Plain answers about your data.
This policy explains how Verdue handles personal information. We do not sell personal information. The details below set out what we collect, why we collect it and the choices available to you.
What we collect
Account and work information: we collect account and profile details, such as your name, email address, role and organisation. Verdue may also hold employment or workforce details that your organisation provides, including the information needed to identify workers, teams and supervisors.
Operational records: Verdue processes job, work-order and site details; check-ins, timestamps and completion records; photos and documents; incident and safety reports; and fleet or vehicle information where your organisation uses those features. These records help organisations plan, perform, evidence and manage work.
Workplace readiness information: where your organisation uses safety checks, Verdue collects your answers and declarations about fitness for work, including fatigue, illness, impairment and alcohol or drug use, together with any supporting comments and signature. Authorised people in your organisation can use these records to manage workplace safety.
Location, device and diagnostic information: with permission, the mobile app may collect your device location. We also receive device and technical information needed to operate the app, such as device and operating-system details, app version, IP address, crash reports and diagnostic information.
Search and usage information: when you use operational search, Verdue records the search text, including any names you enter, the type of search and its outcome against your account and organisation. We use these records to understand how search is used and how well it works.
The mobile app and its service providers also collect usage and technical diagnostics, such as interactions with the app, crashes and hangs, and device or installation identifiers. Some of this information is linked to your account or device. We use it to operate, support and improve Verdue.
Website enquiries: if you contact us through this website, we collect the information you provide, such as your name, email address and message, so we can reply.
How we use it
We use personal information to provide, secure and support Verdue; authenticate users; show the work, safety, fleet and reporting features selected by an organisation; respond to enquiries; investigate incidents and technical issues; and meet legal, contractual and operational requirements. We may make information available to authorised people in your organisation and to clients or other recipients your organisation chooses through the service.
To understand how people find and start using Verdue, we retain broad source and campaign categories in your browser for up to 30 days and pass them into a new business registration. We measure the first site, completed job and supported PDF export for new trial organisations. Marketing event details exclude names, email addresses, job records and location data. Remote Ops enquiry counts are measured separately. Anonymous event records are kept for up to 90 days. A short-lived network-address check helps limit automated traffic; that address is not stored with the measurement records. Browser storage or analytics blocking does not prevent signup.
Location: location access is optional. With your permission, Verdue uses location for maps, site records, navigation and location you choose to include in an incident report. Background permission allows your work position to remain visible to your office while the app is not on screen. Work-position tracking requires a valid open shift and work window for every organisation, whether or not it uses Time & Attendance. It stops when you clock off or at your organisation's daily cutoff. Your organisation or Verdue can disable work tracking. Separately started navigation may continue to use location until you end it. You can withdraw location permission in your device settings; this may limit location features.
Service providers and hosting
We use service providers to host, operate, support and improve Verdue. These include Amazon Web Services for primary Australian customer-data hosting, Expo and EAS for mobile-app services, Google Maps for mapping, Sentry for error monitoring when configured, and Vercel for this website's hosting and analytics. Our hosting and support providers process information to deliver their services to us. Google Maps and Navigation also process location, device and interaction information to provide and improve Google services, under Google's applicable terms.
Sentry processes error and hang diagnostics, which may include recent app interactions and technical context. Sentry diagnostic events are currently retained for 30 days under our Developer plan.
Primary customer data is hosted in Australia. Sentry diagnostic data is stored in the United States. Other service providers may process limited information overseas where needed to operate or support the service. We do not sell personal information or disclose it to advertisers for their own marketing.
Retention, access and complaints
We retain information only for as long as needed for the service and for legal, dispute, contractual and operational purposes. Raw location pings are retained by default for 90 days, with each organisation able to configure that period from 7 to 730 days. Derived coverage, work and site records, including attendance and safety records, are retained separately and currently have no automatic expiry. Search history and audit records also currently have no automatic expiry. Removing a photo from the app does not necessarily remove stored files or exported copies, and current stored photos have no automatic expiry.
Database recovery backups are retained for 35 days. Versioned logical backups have a current version period of 365 days and a non-current version period of 400 days, so an unchanged dump is normally eligible for permanent deletion after roughly 765 days, plus lifecycle processing time. This is not a guaranteed maximum. Backups and retained operational records may therefore remain after a deletion request.
Subject to applicable legal and contractual retention requirements, staff may request access to, correction of or deletion of their personal information by contacting us. We assess each request against operational, legal, contractual and dispute needs and explain which information is retained, why it is retained and the applicable retention period or review period. We may need to verify a request and refer it to the relevant organisation where it controls the information. See the Verdue data deletion request process.
To make a privacy request or complaint, email riley@verdue.com.au. We will consider and respond to your concern. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.
Request deletion of Verdue data
To request deletion of your Verdue account or associated personal information, email riley@verdue.com.au with the subject “Verdue data deletion”, your account email and organisation name. Do not send your password. Requests may cover your Verdue account and associated data. We will verify your identity and coordinate with your organisation where it controls the records.
We will explain which information can be deleted and which records must be retained, why they are retained and the applicable retention period or review period.
Who we are
Verdue is operated by Pitmudie Holdings Pty Ltd (ABN 60 681 364 394), Queensland, Australia. Questions about this policy: riley@verdue.com.au.
Effective date: 27 September 2026.