WorkAndGo is a team communication and workforce management platform. Your employer uses it to help their team collaborate and stay organised. This policy explains what data we collect, why, and who can see it.
The short version: Your employer is the data controller. They decide what monitoring features to enable and how long your data is kept. We process your data on their behalf and never sell it to anyone.
What we collect
Account information
- Your name, email address, and profile photo
- Your role and team assignment within your organisation
- Login timestamps and authentication tokens
Communication data
- Messages you send in channels and direct messages
- Files, images, and documents you share
- Reactions, mentions, and message edits
- Voice and video call metadata (duration, participants) -- we do not record call audio or video unless your employer enables that feature
HR data
- Clock-in and clock-out times, including location data if your employer enables geofencing
- Break and lunch duration
- Leave requests and balances
- Roster and shift assignments
Productivity insights
- Application usage patterns (which apps you use during work hours, and for how long)
- Periodic screenshots -- if your employer enables this feature. Screenshots are captured at configurable intervals and are visible only to your admin
- Focus scores and activity summaries generated from the above data
Device information
- Operating system and app version
- IP address (used for regional data routing, not tracking)
- Device type (desktop or mobile)
The WorkAndGo mobile app
The app for iPhone and Android is the employee side of WorkAndGo: chat, tasks, your calendar, and clocking in and out. It is not a monitoring tool and it is built so that it cannot become one.
What the mobile app does not collect
- No screenshots. Ever, on any plan, whatever your employer has switched on elsewhere
- No application or website usage
- No keyboard or mouse activity, including typing rhythm
The productivity insights described above are collected by the desktop application on a computer, and never by the phone app. This is enforced on our servers rather than only in the app, so it holds regardless of which version of the app you are running and cannot be re-enabled by an employer.
What the mobile app does collect
The same account, communication and HR data described above, because it is the same workspace you would see in a browser. Your messages, the files you share, your clock-in and clock-out times, your leave and your roster.
Permissions the app asks for, and when
- Location -- requested only at the moment you clock in or clock out, and only if your employer has turned on location for timesheets. The app does not track your location at any other time and never in the background. If you decline, you can still clock in; the record simply carries no location
- Camera and microphone -- requested only when you join a voice or video call, and only for the duration of that call. Calls are not recorded unless your employer has enabled recording, in which case everyone on the call is told before it starts
- Notifications -- used to tell you about messages and mentions. You can turn these off in your phone settings at any time without affecting anything else
The app stores a sign-in token on your device so you are not asked to sign in every time you open it. Signing out removes it.
How we use your data
- Provide the service. Deliver messages, manage tasks, run HR features, and keep your workspace in sync across devices.
- Generate productivity insights. If enabled by your employer, we compile activity data into team-level productivity reports. These help managers understand workload and patterns.
- Power Jeeves AI. Our AI assistant processes your messages and workspace data to answer questions, summarise discussions, and automate tasks. Jeeves runs within your organisation's data boundary -- your data is never used to train models.
- Compliance monitoring. If your employer enables compliance features, we can flag messages that match configured patterns (for example, sharing of sensitive data). This is fully controlled by your employer.
- Improve the product. We use aggregated, anonymised usage patterns to improve WorkAndGo. We never use your message content or personal data for this purpose.
Who sees your data
Not everyone sees everything. Here is how visibility works:
- Your messages are visible to members of the channel or conversation they are posted in. Admins can access channel archives if granted permission by your organisation.
- Team-level analytics (productivity scores, attendance summaries) are visible to your employer's admins and managers. These are typically shown as team averages, not individual breakdowns, unless your employer configures individual reporting.
- Screenshots and app usage are visible only to admin users designated by your employer.
- Your own data is always visible to you on the My Productivity page, so you can see exactly what your employer sees.
- WorkAndGo staff do not access your data unless required to resolve a support ticket you or your admin raised, and only with your organisation's consent.
We never sell your data. Not to advertisers, not to data brokers, not to anyone. Your data exists to serve your team, and that is it.
Data storage and regional sovereignty
Your data is stored in Australia. Every WorkAndGo organisation is hosted in Sydney (australia-southeast1) -- there is no other option and nothing to configure:
- Database -- MongoDB Atlas, Sydney
- Files, screenshots and attachments -- Google Cloud Storage, Australia
- Application servers -- Google Cloud Run, Sydney
- AI features (Jeeves) -- Google Vertex AI, Sydney. Your content is not used to train anyone's models.
- Backups -- Australia, alongside the data they copy
An earlier version of this page offered a choice of Australian, United States or European Union storage. That choice never existed in the product: all data has always been held in Australia. The wording was corrected on 19 September 2026, and we have kept this note rather than quietly editing the page, because a statement about where your data lives is one you are entitled to see us correct.
Disclosure to overseas recipients
Although your data is stored in Australia, a small number of service providers we rely on to deliver the product operate from overseas, and information passes through them in the course of ordinary use. These are:
- Telephony (United States) -- call routing and call records, if your organisation uses the in-app phone. Not used unless your organisation enables it.
- Email delivery (United States) -- the address and contents of notification and invitation emails we send you.
- Content delivery and security filtering (global edge network, including the United States) -- requests to our site transit this network, which is how we block attacks before they reach us.
- GIF search (United States) -- only the search term you type into the GIF picker, and only when you open it.
- Accounting and payroll connections (varies by provider) -- only where your organisation chooses to connect Xero or MYOB, and only the payroll data required for that connection.
We take reasonable steps to ensure these recipients handle your information consistently with the Australian Privacy Principles, as APP 8 requires.
Who we use, by name
The complete list of service providers that handle any part of your information. Anything marked optional is not used at all unless your organisation turns it on or connects it.
| Provider |
What it does |
Where |
| Google Cloud | Runs the application, stores files and screenshots, holds our secrets, and provides the AI behind Jeeves | Australia (Sydney) |
| MongoDB Atlas | The database | Australia (Sydney) |
| MyAndGo | Sign-in, your organisation and subscription, and the rail our email leaves by | Australia (Sydney) |
| Cloudflare | Carries and filters traffic to our site, which is how attacks are stopped before they reach us | Global edge network, including the United States |
| SendGrid | Delivers email when the primary rail is unavailable. Receives the address and contents of that email | United States |
| Twilio (optional) | Routes calls and holds call records, only if your organisation uses the in-app phone | United States |
| Giphy | GIF search. Receives the words you type into the picker, and only while it is open | United States |
| jsDelivr | Serves the video-background library to your browser. Sees your IP address when a call loads, nothing else | Global content network |
| Google Fonts | Serves the two typefaces the site is set in. Sees the IP address of anyone who loads a page, including visitors who never sign in | Global content network |
| newsdata.io | Supplies the headlines in the news feed. Receives no information about you | Outside Australia |
| Xero, MYOB (optional) | Payroll and timesheets, only where your organisation connects them, and only the payroll data that connection needs | Varies by provider |
| Microsoft, Google (optional) | Calendar sync, only where you connect your own calendar | Varies by provider |
| SupportAndGo | Our help desk, if you raise a support request | Australia |
Not on this list, deliberately: we use no advertising networks, no marketing trackers and no product-analytics service. A session-recording tool was removed in August 2026 and has not been replaced.
This list is kept current. If you believe something is missing from it, email privacy@workandgo.com.au and we will correct it.
Monitoring data -- screenshots, activity, attendance and productivity records -- is not disclosed to any of these providers. It stays in Australia.
Your rights
- See your data. Visit the My Productivity page in WorkAndGo to view everything collected about you -- activity logs, productivity scores, screenshots, and attendance records.
- Export your data. Request a full export of your personal data by contacting your admin or emailing privacy@workandgo.com.au.
- Request deletion. You can request deletion of your data. Note that your employer may have retention policies that require certain data to be kept for a period. We will delete everything that is not subject to such a policy.
- Opt out of non-essential collection. You can disable productivity tracking from your profile settings, subject to your employer's configuration. Essential data (messages, authentication) cannot be opted out of while using the service.
Cookies
We keep it simple:
- Session cookie -- one httpOnly cookie to keep you logged in. It expires when your session ends or after 30 days of inactivity.
- No tracking cookies. We do not use advertising cookies, analytics cookies, or any third-party cookies.
- No cookie banner needed. Because we only use a strictly necessary session cookie, there is nothing to consent to.
Data retention
Your employer configures how long data is kept. Here are the defaults:
- Messages and files -- retained indefinitely (searchable forever), unless your employer sets a limit
- Screenshots -- 90 days, then automatically deleted
- Activity telemetry (app usage, focus scores) -- 180 days
- HR records (attendance, leave) -- retained for the duration of employment plus 7 years (Australian legal requirement)
- Account data -- deleted within 30 days of account removal
Your employer can adjust these defaults (shorter or longer) from their admin panel.
Security
- Encryption at rest -- AES-256 for all stored data
- Encryption in transit -- TLS 1.3 for all connections
- Access control -- role-based access control (RBAC) with principle of least privilege
- Authentication -- OAuth 2.0 with session tokens stored in httpOnly cookies
- Infrastructure -- hosted on Google Cloud Platform in Sydney. Google's cloud infrastructure holds SOC 2 Type II and ISO 27001 certification; these are Google's certifications for the platform we run on, not certifications held by WorkAndGo
- Logging -- application and access logs are retained for troubleshooting and review. If you believe you have found a security issue, email andy@interetail.com
Changes to this policy
If we make changes to this policy, we will notify you through the WorkAndGo app. For material changes -- anything that affects what data we collect, how we use it, or who can see it -- we will give you at least 30 days notice before the changes take effect.
We will never retroactively change how we handle data that was collected under a previous version of this policy.
Contact
If you have questions about your privacy or this policy:
- Email: privacy@workandgo.com.au
- For data access or deletion requests, include your organisation name and the email address associated with your WorkAndGo account
- We aim to respond within 5 business days
If you are not satisfied with our response
Tell us first, at privacy@workandgo.com.au, and we will treat it as a privacy complaint and respond within 30 days. If you are still not satisfied, you can escalate to the Office of the Australian Information Commissioner (OAIC), which handles privacy complaints under the Privacy Act 1988:
You do not need our permission to do this, and we will not treat it as a reason to change your service.
Fintech Development Pty Ltd, ACN 655 608 969, ABN 78 655 608 969. Level 1, 18-20 Knuckey Street, Darwin NT 0800.