Privacy Policy

1. Who we are

FairWork Mate (https://fairworkmate.com.au) is operated by FairWork Mate (ABN 89 683 151 304), an Australian registered business. We handle personal information in accordance with the Australian Privacy Principles (APPs) in the Privacy Act 1988. For privacy questions, contact hello@fairworkmate.com.au.

2. The short version

• Calculators: run in your browser. Seven calculators (listed in Section 3) send the figures you entered and the result to us with an anonymous session ID so we can improve them — never your name, email or IP address.
• AI advisor (free, anonymous): messages are PII-scrubbed before reaching our servers or the AI provider. Anonymous chats are deleted within 24 hours. We keep only an anonymised daily count of question themes (no message text, no identifiers) for product analytics.
• AI advisor (signed-in paid tiers): we keep your email + plan + per-period usage to bill correctly and show your chat history. Chat history is kept according to your plan — 90 days on the 7-Day Pass, Plus and signed-in free accounts, 6 months on Pro, 12 months on business plans, unlimited on Premium and Enterprise — then auto-deleted. On the 7-Day Pass your saved chats are visible while the pass is active.
• Document upload (Pro / Business / Premium / Enterprise): uploaded files are PII-scrubbed for the AI but kept in Supabase Storage for 30 days for audit, then deleted.
• Payment: Stripe handles your card. We never see or store it — only your Stripe customer ID.
• No sale of personal information. Ever.

3. Calculator tools

Calculations run in your browser. Seven calculators — take-home pay, superannuation, redundancy pay, second-job tax, bonus tax, super recovery and the redundancy Centrelink waiting period — send the figures you entered and the result to our server with an anonymous session ID so we can see which scenarios people run and improve the tools. You can optionally add an age bracket and gender. We never receive your name, email address or IP address from a calculator, the session ID is not linked to any account, and calculator data is never sold. Every other calculator sends nothing.

4. AI Workplace Advisor

The AI advisor at /advisor processes your questions to provide general workplace information:

• PII scrubbing: Before your message is processed, we automatically detect and remove personal information including tax file numbers, ABNs, Medicare numbers, phone numbers, email addresses, bank account / BSB numbers, and street addresses. Scrubbing runs both in your browser and again on the server as defence-in-depth.
• Anonymous use: If you use the advisor without signing in, we store your scrubbed messages and the AI's responses linked to a session token (random ID, not tied to your identity) and a hashed IP for rate limiting. Anonymous chat history is deleted within 24 hours.
• Signed-in use: We also store your account email against each chat so we can show your chat history across devices (7-Day Pass, Plus, Pro, Business, Premium and Enterprise). The auto-generated chat titles (short labels for the sidebar) are generated by the AI from your first message. Signed-in chat history is kept for your plan's retention window (90 days on the 7-Day Pass, Plus and free accounts, 6 months on Pro, 12 months on business plans, unlimited on Premium and Enterprise), and each plan keeps a rolling window of your most recent chats. History is deleted sooner if you delete the chat yourself from the sidebar or delete your account.
• AI provider: Scrubbed messages are sent to our AI model provider (named in Section 12) for processing. Scrubbing removes identifiers but is pattern-based, so treat it as a strong safeguard, not a guarantee — anything the patterns don't catch (such as a person's name) will reach the provider. Your messages are not used to train the provider's models.
• Retrieval: To find the decisions, agreements and legislation relevant to your question, the scrubbed text is also sent to an AI embedding provider (Section 12), which returns a search vector. It is not used to train that provider's models.
• Rate limiting: We store a cryptographically hashed version of your IP address to enforce free-tier limits. The hash cannot be reversed to identify you.
• Cost + abuse logging: We log token consumption per query (counts only — not the message content) against your account or hashed IP for billing reconciliation and abuse detection.

5. Document upload (paid tiers)

Pro, Business, Premium and Enterprise customers can upload documents (PDF, Word, plain text) for the AI to review:

• Text extraction + PII scrubbing: Text PDFs and Word documents are extracted server-side and put through the same PII scrubber as chat messages before the AI reads them. Scanned or photographed documents are transcribed by the AI model first (the page images go to our AI model provider under the same no-training terms), and the transcript is scrubbed before it is stored.
• Storage: The original file is stored in Supabase Storage keyed by a hashed version of your email so the bucket layout doesn't reveal who uploaded what. The extracted text is stored in our database. Both are hosted by Supabase in Tokyo, Japan — see Section 13.
• Retention: Files and extracted text are auto-deleted 30 days after upload by a daily retention cron. You can also remove a document at any time by deleting the chat it's attached to.
• Quota: We log per-month upload counts against your email so we can enforce your plan's limit.

6. Payment + subscription data

Paid plans are billed by Stripe. When you subscribe:

• Stripe handles your card. Card details are entered on Stripe's own checkout page, hosted by Stripe. We never see, transmit or store your card details.
• We store: your email address, your Stripe customer ID, your current plan, your per-period AI question consumption, and a per-month document upload count. This is the minimum needed to enforce your plan and bill correctly.
• Receipts + invoices: Issued by Stripe to the email you provide at checkout.
• Cancellation: You can cancel a subscription at any time from your account dashboard. Cancellation takes effect at the end of your current billing period.

Stripe's privacy practices are described in Stripe's Privacy Policy.

7. API tiers (legacy customers only)

The API tiers are closed to new subscriptions; this section applies to existing API customers who integrate our REST API into their own software. We log:

• API call counts (for quota enforcement and overage billing)
• The endpoint called and timestamp
• Your API key (or a hash of it) as the requester

We do not log request bodies in production. We do not retain response payloads. API call logs are retained for 90 days for billing reconciliation and abuse detection, then deleted.

8. Template tools (letter generators)

Some tools on this site generate template documents (such as a letter to an employer about a pay query). When you use a template tool:

• Form inputs (employer name, pay rate, dates, etc.): processed in your browser to produce the document. If you choose to have a copy emailed to you, these values are sent to our server only long enough to generate the PDF and send the email, then discarded. We do not retain them.
• Generated PDF: generated in memory and either downloaded to your device or attached to the email we send you. We do not store a copy.
• Your email address (if you ask for an emailed copy): used only to send that one email via Resend. We do not add it to any marketing list unless you separately subscribe.
• Consent record: we record a timestamp, a hashed IP, your browser user-agent, which confirmations you ticked, and whether you chose to be redirected to the Fair Work Ombudsman instead. We retain this for up to seven years as an evidence trail.
• AI document builders (resume, pay-rise pack, speaking notes): with your consent, the details you enter are sent to our AI model provider (Section 12) to draft the document. They are not scrubbed — the document needs them — and are not used to train AI models. The finished document is kept for 72 hours so you can download or regenerate it, then deleted.

9. Newsletter + email subscriptions

If you sign up to the FairWork Mate newsletter, we store your email address in our database and (where applicable) in our email service's audience list. You can unsubscribe at any time from any newsletter we send, or by emailing hello@fairworkmate.com.au. Unsubscribe is honoured within 1 business day.

Account emails you switch on. Some emails are about your own account and go only to you: deadline reminders for a dismissal date you saved (7, 3 and 1 day before, and on the day), a one-off note the day before your 7-Day Pass ends, and alerts for agreements or awards you watch. For a deadline reminder we store the date you entered and your account email — nothing about your situation. Every one of these emails has a one-click link to stop it, and we never add you to the newsletter because of them.

10. Analytics + advertising

We use Google Analytics 4 (GA4) to understand how visitors use our website. GA4 collects pages visited, referring source, general geographic location, device + browser type, and anonymised interaction data. GA4 does not collect personally identifiable information.

You can opt out via the Google Analytics Opt-out Browser Add-on.

Mediavine Programmatic Advertising (Ver 1.1)

The Website works with Mediavine to manage third-party interest-based advertising appearing on the Website. Mediavine serves content and advertisements when you visit the Website, which may use first and third-party cookies. A cookie is a small text file which is sent to your computer or mobile device (referred to in this policy as a "device") by the web server so that a website can remember some information about your browsing activity on the Website.

First party cookies are created by the website that you are visiting. A third-party cookie is frequently used in behavioral advertising and analytics and is created by a domain other than the website you are visiting. Third-party cookies, tags, pixels, beacons and other similar technologies (collectively, "Tags") may be placed on the Website to monitor interaction with advertising content and to target and optimize advertising. Each internet browser has functionality so that you can block both first and third-party cookies and clear your browser's cache. The "help" feature of the menu bar on most browsers will tell you how to stop accepting new cookies, how to receive notification of new cookies, how to disable existing cookies and how to clear your browser's cache. For more information about cookies and how to disable them, you can consult the information at All About Cookies.

Without cookies you may not be able to take full advantage of the Website content and features. Please note that rejecting cookies does not mean that you will no longer see ads when you visit our Site. In the event you opt-out, you will still see non-personalized advertisements on the Website.

The Website collects the following data using a cookie when serving personalized ads:

• IP Address
• Operating System type
• Operating System version
• Device Type
• Language of the website
• Web browser type
• Email (in hashed form)

Mediavine Partners (companies listed below with whom Mediavine shares data) may also use this data to link to other end user information the partner has independently collected to deliver targeted advertisements. Mediavine Partners may also separately collect data about end users from other sources, such as advertising IDs or pixels, and link that data to data collected from Mediavine publishers in order to provide interest-based advertising across your online experience, including devices, browsers and apps. This data includes usage data, cookie information, device information, information about interactions between users and advertisements and websites, geolocation data, traffic data, and information about a visitor's referral source to a particular website. Mediavine Partners may also create unique IDs to create audience segments, which are used to provide targeted advertising.

If you would like more information about this practice and to know your choices to opt-in or opt-out of this data collection, please visit National Advertising Initiative opt out page. You may also visit Digital Advertising Alliance website and Network Advertising Initiative website to learn more information about interest-based advertising. You may download the AppChoices app at Digital Advertising Alliance's AppChoices app to opt out in connection with mobile apps, or use the platform controls on your mobile device to opt out.

For specific information about Mediavine Partners, the data each collects and their data collection and privacy policies, please visit Mediavine Partners.

11. Cookies

• Essential: Session cookie (fwm-session) for signed-in users, set as HttpOnly + Secure. Required to keep you logged in.
• Preference: Audience cookie (fwm-audience) remembers whether you told us you're asking as an employee, employer or adviser. Kept for 1 year; contains no personal information; cleared by choosing "Just browsing".
• Analytics: Google Analytics. Can be disabled via your browser or the GA opt-out add-on.
• Advertising: Mediavine (free audience only). See Section 10 for opt-out.

12. Subprocessors

Third parties that process personal information on our behalf:

• Vercel — website + API hosting. Runtime data is processed in the Sydney (syd1) region; static assets and edge routing are served from Vercel's global network. See Vercel Privacy Policy.
• Supabase — Postgres database + storage, hosted in Tokyo, Japan (AWS ap-northeast-1). See Supabase Privacy Policy.
• Anthropic — AI model provider for the advisor, document review, scanned-document transcription and the AI document builders. See Anthropic Privacy Policy.
• OpenAI — AI embedding provider used to index and search our case, agreement and legislation corpus. The scrubbed text of your question (and, on business plans, your uploaded organisation documents) is sent to compute a search vector. See OpenAI Privacy Policy.
• Stripe — payment processing. See Stripe Privacy Policy.
• Resend — transactional email (one-off PDF copies + newsletter). See Resend Privacy Policy.
• Google — Analytics + Google OAuth sign-in. See Google Privacy Policy.
• Microsoft — optional Microsoft sign-in. See Microsoft Privacy Statement.
• Mediavine — display ad partner. See Mediavine Privacy Policy.

13. Data residency + security

Application compute runs on Vercel in Sydney, Australia. Our database and document storage run on Supabase in Tokyo, Japan (AWS ap-northeast-1). Some subprocessors (AI model and embedding providers, Stripe, Google, Microsoft, Resend) operate global infrastructure — your scrubbed AI requests may be processed in their nearest region. All connections use TLS 1.2 or later.

We encrypt data at rest in the database. Passwords are hashed with bcrypt before storage. Session tokens are short-lived JWTs. We follow the principle of least privilege for internal access.

14. Retention summary

• Calculator inputs: not stored — except the seven calculators in Section 3, whose anonymous telemetry (inputs + result + session ID, no identity) is retained for analytics
• Anonymous chat messages: 24 hours
• Signed-in chat messages: per plan — 90 days (7-Day Pass, Plus, free accounts), 6 months (Pro), 12 months (business plans), unlimited (Premium/Enterprise); sooner if you delete the chat or your account
• Anonymised question themes (aggregate counts only, no text/identifiers): retained for analytics
• Uploaded documents: 30 days (or immediately on account deletion)
• API call logs: 90 days
• AI usage/cost logs (token counts only, no message text): 90 days
• AI document builder outputs (Section 8): 72 hours
• Account record (email + plan): while your account is active, plus 7 years for tax + Stripe reconciliation if you ever paid
• Auth rate-limit records: 7 days
• Template-tool consent records: 7 years
• Analytics data: 12 months

15. Your rights

Under the Australian Privacy Act 1988 you have the right to:

• Know what personal information we hold about you
• Access that information
• Request correction of inaccurate information
• Request deletion of your account + associated data
• Complain about a breach of the APPs

To exercise any of these, email hello@fairworkmate.com.au from your account email. We'll respond within 30 days.

If you believe we've breached the APPs, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

16. Children

This website is not directed at children under 16. We do not knowingly collect personal information from children.

17. International users

FairWork Mate is built for Australian workplaces. If you access the site from outside Australia, your data is processed in Australia (application compute) and Japan (database + document storage), plus the subprocessor regions listed in Section 12. We do not target users in the EU/UK, but if you're an EU/UK user using the site, you can still exercise the rights in Section 15.

18. Changes

We may update this privacy policy from time to time. Material changes will be highlighted at the top of this page and emailed to active paid subscribers. The "Last updated" date at the top reflects the most recent revision.

19. Contact

FairWork Mate · ABN 89 683 151 304.
Email: hello@fairworkmate.com.au.

Also see our Terms of Service.