ClearBoard
Log in

Privacy Policy

Last updated: 16 July 2026

ClearBoard ("we", "us") provides workforce compliance, clearance and onboarding record-keeping software for Australian businesses. This policy explains what personal information we collect, why we collect it, how it is stored and protected, and the rights you have over it. We handle personal information in accordance with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth).

Who this policy covers

  • Customers — the businesses that subscribe to ClearBoard and their staff who use the app.
  • Workers and new hires — people whose employer uses ClearBoard to collect onboarding documents and track credentials. Your employer is the primary record-holder; ClearBoard processes this information on their behalf.
  • Website visitors — people browsing clearboard.cloud.

What we collect

  • Account details — name, work email address, company name and role, collected when an account is created.
  • Onboarding records — information a new hire submits through their secure onboarding link: identity and right-to-work details, signed statutory forms (such as the ATO Tax File Number declaration and Superannuation Standard Choice form), policy acknowledgments and requested document uploads.
  • Tax File Numbers and bank details — collected only when a hire submits them through the onboarding portal. These are encrypted the moment they are received (see Security below) and handled in line with the Privacy (Tax File Number) Rule 2015.
  • Billing details — handled by Stripe, our payment processor. We never see or store full card numbers.
  • Usage and log data — standard technical logs (IP address, browser type, pages requested) used to keep the service secure and reliable. Sensitive values are scrubbed from application logs.

Why we collect it

  • To provide the service: guided onboarding, document collection, credential expiry tracking, and compliance record-keeping.
  • To meet legal obligations your employer has under Australian law (for example Fair Work record-keeping and ATO requirements).
  • To secure the service, prevent fraud and misuse, and to communicate with you about your account.

We do not sell personal information, and we do not use it for advertising.

Where your data lives

All customer records are stored in Australia, in the AWS Sydney region (ap-southeast-2), via our database provider Supabase. Application hosting is provided by Vercel, with serverless functions pinned to the Sydney region.

Security

  • Tax File Numbers, BSBs and bank account numbers are encrypted at rest with dedicated vault encryption and are masked everywhere they appear in the app. Viewing an unmasked value requires an authorised role and is written to an audit log.
  • All data is encrypted in transit (TLS) and at rest.
  • Each customer's data is isolated with database row-level security.
  • Long-term archives are encrypted to a key only the customer holds (the open-source age standard) — ClearBoard cannot read them.

Third-party services (sub-processors)

  • Supabase (database & storage, AWS Sydney) — all customer records.
  • Vercel (application hosting) — serves the app and website.
  • Stripe (payments) — subscription billing.
  • Resend (email delivery) — transactional email such as onboarding invitations and reminders.
  • Google Workspace / Microsoft 365 — only if your employer connects them, to create and deactivate staff accounts during onboarding and offboarding.

Google Workspace and Microsoft 365 data

If a customer connects their Google Workspace or Microsoft 365 tenancy, ClearBoard uses that connection solely to provision, update and deactivate user accounts as part of onboarding and offboarding, at the customer's direction.

ClearBoard's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not allow humans to read it except with your consent, for security purposes, or as required by law.

Retention and deletion

Some records must be kept for legally mandated periods (for example, employee records under the Fair Work Act are kept for 7 years). Document uploads carry retention rules and are automatically deleted when their retention period ends. When a customer leaves ClearBoard, they can export their records, and remaining data is deleted after any statutory retention periods expire — a process with a human in the loop, confirmed in writing.

Your rights

You may request access to, or correction of, personal information we hold about you. If your records are held on behalf of your employer, we may refer the request to them as the record-holder. To make a request, or to complain about how your information has been handled, contact us at founder@clearboard.cloud. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Changes to this policy

We will post any changes to this policy on this page and update the date above. Material changes will be notified to customers by email.