Last updated: 6 November 2026 · Version 1.5
Burgy (we, our, us) respects your privacy and is committed to protecting the personal information we collect from you in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
This Privacy Policy explains how we collect, use, store, and disclose your personal information when you use our platform, applications, and related services (the Services). It should be read alongside our Terms & Conditions.
We collect only the information necessary to operate the Burgy platform effectively and maintain compliance with workplace safety and record-keeping obligations. This may include:
We collect information directly from you, from your company's authorised representatives, or automatically as you use the Services.
Your information is used to:
We will never sell your personal information to third parties.
We track how customers use Burgy so we can make the platform faster, more reliable, and more useful. By using the Services you agree that we may collect, generate, and use de-identified, anonymised, and/or aggregated data derived from your use to:
De-identified and aggregated data does not personally identify you, your workers, or your customers, and is no longer treated as personal information once it has been de-identified. We do not use raw, identifiable Customer Data to train third-party AI models without your consent.
Where you choose to use AI-assisted features (for example, a task or hazard suggestion that calls a third-party AI provider), the relevant content is processed by that provider for the duration of the request only. We use providers that contractually agree not to retain or train on customer prompts.
In-app usage tracking. To find out which features are used, where people get stuck and what is slow, Burgy records how the app is used: the screens you open and for how long, the buttons you tap (by their on-screen label), which form fields you use and whether you leave them empty, how far you scroll, errors you see, slow loading, when the app is opened or closed, and your device type and app version. These records are linked to your account and your company. We never record what you type into a field. They are used only by Burgy staff to improve and support the Services; they are not shown to your employer or other users, and never sold. They are kept in a separate database in Australia (Sydney). Records linked to individual people are deleted after 30 days; after that we keep only daily totals per company, which do not identify anyone. Burgy staff accounts and our test and demo accounts are excluded from these totals.
In-app help assistant. If you ask a question using the in-app help assistant, we store the text of your question, the page you asked it from, and whether the assistant was able to answer. We use this only to find the gaps in our help content and to improve the Services; it tells us what customers cannot work out how to do. Questions are stored against your company, not published, and never sold. Please do not enter personal information, client details or site addresses into the help assistant; it is designed for questions about how to use Burgy, and you do not need to include real job data to get an answer. If you escalate an unanswered question into a support request, your conversation is attached to that request so we can see what you were trying to do.
You can access or update your personal information at any time by logging into your Burgy account.
If you believe any of your information is inaccurate or incomplete, please contact us to request correction. You can also request a full export of your personal data from the “Download My Data” option on your profile.
Workplace safety documentation (e.g., SWMS, JSAs, dockets, prestart records, permits) is retained for a minimum of 7 years to comply with WHS record-keeping laws, unless otherwise required or requested for deletion. On termination of an account, Customer Data is available for export for at least 30 days before deletion, except where retention is required for legal, regulatory, audit, or backup purposes.
We use cookies, local storage, and analytics tools (including session-replay and heat-mapping tools such as Microsoft Clarity, where enabled) to understand how the platform is used and to improve user experience.
Where session-replay or heat-mapping is in use, sensitive fields (such as passwords, payment details, and other clearly-marked content) are masked. We do not use these third-party tools to identify individual workers or customers; the data is used in aggregate to spot UX issues and bugs. Our own in-app usage tracking, described in clause 3, is linked to your account for up to 30 days.
You can disable optional analytics cookies via your browser settings. Required cookies (for login, security, and core functionality) cannot be disabled without breaking the Services.
Where we send you optional feature and product-update emails (as distinct from account and security emails), those emails may include open and click tracking so we can measure engagement and improve what we send. This tracking applies only to these optional emails, never to account or security messages, and every such email includes a one-click unsubscribe link. You can also manage your preference at any time in My Profile → Notifications.
We rely on a small number of trusted third-party providers to operate Burgy. By using the Services you consent to your data being processed by, at a minimum:
An up-to-date list is available on request. Each sub-processor is contractually bound to confidentiality and equivalent or stronger data-protection obligations.
We may share information only with:
We do not sell raw personal information.
This clause applies only to companies that switch on DCAC applications in their Safety settings. A DCAC (Defence Common Access Card) application is the paperwork a worker needs before they can get onto a Defence base, for example through a head contractor. If your company has not switched DCAC applications on, none of the information below is collected through Burgy.
What we collect. Where DCAC applications are on, a worker (or an Administrator on their behalf) may add the following to their DCAC record:
Police check information is sensitive information under the Privacy Act 1988 (Cth). We collect a National Police Check only with the worker’s consent. The worker gives consent by ticking a box when they first add a police check. If an Administrator uploads a police check for a worker, the Administrator confirms that the worker has consented. We record the consent and the time it was given.
Purpose. We use this information only to prepare the worker’s DCAC application, so that their employer can submit it.
Who can see it. DCAC records and files can be seen only by:
Other roles, coworkers, shared-job contractors, and Burgy’s own admin pages cannot see them. When a worker changes employer, the Administrators of their former employer can no longer see their DCAC records, and the new employer starts with an empty checklist. The worker can choose to copy a document into their new employer’s record, one document at a time. Nothing is shared unless the worker chooses to share it.
Retention. DCAC records and files are kept until the worker or their employer deletes them, so they can be reused for renewals. They are not covered by the seven-year workplace safety record retention in clause 6. A worker can delete any of their DCAC documents at any time, and an Administrator can delete one (for example, an out-of-date police check). Switching DCAC applications off hides the DCAC screens but does not delete existing records. When a worker’s account is deleted, their DCAC records and files are deleted with it.
Not sent to Defence or contractors. Burgy does not send DCAC information to Defence, to head contractors, or to anyone else. The employer downloads the pack from Burgy (as a zip of PDFs or as one combined PDF) and submits it themselves.
Storage and access. DCAC files are kept in a private storage area and can only be opened through links that expire after a few minutes. DCAC records and files are online only: they are not saved to the phone for offline use.
“Download My Data” includes the recorded DCAC details, but not the files. The worker can view and download their own DCAC documents from the DCAC section of their profile.
In the event of a suspected or confirmed data breach, Burgy will:
The Services are not intended for users under 16. If you become aware that a worker on your account is under 16, contact us so we can take appropriate action.
For any questions, access requests, or complaints regarding privacy:
Burgy Privacy Officer
Email: burgy.app@gmail.com
Web: burgy.com.au
We will respond to all enquiries within a reasonable period (usually within 30 days) in accordance with the APPs. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC).
We may update this Privacy Policy from time to time. The latest version will always be available within the Burgy app and on our website. For material changes that adversely affect you, we'll give reasonable notice (typically by in-app notification or email).