PRIVACY NOTICE · AUSTRALIA
Privacy Notice
1. Information the service may hold
Depending on enabled modules: account and verification details; organisation settings; customer/enquiry records; quotes, bookings and jobs; staff/worker/contractor records; documents and qualifications; communications; call/SMS/email metadata and recordings where enabled; invoices/payments; social/content records; support complaints; AI task history; integration metadata; audit/security events and policy acknowledgements.
2. Purposes
Information may be used to verify accounts, provide the workspace, operate customer and workforce workflows, route communications, provide support, maintain security, record audit evidence, generate user-requested AI assistance, investigate incidents/complaints, meet lawful record obligations and improve service reliability. Personal information should not be repurposed incompatibly without an appropriate basis.
3. Transparent AI and automated workflows
Automated tools can classify, route, summarise and recommend. Consequential outcomes require human oversight. Where applicable, privacy policies and notices should explain significant automated decision arrangements. Australian APP 1 amendments concerning certain significant automated decisions commence on 10 December 2026.
4. Organisation isolation and access
Records are designed to be scoped by organisation. Server-side role checks restrict sensitive governance views. Owners/senior users may access organisation-wide audit, security and complaint administration where authorised; ordinary users receive role-relevant access. Confidential complaint routing can restrict access from a conflicted manager.
5. Security
Controls include verified registration, strong passwords, HTTP-only sessions, rate limits, optional MFA, role checks, provider secrets kept server-side, security alerts, append-only governance evidence and cryptographic hash chaining. Production infrastructure must add encryption-at-rest, managed key/secrets services, monitoring, backups, restoration testing and secure deployment practices.
6. Connected providers and overseas disclosure
A provider appears in Oprun only as an option. Your data is sent to a telephony, email, AI, social, storage, payment or accounting provider only after you or the operator connect and authorise it. Some providers process information outside Australia. The Connected Services page lists the providers and what each one is used for. Where we disclose personal information overseas we take reasonable steps to make sure the recipient handles it in line with the Australian Privacy Principles.
7. Where your information is kept
Your business records are kept in the service database and your uploaded files in the service’s file storage. Both are separated by business, so each business can only reach its own records. Sign-in tokens for connected platforms and payment provider keys are stored encrypted and are never shown back in the app. Passwords are stored as one-way hashes. Our hosting provider protects the underlying infrastructure.
8. Retention, restriction, deletion and de-identification
We keep information only as long as it is needed for the purpose it was collected, or as the law requires. If a trial ends without a paid plan, the workspace is read-only for 30 days, then archived for a further period (183 days by default), with a final 14-day window to restore it before deletion becomes due. These periods can be changed with notice. When information is no longer needed we destroy or de-identify it unless the law requires us to keep it. Deleted information is removed from backups as those backups expire.
9. Access, correction, export and complaints
You can ask to see, correct or export the personal information we hold about you, or ask us to delete it. Business owners can export business records from the workspace. Contact us through the Help & Complaint Desk. If you are not happy with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
10. Data breach response
We contain, investigate and assess security incidents. Where an incident is an eligible data breach under the Notifiable Data Breaches scheme, we notify affected people and the OAIC as the law requires, and tell affected businesses without delay so they can meet their own duties.
11. Marketing
Marketing messages we send identify us, carry an unsubscribe option and are only sent where you have agreed or the law allows. Service messages about your account are kept separate from promotions. Businesses that use Oprun to message their own customers are responsible for their own consent records.
12. Children and sector-specific information
The standard business workspace is not designed as a child-directed service. Health, legal, financial, education, disability, government and other regulated sectors may require additional privacy, security, retention and contractual controls before use.
13. Our role and your customers’ information
For our own account, billing and support records about you, Oprun is the organisation responsible for the information. For the customers, workers and contacts you add to your workspace, you are responsible for them and we handle that information on your instructions to provide the service. You must have a lawful reason to collect it and tell those people how you use it.
14. What the platform operator can see
Our operator console shows account-level information only: your business name and category, plan, subscription and payment status, the account holder’s name and contact details, add-ons and billing history. It does not list your customers, workers, jobs, messages or files. We do not browse the contents of your workspace. If a support request needs us to look at something inside it, we will ask you first.
15. Cookies and device storage
We use a sign-in cookie that is needed for the service to work, and small amounts of storage on your device to remember preferences such as theme. We do not use advertising cookies in the workspace.
Job applicants
If you apply for a job through a link from a business that uses Oprun, that business decides what to ask for and why. Oprun provides the system that receives your application. The business collects your name, contact details, message and any documents you choose to upload. It is shown only to the business owner and its authorised admins, is kept apart from the business's customer and job records, and is deleted automatically after 12 months unless you or the business ask for it to be deleted sooner. AI may help the business read your application, but a person makes every hiring decision. To see, correct or delete your information, contact the business directly. If you cannot reach them, contact us through Support and we will pass your request on.
16. Contact
Privacy questions, access requests and complaints can be sent through the Help & Complaint Desk in the workspace. Our Complaints Procedure explains how we respond.
Communication activity
Where enabled, the workspace stores provider message identifiers, delivery and email-open signals, reply timestamps and follow-up activity to help the sending business manage correspondence. An email-open signal is not proof that a person read the email. Notification preferences belong to each user and business. Owners can control eligible 24-hour follow-ups from the delivery activity panel.