Privacy Policy

Last updated: 29 September 2026

Make Safer is run by iddesign Ltd, based on the Sunshine Coast, Queensland ("we", "us", "our"). This policy explains how we handle personal information in Make Safer (the "Service"). We aim to handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

1. Who is responsible for what

Businesses subscribe to Make Safer to keep their health and safety records. Those records often include information about the business's workers, contractors and visitors.

• The business that uses Make Safer decides what information to record about its people and why. It is responsible for telling those people, and for having a lawful basis to collect it.
• We store and process that information on the business's behalf, only to provide the Service to it. We do not use it for our own purposes.

If you are a worker and have a question about a record a business holds about you, please contact that business first. We will help them respond where we can.

2. Information we collect

Account information. Your name, email address, password (stored in hashed form, so we never see it), role and the company you belong to.

Company information. Business name, ABN, address, sites, branding and billing contact.

Records you create. Whatever you and your team enter into the Service, for example hazards, SWMS, procedures, form answers, photos, documents, typed names and signatures. Depending on how a business uses the Service, this can include:

• details of incidents and injuries, which may be health information; and
• qualifications, licences and certification expiry dates.

Payment information. Payments are handled by Stripe. We receive limited details such as your plan and billing status, but we never see or store your card numbers.

Technical information. Information needed to run and secure the Service, such as log-in times, IP addresses, browser type and error logs.

3. How we use it

We use personal information to:

• provide the Service, including sign-in, storing and displaying records, and sending emails the Service is designed to send (such as invitations, password resets, reminders and incident alerts);
• manage subscriptions and billing;
• provide support when you contact us;
• keep the Service secure and fix problems; and
• tell account owners about important changes to the Service or these policies.

We do not sell personal information, and we do not use it for advertising.

4. Where it is stored and who we share it with

Your records are stored in a database hosted in Sydney, Australia.

We use a small number of trusted service providers to run the Service:

Some of these providers may process information outside Australia, including in the United States, for example while a page is being loaded or an email is being sent. We choose providers with strong security and privacy practices, and only share what they need to do their job.

Within the Service, a business's records are only visible to members of that business, according to the roles the business gives them. If a business links a health and safety consultant to its account, or shares a record using a share link, those people can see what the business has given them access to.

We may also disclose information where the law requires it.

5. Security

We protect information using encryption in transit, access controls that separate each business's data, and restricted staff access. No online service can be completely secure, so please use a strong, unique password and remove team members who no longer need access.

If we become aware of a data breach that is likely to cause serious harm, we will act promptly to contain it and will notify affected businesses and, where required, the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

6. How long we keep it

We keep a business's data while its account is active. After a subscription ends, we keep the data for up to three years so that it can be restored if the business returns, and then delete it. A business owner can ask us to delete it sooner.

Businesses are responsible for keeping their own copies of records they are legally required to retain. See our Terms of Service.

7. Cookies

We use only the cookies needed to keep you signed in and to make the Service work. We do not use advertising or tracking cookies.

8. Accessing and correcting your information

You can view and update your own profile details in the app under My Account. To ask for a copy of the personal information we hold about you, to correct it, or to ask us to delete it, contact us using the details below. We may need to confirm your identity, and where the information belongs to a business's records, we may refer your request to that business.

9. Complaints

If you have a concern about how we have handled your personal information, please contact us first and we will respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

10. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and change the date at the top.

11. Contact us

Privacy questions and requests: Charles@iddesign.net.au

iddesign Ltd, Sunshine Coast, Queensland, Australia