Privacy Act 1988 (Cth) • Australian Privacy Principles (APP 11) • UK Data Protection Compliance
WorkCatch ("we", "our", or "us"), operated under Australian Business Number (ABN): 64 257 674 634, located in Sydney, NSW, Australia, is dedicated to protecting the privacy of trade contractors and callers in strict compliance with the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs, specifically APP 11 security and retention obligations), alongside applicable UK data protection laws for UK users.
1. Information We Collect & Express Recording Consent
To deliver real-time missed-call notifications and mobile Job Cards, we collect and process:
- Contractor Account Data: Business name, ABN, mobile contact number, trade specialisation, and operating hours.
- Telephony & Caller Data: Inbound caller phone numbers (E.164 normalized), call timestamps, call duration, and call status.
- Call Recording Express Consent: All inbound voicemail greetings explicitly instruct callers to "leave a recorded message after the tone", establishing express consent before recording begins in compliance with Australian Surveillance Devices legislation.
2. Zero-Eavesdropping Architecture & Purpose of Collection
All audio recordings and customer phone numbers are processed strictly for automated alert notifications directed to the contractor. We do not sell, rent, monetize, or disclose customer audio or personal information to third-party advertisers or data brokers under any circumstances. WorkCatch operates on a zero-eavesdropping architecture:
- Immediate Carrier Audio Purge: Inbound voicemail audio is transcribed in volatile memory and immediately deleted from telecommunications carrier servers upon encrypted vault storage.
- Token-Gated AES-256 Vault Encryption: Voicemail audio and customer intake transcripts are encrypted at rest using AES-256-GCM keyed to the contractor's private Job Card capability token (
/j/:token). Platform administrators cannot listen to voicemails or inspect verbatim transcripts in the database.
- Event-Only Message Ledger: Communications logs record only structured event telemetry (template IDs, delivery status, and field detection flags) rather than raw customer message bodies.
- Off-Platform Communication: Once a contractor dials or texts a customer back from their handset, all ongoing communication occurs directly over standard cellular carrier networks outside WorkCatch.
3. Exact 14-Day Data Retention & Destruction Lifecycle
In accordance with Australian Privacy Principle 11, data is retained strictly as long as necessary under an automated lifecycle:
- Hang-Up & Duration Thresholds (≤ 4 seconds): Calls abandoned after the voicemail beep (≤ 4 seconds of empty recording) or unanswered calls trigger a single polite SMS follow-up so genuine customers can text their job details, while pocket dials and silent audio are automatically filtered out and all personal lead data is purged after 14 days under APP 11.
- Hours 0 to 72 (Days 1 to 3): Job Card (
/j/:token) is fully interactive with token-decrypted voicemail audio streaming, site photo inspection (purged after 72 hours), tap-to-call, and polite decline buttons.
- Hours 73 to 336 (Days 4 to 14): Temporary site photos are permanently deleted for customer privacy. The Job Card remains active for contractor customer contact and invoicing before converting to an archived billing docket.
- Day 14 Hard Purge (336 Hours): All encrypted voicemail audio in the privacy vault, encrypted transcripts, and capability links permanently expire and are hard-deleted. Customer names and SMS ledger bodies are de-identified, retaining only non-identifying statistical counters (suburb, postcode, genuine job flag).
4. Verified Sub-Processors & Infrastructure Security
All data is processed through verified, enterprise-grade cloud infrastructure and sub-processors with TLS 1.3 encryption in transit and AES-256 encryption at rest:
- Telecommunications & Carrier Gateways: Licensed telecommunications carriers and mobile network gateway partners for voice and SMS delivery.
- Encrypted Database & Cloud Storage: ISO 27001 and SOC 2 Type II certified cloud database infrastructure with Row-Level Security (RLS) and strict cryptographic tenant isolation.
- Voice Processing & Language Intelligence: Enterprise cloud machine-learning and transcription infrastructure.
- Payment Processing: Tier-1 PCI-DSS Level 1 certified payment processing infrastructure — WorkCatch never stores raw credit card details.
- Edge Security & Application Hosting: Enterprise cloud application hosting with TLS 1.3 edge encryption and DDoS protection.
5. Website & Demo Advertising Measurement (workcatch.com.au)
Public visits to workcatch.com.au and Australian interactive simulation demo links (/j/sim_*) use measurement cookies and tags from Google, Meta, and TikTok (managed via Google Tag Manager, which may process browsing and device information overseas) to evaluate advertising performance and deliver relevant updates.
- Strict Separation from Customer Work: As set out in Section 2, real customer Job Cards, caller phone numbers, and voicemail records never load third-party advertising tags or cookies.
- Your Choices & Opt-Out Controls: You can clear or block cookies in your browser settings at any time, or manage ad personalisation via Google Ad Settings (
adssettings.google.com), Meta Ad Preferences, and TikTok Ad Settings.
6. Contact Us
Contractors may request access to, correction of, or permanent deletion of their lead history and audio records at any time. Inquiries and deletion requests can be submitted directly to:
WorkCatch Privacy Officer
Email: [email protected]
Sydney, NSW, Australia