Shedtally Privacy Policy
This policy explains how Sebastian Boardman, trading as Shedtally ("Shedtally", "we", "us") collects, uses and protects personal information, in line with the Privacy Act 2020. Shedtally is the organisation that collects and holds the information described in section 2. You can contact us by email at the contact email shown under Get help in the app. That's a temporary address until Shedtally's own email is set up; we'll update this page when it changes. Our postal address is available on request from the same email address.
In short: we collect what we need to run your account and bill your business. A business's work records (dockets, hours, photos, incidents) belong to that business, and we only hold them for it. Your data is stored in Auckland. Shedtally doesn't track anyone's location. We don't sell personal information. You can ask to see or correct what we hold about you.
1. Two kinds of information
Information we're responsible for. This means information about the people who sign up for Shedtally, the contacts at our customers, people who contact us, and the sign-in details of everyone who uses Shedtally. This policy covers it.
Information we hold for our customers. When a business uses Shedtally, it puts in information about its staff, drivers, customers, subcontractors and others (for example dockets, hours, photos and incident reports). That business is responsible for that information, and its own privacy policy applies. We only hold it on the business's behalf to provide Shedtally, and we don't use it for our own purposes. A business can choose to let its own accountant or bookkeeper (an Advisor) see its money figures and its pay and hours records in Shedtally, read-only. Pay rates are shown to an Advisor only if the business allows it. That's the business's decision, made under its own privacy obligations, and it can remove that access at any time. If you're a driver or staff member with a question about your work records, please ask your employer first. We'll help them answer you.
2. What we collect
- Account details: your name, business name, NZBN, role, email address and mobile number.
- Advisors: if a business invites its accountant or bookkeeper, we hold the advisor's name, email address, firm and sign-in details, when they accepted our Advisor Terms of Use, and a log of what they viewed or exported. We use these only to give the advisor access for that business, keep it secure, and support them. An advisor who works for several businesses has separate access to each, and never sees one business's information through another. We don't add advisors to any marketing list unless they ask us to.
- Sign-in details: a PIN or password (stored only in a protected, hashed form), two-factor sign-in settings, and passkeys if you add one.
- Billing details: billing contact, invoices and payment history. Card and bank details are handled by our payment provider, Stripe. We don't see or store full card numbers.
- Usage and device information: when you sign in, the features you use, your device and browser type, and error reports. This helps us keep Shedtally secure and working. We remove personal details from our application logs.
- What you send us: support requests through Get help, and feedback.
- Marketing preferences: whether you've agreed to hear from us.
What we don't collect: Shedtally doesn't record or track the location of the people who use it, and it removes location details from photos uploaded through the app. Delivery addresses in a customer's records are addresses of sites, not of people.
We collect most of this from you directly. Some comes from your employer when they invite you to Shedtally (your name, mobile and email), and some from public sources such as the NZBN register (your business's legal name and address). If you apply through our website, the website's privacy notice also applies.
2A. Documents a business keeps about its people
A business can use Shedtally to keep its staff's and drivers' work documents, and to warn them before they expire. These can include: driver licences (class, endorsements, number and expiry); dangerous goods and forklift endorsements or tickets; first aid certificates; medical certificates; and evidence of the right to work in New Zealand (a passport or visa, or a record that the business has checked it). Each may include a photo or PDF, the document number, the issuer and the expiry date.
- Who's responsible: the business. It decides which documents to keep and why, under its own privacy obligations. Shedtally holds them for the business, and doesn't use them for anything else.
- Why: so the business can check that people are licensed and certified for the work they do, meet its health and safety and immigration obligations, and get warnings before anything expires.
- Who can see them: only the person the document is about, and the business's owner and admins, who must use two-factor sign-in. Office staff can add a document for someone, but can't open it afterwards. The business's accountant or bookkeeper can't see them, and neither can its customers.
- Medical and identity documents: these are the most sensitive. A business should keep them only if it needs them. For the right to work, it can record that it has checked the person's entitlement (how, when and by whom) instead of keeping a copy. A medical certificate should show only what the business needs to know, such as whether the person is fit for the work and until when, and not diagnoses.
- How long they're kept: while the person works for the business, with these limits on the copies (the photo or PDF):
- when a document is replaced, the old copy is deleted after 90 days (a medical certificate's old copy after 30 days);
- a medical certificate's copy is deleted 30 days after it expires;
- a copy of a passport or visa is deleted 90 days after the right to work was checked. The record of the check (how, when, by whom, and the visa expiry) is kept instead;
- when someone leaves, their document copies are deleted 3 months later (the business can set between 1 and 12 months).
- Your rights: you can see your own documents in the app at any time, and download them. To correct or remove one, ask your employer, who is responsible for them. You can also contact us at the contact email shown under Get help in the app, and we'll help your employer respond. If you're not happy with the response, you can complain to the Privacy Commissioner at www.privacy.org.nz.
3. Why we use it
- To create and run your account, and to sign you in securely.
- To provide, support and improve Shedtally.
- To bill your business.
- To tell you about changes to Shedtally or our terms, and about security issues.
- To send news and offers, but only if you've agreed. You can unsubscribe at any time.
- To meet our legal obligations, such as keeping tax records.
Some details are needed to set up an account (your name, business, email and mobile). Without them we can't set up your account. Other details are optional.
4. Who we share it with
We share personal information only with:
- the service providers who help us run Shedtally (listed in section 5), and only to the extent they need it;
- our professional advisers (accountant, lawyers, insurers), in confidence;
- Shedtally Limited, when it's incorporated and takes over running Shedtally, and any later buyer of the business, on the condition that they protect it in the same way; and
- anyone the law requires us to disclose it to, or where the Privacy Act allows it (for example to prevent a serious threat to someone's safety).
We don't sell personal information.
5. Where it's stored, and our service providers
Shedtally's records are stored in Microsoft Azure's New Zealand North region, in Auckland. The emails we send (invitations, sign-in and password-reset links, trial and account messages) are processed in Australia by Microsoft Azure Communication Services, and aren't kept there as our records after sending. Some of our service providers are overseas:
| Provider | What it does for us | Information involved | Location |
|---|---|---|---|
| Microsoft Azure | Hosting: app servers, database, photo storage, backups, logs | All Shedtally records | New Zealand North (Auckland) |
| Microsoft Azure Static Web Apps | Delivers the app's code to your device | No account or customer records | Microsoft's global network |
| Stripe | Subscription billing and payments | Billing contacts, payment details, invoices | United States / Ireland |
| Microsoft Azure Communication Services | Sends sign-in, invitation, password-reset, trial and account emails from mail.shedtally.com | Recipients' names and email addresses, and the message content (including one-time sign-in and reset links) | Processed in Australia; not kept as our records after sending |
| Apple, Google and Mozilla push services | Deliver notifications to phones and browsers | Short notification text, with no names or addresses | United States |
Where a provider only holds or processes information for us, we stay responsible for it. Stripe also uses some billing information for its own purposes, such as preventing fraud and meeting its legal obligations, under its own privacy policy. It may store that information outside New Zealand, where it may not be protected in the same way as New Zealand law requires. By paying through Stripe, you agree to that. Services a business connects itself, such as Xero or a telematics provider, are that business's providers, and their own policies apply.
6. How long we keep it
We keep account information while your business uses Shedtally, and for up to 12 months after its account closes, unless you ask us to delete it sooner. An advisor's details are kept while they have access, and for up to 12 months after the business removes them. The log of what they viewed is kept with the business's records. We keep billing records for 7 years, as tax law requires. After that, we delete or de-identify it. When a business's free trial ends without a plan, or its paid subscription is cancelled, its records are kept read-only for 6 months, so it can export them or subscribe again. We warn the account owner 30 days and 7 days before the end. After 6 months the records are deleted (within 30 days, and from backups as they expire). A business can also close its account sooner: it then has 30 days to export, and the records are deleted within 90 days.
7. Security
We protect personal information with measures such as encryption in transit and at rest, separation between customers that is checked by automated tests, two-factor sign-in for owners and admins, secrets kept in a key vault, and backups kept in a separate account. No system is perfectly secure. If a privacy breach is likely to cause serious harm, we'll tell the people affected and the Privacy Commissioner, as the law requires.
8. Your rights
You can ask for the personal information we hold about you, and ask us to correct it. We'll respond as soon as we can, and within 20 working days. Contact our privacy officer, Sebastian Boardman, at the contact email shown under Get help in the app.
If you're not happy with our response, you can complain to the Office of the Privacy Commissioner at www.privacy.org.nz.
9. Cookies and device storage
The app uses only the storage on your device that it needs to sign you in, work offline, and remember simple settings (for example whether you've been asked about notifications). It doesn't use analytics or advertising cookies. If that changes, we'll update this policy first.
10. Changes
We may update this policy. We'll publish the new version here with its date, and tell account owners by email about significant changes.