Workhorse Privacy Policy

title: Workhorse Apps Privacy Policy — October 2026 status: draft read_when:

• reviewing or publishing the final October 2026 privacy policy

WORKHORSE APPS PRIVACY POLICY

14 October 2026

1. Who we are

The Trustee for Instrand Holdings Trust (ABN 58 150 596 586) trading as Workhorse Apps (Workhorse Apps, we, our or us) builds and supports software for businesses. We handle personal information in line with the Australian Privacy Principles (APPs). This policy explains how we handle information through our website, app and services.

Contact us about privacy at support@workhorseapps.com. Please address your request to the Privacy Contact, Workhorse Apps, Level 1, 530 Little Collins Street, Melbourne VIC 3000.

2. What we collect and how

We collect information you give us, information your organisation gives us when it invites you or names you as a contact, and information generated when you use our services:

• Account information: name, work email, organisation, role, account preferences, sign-in and session information. If you choose Google sign-in, we receive the profile and account information needed to sign you in.
• Billing information: billing contact and address, ABN, plan, invoices, payment status and payment references. Stripe processes card, bank account and payment authority information. We do not store full card numbers or online banking passwords.
• Support and project information: messages, requests, files and information you share so that we can build or support your systems. This may include personal information in material you choose to provide or authorise us to access.
• Service and website information: browser and device details, IP addresses, access logs and cookies needed to operate, secure and understand use of our website and app. These are separate from the system usage meter described below.
• Usage metadata: for systems we build and support, the meter records the system, table, operation, time and source of writes. It never records record contents or person identifiers. We use those records to measure, bill and show usage; longer-term aggregated or de-identified use is explained in section 6.

Please provide only the information needed for the task. We do not seek sensitive information unless it is needed for an agreed service and there is a lawful basis to handle it. If we receive information we do not need, we take reasonable steps to delete or de-identify it where lawful.

You may make a general enquiry anonymously or under a pseudonym. We need account and payment information to provide a subscription; without necessary information, we may be unable to provide the requested service.

3. Why we use information

We use personal information to create and secure accounts, deliver and support our services, communicate about work, manage subscriptions and payments, investigate problems, prevent misuse and meet legal obligations. We use website and service information to understand and improve those services. We use PostHog for product analytics embedded in the product, to understand how features are used and improve them. The meter's usage data follows section 6.

We may send relevant offers and announcements where permitted by law. We do not sell personal information or use customer data to train general AI models. We use AI tools for customer work only under business terms that do not train on customer data, with model-training and improvement settings off. See our AI Use Statement.

4. Who receives information

Our staff, contractors and advisers may access information needed for their work, subject to confidentiality duties. We use providers for hosting, databases, network security, sign-in, payments and billing, email, analytics, code repositories, project collaboration and AI services. They receive the information needed for the service they supply.

Our dated Subprocessor List names providers that hold or process customer data for the Workhorse platform itself. We may change those providers at any time, without advance notice, an objection process or change emails. We keep that page current. Providers for systems we build for you are chosen per system, agreed as part of its build work and shown on that system's page in your account. We do not maintain a separate list or send separate provider-change notices for those systems.

Marketing website providers handle visitor traffic and submitted information. Previous billing providers may retain historical billing and contact records after we stop sending new information to them.

We take reasonable steps to ensure providers protect personal information and use it only for the services they supply or as required by law. Some providers, including payment providers for their own legal and fraud-prevention duties, also act independently under their own privacy notices. A provider is a subprocessor under our DPA only where it processes personal information on our behalf for your system.

We may disclose information where required or authorised by law, to protect legal rights, or to professional advisers and a prospective buyer during a business transfer, subject to appropriate confidentiality and privacy safeguards.

5. Overseas handling

We are likely to disclose personal information to overseas providers of hosting, databases, network services, payments and billing, email, analytics, collaboration and AI services. They may store or process information in the United States and, depending on the service, Ireland, Germany and Singapore. Some operate global support and processing networks. We keep these country and service-category disclosures current as arrangements change. We can provide available details about a particular service; we do not promise Australian-only storage.

We take reasonable steps to protect information sent overseas consistently with APP 8, including checking provider terms and safeguards. We remain accountable as required by law. This policy does not ask you to waive protections for overseas disclosure.

6. Customer systems and usage measurement

Our customers decide what personal information their own systems hold and why. When we access it to build or support those systems, we act on the customer's instructions under our Data Processing Addendum, which covers confidentiality, security, subprocessors, overseas handling, breach response and return or deletion. The customer's own privacy notice explains its handling of that information. You can contact that customer about information in its system; we will help it respond where appropriate.

We keep usage records while we provide services to the customer and for 24 months after our last service to that customer. They hold no person identifiers or record contents and are stored with our cloud providers, including in the United States. After that, we keep only aggregated or de-identified usage data, which we may keep and use indefinitely for analysis and improving our services. It must not identify a person or customer, disclose confidential information or allow reconstruction of individual usage records. We do not attempt to re-identify it.

The account admin may ask us to switch capture off. Usage billing then ends unless the customer's Order provides for reasonable estimated billing. We do not present estimates as measured usage or count usage caused by our defects. We alert customers when usage passes each multiple of their plan's included record band. Customers give notices to their own staff where workplace law requires them.

7. Security and retention

We use reasonable technical and organisational safeguards, including access controls and limiting access to people who need it. No system is completely secure. We investigate suspected incidents and notify affected people and relevant authorities where required by law, applying the Notifiable Data Breaches process where relevant.

Usage retention above does not authorise retention of personal information from customer systems. For other information, we keep personal information only as long as needed for its purpose, to resolve disputes or to meet legal record-keeping duties. Account and support records may need to remain after a subscription ends for those purposes; billing and tax records may have longer legal retention periods. We then take reasonable steps to delete or de-identify the information, including through provider retention and backup processes. Ending an account does not instantly erase every backup or a record we must keep by law.

8. Your choices, access and correction

Contact the Privacy Contact to request access to personal information we hold about you or ask us to correct it. We may need to verify your identity and clarify the information requested. We respond within a reasonable time, usually within 30 days. There is no charge to make a request or seek correction. If permitted, any reasonable charge for providing access will be explained in advance. If we cannot grant a request, we explain why and how to complain, unless the law prevents this.

You can unsubscribe from offers and announcements using the Unsubscribe link in an email. The link opens a page where you confirm your choice; a supported mail client's unsubscribe control may also act directly. This stops that mailing list, not invoices, security notices or other messages needed to provide your service. You may also ask us directly to stop marketing.

You can control cookies through your browser. Blocking necessary cookies may affect sign-in or other features.

9. Complaints and changes

If you have a privacy concern, email support@workhorseapps.com with the details. We will acknowledge the complaint, investigate it and aim to give a written response within 30 days. If we need longer, we will explain why and keep you informed.

If you are not satisfied, you can contact the Office of the Australian Information Commissioner (opens in a new tab) (OAIC) or call 1300 363 992. The OAIC can advise whether your complaint falls within its jurisdiction.

We may update this policy and will show the date of the current version. Provider changes follow section 4; we give appropriate notice of other material changes. Changes to the collection permitted by our Terms follow their notice and acceptance requirements.