OpDesk ("OpDesk", "we", "us", "our") provides a workforce management platform — accessible via our website, our web application, and our iOS and Android mobile apps (together, the "Service") — used by businesses ("Customers") to manage their employees' scheduling, attendance, leave, tasks, and related HR functions.
If you are an employee using OpDesk because your employer has set up an account for you, your employer is the data controller for your employment-related information, and OpDesk acts as a data processor on their behalf. Questions about how your data is used should usually go to your employer first; we're also happy to help.
Payment card details are entered directly into a secure field provided by our payment processor, Stripe, and are never transmitted to or stored on our own servers. We retain billing history (plan, amount, date, and your card's brand/last 4 digits only) to manage your subscription and provide invoices.
Our iOS and Android apps request the following device permissions and collect the following additional data beyond what the web app collects:
| Data / permission | Why we collect it |
|---|---|
| Location (while using the app) | To confirm you're within your workplace's geofenced area when you clock in or out, if your employer has enabled location-based attendance verification. We do not track your location in the background or outside of the clock-in/clock-out action. |
| Camera / photo library | If you choose to upload or update a profile photo. |
| Push notifications | To notify you about schedule changes, task assignments, chat messages, and leave request updates. |
| Device & advertising identifiers | Our apps display advertising served by Google AdMob. AdMob may collect your device's advertising identifier (IDFA on iOS, Advertising ID on Android) and other device information to serve and measure ads. See "Advertising" below. |
Our mobile apps display banner advertisements provided by Google AdMob, a third-party advertising network. AdMob may collect device identifiers and usage data to serve ads and, where you've granted permission, personalized ads. On iOS, we ask for your permission via Apple's App Tracking Transparency framework before any identifier is used for tracking; you can change this at any time in your device's Settings → Privacy → Tracking. On Android, you can reset or opt out of your Advertising ID in your device's Google Settings → Ads.
We do not control how Google AdMob or its advertising partners use data they collect directly. You can review Google's own privacy practices at policies.google.com/privacy and their advertising-specific policy at policies.google.com/technologies/ads.
We do not sell your personal information. We share information only with:
Your data is stored on servers we operate and is protected by industry-standard measures including encrypted connections (HTTPS), hashed passwords, and access controls limiting who can view your data internally. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we take reasonable, industry-appropriate steps to protect your information.
We retain your information for as long as your account is active, and for a reasonable period afterward to comply with legal, accounting, or reporting obligations (for example, billing records). When a company account is deleted (see Section 9), we deactivate access immediately and mark the account and associated data for deletion; some records may be retained longer where required by law (e.g. financial records related to processed payments).
Depending on where you're located, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us using the details in Section 13, or — for employment data — your employer/company admin, who can update or remove your records directly within OpDesk.
You can permanently delete your company's OpDesk account and data at any time:
This action is available to account Owners and Admins, since it deletes data for the whole company, not just one person. Deleting your account will:
If you're an individual employee and don't have Owner/Admin access, or if you're unable to log in and need your data removed, email us at the address in Section 13 and we'll process your request directly.
OpDesk is a workforce management tool intended for use by employed adults and is not directed at, nor knowingly used to collect information from, children. If you believe a child has provided us with personal information, please contact us and we will delete it.
Our website and web app use cookies that are strictly necessary for the Service to function (for example, keeping you logged in and protecting against cross-site request forgery). We do not currently use cookies for advertising or cross-site tracking on the website.
We may update this policy from time to time. We'll update the "Last updated" date above, and for material changes, we'll make reasonable efforts to notify account Owners/Admins directly (e.g. by email or an in-app notice).
Questions about this policy or your data?
Email: privacy@opdesk.com.au