Privacy Policy

Last updated 28 October 2026

Footing is job-management software for Australian trade and construction businesses. This policy explains what personal information we handle, why, where it is stored, and the choices you have. It is written to meet our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Footing is made for businesses. It is not directed at children, and we do not knowingly open accounts for anyone under 18.

In this policy, “we” means Footing, operated by Folkware, ABN 69 340 390 198. “You” means a person whose information we handle. “Customer” means a business that subscribes to Footing.

The two roles we play

This distinction matters, because it changes who you should contact about your information.

• Our own customers. When a builder signs up, we decide how their account information is handled. We are responsible for it, and this policy governs it.
• Data our customers put into Footing. A builder using Footing records details about their clients, staff, sub-contractors and sites. We hold and process that information on their instructions, as their service provider. We do not decide what they collect or what they do with it, and we do not use it for our own purposes. If your builder holds information about you and you want to see, correct or delete it, ask them first — they control it. We will support them in responding.

What we collect

From our customers

• Account and identity: name, email address, phone number, business name, ABN, role.
• Billing: subscription tier, billing cycle, invoice history. Card details go directly to Stripe — we never see or store a card number.
• Usage and technical: pages visited, actions taken, IP address, browser and device type, and server logs used to run and secure the service.

Recorded by our customers about other people

Depending on how a customer uses Footing, this can include:

• Their clients and client contacts — names, email addresses, phone numbers, billing and site addresses, ABNs.
• Their staff and sub-contractors — names, contact details, roles, licences and credentials, insurance details, labour cost and charge-out rates, timesheets and attendance records.
• Job records — sites, schedules, quotes, invoices, payments, variations, purchase orders, photos and documents.
• Work health and safety records — SWMS, JSA and induction forms, incident reports, and the signatures captured on them.
• Signed documents — accepted quotes, variations and progress claims, stored as PDFs with a SHA-256 hash so the signed copy can be shown to be unaltered.

Some of this is sensitive information under the Privacy Act — health information in an incident report, for example. Our customers are responsible for having a lawful basis to collect it. We hold it under the same protections described below.

Why we use it

• To provide the service — running jobs, quotes, invoices, scheduling and compliance workflows.
• To send transactional email — invoices, quote and variation approval requests, invitations, reminders and notifications. These are not marketing.
• To take payment and manage subscriptions.
• To secure the service — authentication, access control, abuse and fraud prevention, and diagnosing faults.
• To support customers who contact us.
• To meet legal and record-keeping obligations.

We do not sell personal information. We do not use customer data to train, fine-tune or otherwise improve machine-learning models.

Where your information is stored

Application data — the databases and uploaded files — is stored in Amazon Web Services in the Asia Pacific (Sydney) region, ap-southeast-2. Each customer’s data lives in its own separate database rather than a shared one.

Some of the providers listed below operate outside Australia, so information can be disclosed overseas as part of running the service. Where that happens we take reasonable steps to ensure the provider handles it consistently with the APPs.

Who else handles it

We use these providers to deliver the service. Each is bound by its own agreement with us.

We also disclose information where the law requires it, or to protect the rights or safety of a person.

AI assistant connections

Footing can be connected to an AI assistant such as Claude or ChatGPT. Any signed-in user can connect their own assistant from Settings → AI Assistant. Nothing is connected until they do.

When connected, that assistant can read and act on the connecting user’s Footing data on their behalf (only what that user can already do in Footing), and information is sent to whichever AI provider they chose. That provider’s own terms then apply to how it is handled. You can disconnect at any time in Settings → AI Assistant: refresh tokens are revoked straight away, and leftover access tokens expire within one hour. We do not send data to any AI provider unless a customer has connected one.

Free tools — Footing Tools

Footing offers free tools that anyone can use without an account: in ChatGPT and Claude (where they are listed as Footing Tools) and in the forms on getfooting.com.au. They make variations, progress claims, payment deadlines, SWMS, quotes, tax invoices, material take-offs and site diaries.

What we receive

• The details you put into the document — for example business and client names, ABNs, addresses, contact details, prices, dates, site notes and safety steps. In ChatGPT or Claude, we receive only the details the assistant passes to our tool to make the document, not your conversation.
• Where the request came from — whether it was ChatGPT, Claude or our website, and any campaign tags in the website link (for example utm_source). We use this to understand which tools are useful. We do not put conversation text or personal information in links.
• Technical information — IP address and browser details, used to limit abuse (requests are rate limited) and to keep the service secure.

Guest documents

Each result is saved as a guest document: a page and a PDF reachable by a long, random link. Anyone with the link can see it, so share it only with the people it is for. Guest documents are deleted 90 days after they are made, unless you save one into a Footing account, in which case it becomes part of that account’s data.

The person a document is sent to can act on it. If they sign a variation or quote, we record their name, signature, the time, their IP address and browser details on the signed copy, with a fingerprint (SHA-256) of the document. If they confirm they received a progress claim, we record their name and the time. If workers sign on to a SWMS, we record each name, company and time. We never email the people a document is for — the person who made it shares the link.

Reminders

For payment deadlines and progress claims you can ask us to email you reminders. We send nothing until you click the confirmation link we email you, every reminder has a one-click unsubscribe, and reminders stop when the document is deleted.

ChatGPT and Claude

When you use the tools in ChatGPT or Claude, OpenAI or Anthropic handles your conversation under their own terms and privacy policies. If you connect your Footing account there, the section above on AI assistant connections applies.

Sharing links you may receive

Footing lets our customers send quotes, invoices, variations and progress updates by an emailed link that opens without a password. Anyone with the link can view that document, so treat it as confidential. Links can be revoked by the customer who issued them.

Signing in to a building site

A builder using Footing can put a sign with a QR code on their site. Scanning it signs you in and out, with no app and no account. The builder is the one collecting your information, for site safety and the work health and safety records the law asks them to keep; Footing stores it for them.

• What you give: your name, mobile, email, company, an emergency contact if you choose to, whether you’re under 18, and who you’re visiting.
• Your White Card (general construction induction card): its number, issuing state, date, and a photo of the front.
• The site induction you read, your answers and signature, and the time, IP address and browser you signed from.
• The time you signed in and out of the site.
• Your location, only if you tick the box, read once at the moment you tap sign in or sign out to show you were at the site. It is never tracked in the background from the web page.

Signing out when you leave (Footing app only): if the builder has turned it on, has given you written notice at least 14 days before, and you turn on “Sign me out when I leave site” yourself, your phone watches one circle around a site while you’re signed in to it. When you leave the circle you’re signed out at that time. Only the time you left is sent; no trail of where you’ve been is kept, and nothing runs before you sign in or after you sign out. You can turn it off in the app at any time.

Automated check: if the builder has turned it on, sign-in is refused when there’s no current White Card on file, and you’re asked to talk to the site supervisor, who can let you on.

Your details are remembered on your phone (in the browser) so you don’t retype them; clearing the browser’s site data removes them. You can email yourself a copy of your induction and sign-in record from the sign-in page, and ask the builder to correct it. The builder keeps the register for the period they set (two to ten years after the job finishes, seven by default), longer if it’s linked to an incident.

How long we keep it

We keep customer account data for as long as the account is open. After an account closes we retain it for 90 days so it can be restored or exported, then delete or de-identify it, except where we must keep records longer — Australian tax and financial records generally need to be kept for five years.

Credentials used for a one-off data import are encrypted for the duration of the import and deleted within five minutes of it finishing. Backups are retained on a rolling cycle and overwritten in the ordinary course: database backups for 7 days, and earlier versions of deleted or replaced files for 30 days.

How we protect it

• Encrypted in transit with TLS, and at rest in AWS-managed storage.
• Access tokens for connected services — Xero, Stripe, email — are individually encrypted with a key unique to each customer, so a single compromised key cannot unlock another customer’s credentials.
• Each customer’s records live in a separate database, not a shared table.
• Role-based access inside the product, so staff and sub-contractors only see what their role allows.
• Access to production systems is restricted to the people who need it to operate the service.

No system is completely secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

Cookies

We use cookies and similar browser storage that are necessary to keep you signed in and to remember interface preferences — and, if you start a free trial from a guest document, to remember which document to save once your account is ready. We do not use advertising or cross-site tracking cookies.

Your rights

You can ask us to give you access to the personal information we hold about you, correct it if it is wrong, or delete it where we are not required to keep it. You can also withdraw consent to optional processing, and ask how we handle your information.

You can delete your account yourself at any time, in the Footing app or on the web, from Your account. How deleting works.

Email hello@getfooting.com.au. We will respond within 30 days. We may need to verify who you are first. If your information was recorded by a business using Footing, we will refer you to them, since they control it.

Complaints

If you think we have mishandled your information, email hello@getfooting.com.au and we will investigate and respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes

We may update this policy. The date at the top shows when it last changed. If a change materially affects how we handle your information we will tell affected customers by email before it takes effect.

Contact

Folkware, ABN 69 340 390 198, trading as Footing
hello@getfooting.com.au