Legal

Privacy policy

In force from 8 October 2026.

This policy explains how TworkX handles personal information. We handle it in line with the Australian Privacy Principles in the Privacy Act 1988. In this policy, we, us and our mean the operator of TworkX, ABN 66089351367.

1. What we collect

Your account: your name and email address, your password (kept only as a one way hash, which cannot be turned back into the password), and the role, organisation, phone number and company logo you choose to add in Settings.
Your projects and briefs: the information you enter and the files you attach. A brief usually names people on the project, such as its author, the temporary works coordinator and the designer, with their roles and contact details. You decide what goes into it.
Enquiries: the name, email address, company, role, phone number, preferred times and message you send through the website's forms.
Billing: your Stripe customer number, your plan, the status of your subscription and its dates. Card details are collected and held by Stripe and never reach TworkX. Stripe also collects your billing address and, if you give them, your business name and ABN, for its invoices.
Security records: when you sign in, your session records your IP address and browser details. If you turn on two step sign in, the key for your authenticator app and your backup codes are kept encrypted. The website's forms and the demonstration keep only a scrambled (hashed) form of the IP address, to limit how often one sender can post.
AI records: who used an AI feature and when, and for document reading the document's name, the pages sent and how many values were proposed. Never the document's content.

TworkX uses a cookie to keep you signed in. It uses no advertising or analytics cookies.

2. How we collect it

From you, when you create an account, use TworkX or contact us; from Stripe, about your subscription; and from other users who name you in a brief they prepare.

3. Why we use it

to provide TworkX: your account, your briefs and exports, and help when you ask;
to take payments and keep billing and tax records;
to send the emails the service needs: password reset links, replies to enquiries, and the receipts, invoices and payment notices Stripe sends;
to keep TworkX secure and stop misuse;
to improve TworkX; and
to meet our legal obligations.

We do not sell personal information. We do not use your project data to train AI models. We send marketing emails only if you ask for them, and each one lets you unsubscribe.

Decisions made by computer: TworkX uses your subscription status, as Stripe reports it, to decide automatically whether your account has full or read only access. It makes no other automated decisions about people.

4. Who we share it with

We share personal information only with the service providers that run parts of the service, each for that part only, and where the law requires it.

Provider	What it does	Where the information is held
Vercel	Hosts the application and the website	The application runs in Vercel's Sydney region. Vercel is a United States company, and its support and service logs can involve access from overseas.
Neon	The database that holds accounts, projects and briefs	Sydney, Australia, on Amazon Web Services
Stripe	Payments, invoices, receipts and the billing portal	Australia and overseas, including the United States
Resend	Sends the emails the application sends: password reset links, copies of website enquiries to our business address and our weekly feedback summary. It receives the address, the subject and the text of each email	The United States, where Resend's primary processing takes place
Google Workspace	Our business email: enquiries sent on to us and correspondence	Google's data centres, which can be overseas
Amazon Web Services (Amazon Bedrock)	Reads the document pages you choose to send, when document reading is switched on for your account	Sydney or Melbourne, Australia
Anthropic	Writes AI explanations of the library's questions. It receives the question text, with the brief's state or territory and, for a formwork brief, the formwork design standard selected, and no other project data or personal information	Outside Australia, including the United States

We may also disclose information where the law requires or allows it, or to our professional advisers, who keep it confidential.

5. Information held overseas

Stripe, Resend and Google can hold information outside Australia, including in the United States, and Vercel's support can reach it from overseas. We choose providers with strong commitments to security and privacy, and we take reasonable steps to make sure they handle personal information consistently with the Australian Privacy Principles.

6. How long we keep it

Your account, projects and briefs: while your account exists. When you delete a project, brief or file, or the whole account, it is removed from the database; copies in our database provider's backups expire after a set period.
Billing records: at least five years, as tax law requires. Stripe keeps its own records under its own policy.
Enquiries: until they are dealt with and no longer needed.
Demonstration accounts: removed with everything in them 24 hours after they open.

7. Keeping it secure

Accounts and briefs are held in Australia. Information is encrypted in transit and stored by providers that encrypt it at rest. Passwords are kept only as hashes, two step sign in with an authenticator app can be turned on in Settings, access is restricted, and payment details are handled by Stripe. No system is perfectly secure. The Security page says more, including how to report a security problem.

If a data breach is likely to result in serious harm to you, we will tell you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

8. Seeing and correcting your information

You can see and correct most of your information in TworkX itself (Settings, your projects and your briefs), export your briefs at any time, and download everything your account holds with Download all my data in Settings. You can delete your account yourself with Delete my account in Settings, which cancels any subscription first and then removes the account and everything it holds at once. You can also ask us for access to, or correction of, any personal information we hold about you, or to delete your account, and we will reply within 30 days.

9. Complaints

If you have a concern about how we handle personal information, contact us first and we will reply within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

10. Changes to this policy

We will post any change here with its date, and email account holders about a significant change.