Privacy Policy
PayQuery is operated by Tokoloshe.ai ("we", "us"). This policy explains what information we handle, how we use it, and the choices you have. We handle data in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth).
What we handle
- Account information — your name, work email, firm name, and role, used to give you access to your firm's workspace.
- Project data you upload — timesheets, payslips, employee records and related payroll data you provide to run a recalculation. This may include personal information about employees who are not our users.
- Usage information — basic technical logs (request times, errors) used to keep the service running and secure. We do not run advertising trackers.
How we use it
We use project data only to perform the recalculations and produce the outputs you ask for, and to support you in using the service. We do not sell your data, and we do not use your project data to train external models.
Your firm's data is isolated
Each firm's workspace is logically separated from every other firm's. A firm cannot see another firm's projects. Access to a specific project is granted explicitly by your firm; people see only the projects they have been given access to.
Where it's stored
Our database and file storage is provided by Supabase, hosted in the Sydney (Australia) region — your project data and account information are stored in Australia. Our application servers are hosted by Railway. Confirm Railway's hosting region with your lawyer — if it isn't also Australia, say so plainly here rather than implying everything is AU-hosted.
Who else handles your data (sub-processors)
We use a small number of specialist providers to run the service. Each only receives the data it needs to do its job, under a contract with us:
- Supabase (database, file storage, authentication) — Sydney, Australia. Holds all project data, account information, and uploaded documents.
- Anthropic (AI models) — used for two optional features: extracting draft figures from an uploaded award or enterprise agreement PDF for a human to check (never used to decide an entitlement on its own), and PayQuery Copilot, a read-only assistant that answers questions using only the data your firm can already see in PayQuery. Confirm Anthropic's current data-processing terms and hosting region with your lawyer — as at this draft, Anthropic's API does not offer an Australia-only processing region, so content sent to these two features is very likely processed outside Australia. Anthropic does not use API data to train its models by default; confirm this against Anthropic's current commercial terms before publishing.
- Resend (transactional email) — sends account emails only: invitations, email verification, password resets, and notifications like "your report is ready" or "you've been granted access to a matter." Resend receives the recipient's name, email address, and the content of that specific email — never your uploaded project data.
- Sentry (error monitoring) — currently disabled by default. If enabled, Sentry receives technical details about an application error (which page, what went wrong, a request ID) to help us fix bugs. It is not used unless we deliberately turn it on for a deployment, and should not receive uploaded payroll data even when on — flagged here so that remains a design constraint, not just an assumption.
If something goes wrong (data breach notification)
If we become aware of a data breach involving your information that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), without undue delay once we've completed a reasonable assessment. This paragraph states the legal minimum; your lawyer may want to add a specific notification timeframe or process (e.g. "within 72 hours of confirming the breach") as a stronger commercial commitment.
How long we keep it
We keep project data for as long as needed to provide the service for your project, and then according to the retention terms agreed with your firm. You can ask us to delete your data, subject to any record-keeping obligations.
Employee records and whose obligations apply
The people whose data appears in your uploaded timesheets and payslips are generally your client's employees or former employees, not ours or yours. We act as a service provider processing that data on your firm's instructions. Confirm with your lawyer whether the Privacy Act's "employee records" exemption (which applies to an employer's own handling of its employees' records) extends to PayQuery's processing here, given PayQuery is a third-party service provider rather than the employer itself — this affects what this section needs to say and shouldn't be assumed either way.
Your choices and rights
- You can access and correct your account information.
- You can request a copy or deletion of data we hold about you.
- You can raise a privacy concern with us, and escalate to the Office of the Australian Information Commissioner (OAIC) if not resolved.
Contact
Privacy questions: privacy@payquery.com.au or via our contact form.