Privacy Policy

Lede Technologies Pty Ltd (ACN 698 337 718)

Last updated: 25 October 2026

Who we are

Lede Technologies Pty Ltd (ACN 698 337 718) (Lede, we, us) is an Australian registered company. We build operational intelligence tools for workforce-facing industries, beginning with Handover - a shift handover platform for teams in aged care, healthcare, cleaning, security, facilities, hospitality, manufacturing, logistics and warehousing, retail, and field services.

We are committed to handling personal information responsibly, transparently, and in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). Where we refer to "personal information," we mean information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether it is recorded in a material form or not, as defined in section 6(1) of the Privacy Act.

Contact us at: privacy@workwithlede.com

Who this policy covers

This policy covers people who interact with Lede, such as:

Operators - businesses and organisations that create a Lede account and deploy Handover for their workforce. Operators are our direct customers and agree to our Terms of Service on sign-up.

Workers - the employees and contractors who use the Lede apps their employer has deployed to their organisation, to record their submissions and receive briefings. Each worker signs in with their own Lede account, which their employer provisions and manages for them; workers do not sign up themselves and do not hold a subscription.

Website enquirers - people who submit an enquiry through a form on our marketing website. Enquirers are not Lede account holders and do not need to be; we hold their details only to respond to the enquiry and to follow up about Lede.

Managers and site owners are Workers with elevated access permissions within the Lede platform. This policy applies to them in their capacity as Workers, unless otherwise specified.

What we collect

Submissions. Throughout this policy, "submissions" means the notes, entries and other content workers create in a Lede app. In Handover - our first app - submissions are the shift notes workers record during a shift. Where this policy describes how submissions are collected, used, classified and retained, it applies to every Lede app, including Handover, so we do not repeat it for each app.

From operators

• Business name, ABN, and contact details of the account holder
• Name and email address of the account administrator
• Site names and configuration details provided to set up Handover
• Billing information (processed securely by Stripe - we do not store card details)
• Usage data including login activity, feature use, and account settings; we use this only to monitor service quality, troubleshoot, and improve product functionality, and not to draw inferences about individuals beyond the scope of the product.
• Your role, industry, and interests - the job role, industry, and operational topics you share during Intelligence onboarding, used to tailor the insights and Cover Stories you see (we do not use this information to profile individuals for automated decision-making or for other purposes beyond operational delivery and relevant communications).
• Technical request data, including IP address - used only for security and abuse prevention (for example, rate-limiting sign-in attempts). This is kept only for as long as needed for those purposes and is not used to profile you, except that a one-way (hashed) form of it may be kept with the anti-abuse signals described under Data retention.
• When you sign in to a Lede app, we record a device identifier (a random value stored by your browser or the Lede app, kept only as a one-way hash, never the raw value), a short label describing the browser and operating system you signed in from (for example, "Chrome on macOS"), and the times we first and most recently saw that device. We use these to recognise the devices used on your account, to email you a security notice when your account is signed in to from a new device, and to help prevent repeated abuse of our free-trial offer. You can review these devices and sign out any of them from your profile.
• Where you connect external software to your account through Lede's developer or Model Context Protocol (MCP) connection, we record a connection entry for each client: a client label taken from the connecting software's identifier, the session identifier for that connection, and the times we first and most recently saw it. These connections are listed in your account settings, and you can revoke any of them there at any time.
• Questions you ask the Intelligence "Ask" assistant, and the resulting conversation history - stored against your account and processed by AI to generate answers.
• Push notification subscription details - if you enable push notifications, the device or browser push subscription (endpoint and associated keys) needed to deliver them.
• Profile photo (optional) - if the account administrator chooses to upload one.
• Imported submission history - where you import your organisation's historical submission records from a previous system, we collect the records you upload: for each entry, the date, site, shift type, the author's name or email address as written in your source file, and the handover text itself.

From workers

• Shift notes - text and voice-transcribed content entered during a shift
• Clock-in and clock-out times
• Clock-in location check - where your operator has enabled geofencing, whether your device was inside the site boundary at clock-in, and the accuracy of that reading. We do not store your coordinates. Where your operator enforces the boundary and you choose to clock in anyway, we also record the reason you give and the time you did so, which is visible to your managers.
• AI-generated end-of-shift summaries and briefing content derived from shift notes
• Forum messages and attachments - where your operator enables team chat (Forum), the messages you write in your site and team channels, and any photos or short videos you attach to them, stored with your name, the channel, and the time sent. A photo or video may incidentally capture other people or surroundings in view when it was taken. Video attachments are available only on paid plans. As with shift notes, messages and attachments may include personal information about you, colleagues, or clients that Lede did not specifically request; the handling described for shift notes applies to them too.
• We also record how you use these features and interact with other members, such as reactions, reports and blocks.
• The site and shift type the note relates to
• General usage data including session timestamps and device type
• When you sign in, we record a device identifier (a random value stored by your browser or the Lede app, kept only as a one-way hash, never the raw value), a short label describing the browser and operating system you signed in from (for example, "Chrome on macOS"), and the times we first and most recently saw that device. We use these to recognise the devices used on your account and to email you a security notice when your account is signed in to from a new device. You can review these devices and sign out any of them from your profile.
• Technical request data, including IP address - used only for security and abuse prevention (for example, rate-limiting sign-in attempts). This is kept only for as long as needed for those purposes and is not used to profile you.
• Push notification subscription details - if you enable push notifications, the device or browser push subscription (endpoint and associated keys) needed to deliver them
• Name and role, as configured by the operator. Individuals can request to access and correct this information at any time (see 'Your rights' section below).
• Profile photo (optional) - if the worker chooses to upload one
• Historical submission records attributed to you - where your operator imports submission history from a previous system, entries attributed to you (matched by the name or email in that source file) are stored alongside the notes you enter directly.

Workers may, while writing shift notes, include personal information about themselves, colleagues, or clients that was not specifically requested by Lede. We have designed the platform to minimise the collection of sensitive information, but we cannot prevent it from entering freeform note fields. Where possible, we encourage pseudonymisation or coding of references to third parties, especially in health and care settings, to further minimise privacy risks. This policy addresses how we handle such information.

We do not collect sensitive information as defined under the Privacy Act (including health information, racial or ethnic origin, political opinions, religious beliefs or affiliations, trade or professional memberships, sexual orientation, or biometric data) intentionally. Where sensitive information is incidentally disclosed in shift notes, it is handled under APP 11 security obligations and is not used for any purpose beyond operational delivery. Where Forum is enabled, a photo or video a worker attaches to a message can incidentally capture other people, and in some workplaces health or other sensitive information; we apply the same access controls, tenant isolation and retention to these attachments as to the message that carries them, and they are deleted when that message is deleted.

From website enquirers

If you submit an enquiry through a form on our marketing website, we collect:

• Your name and email address (both required)
• Your phone number (required)
• Your company, role, and industry, if you choose to provide them
• Any message you write in the enquiry
• Which form you used, so we know what you were asking about
• If you reached a form through one of our quizzes, calculators, or marketing campaigns, we also collect your responses (and any result they produce) and basic information about how you arrived, such as campaign or referral details.

We use this only to respond to you and to follow up about Lede. We do not use it for any other purpose. We disclose it to Salesforce, our customer relationship management provider, which stores it in Australia. Our marketing forms are also protected by Google reCAPTCHA, which receives some technical information about your device to tell genuine visitors from bots - see the provider list below. We keep enquiry records until you ask us to delete them - email privacy@workwithlede.com at any time and we will remove your details.

From website chat visitors

If you use the "Ask Lede" chat on our marketing website, we collect the questions you ask and the resulting conversation, together with any name, email address, or company you choose to share (for example, if you ask us to follow you up). We use this to answer you and to follow up about Lede. This is a different assistant from the in-product "Ask" assistant - the website chat is public and governed by this Privacy Policy.

How it's processed. Your messages are answered by an AI assistant, and its replies are AI-generated and may be imperfect. When you send a message, the text you type is transmitted to and processed by Amazon Bedrock (AWS), our AI provider, to generate a reply; Bedrock inference for the website chat normally runs in Australia (AWS ap-southeast-2), subject to the global inference routing option described below.

How long we keep it. We record and store the full text of your conversation, including the messages you send and the assistant's replies. We keep it so that we can understand what visitors ask us, improve the product and the assistant's answers, and help you if you get in touch, and our team can review these conversations for those purposes. We store each conversation for up to 12 months and then delete it automatically; if you would like your conversation removed sooner, email privacy@workwithlede.com and we will delete it.

Security logging and follow-up. Separately, for each message we process technical request data, including your IP address and basic message metadata such as message length, for security, abuse prevention, and rate-limiting; this is kept only for as long as needed for those purposes and is not used to profile you. If you share your email address so the team can follow you up, your message and the conversation are also sent to us by email and retained as an enquiry, which we keep until you ask us to delete it; email privacy@workwithlede.com at any time and we will remove your details.

By continuing to chat, you agree to this processing and storage as described in this Privacy Policy.

From onboarding interview participants

If you complete our onboarding interview, we collect and store the personal information you provide in it (such as your name, contact details and role, and details of any staff you share to set up their accounts) for onboarding and to support your account. Your typed and spoken answers are processed by our AI provider, and spoken answers by Amazon Transcribe, as described in this policy. We keep this information while your organisation is a Lede customer, or, if you do not become one, until you ask us to delete it by emailing privacy@workwithlede.com.

How we classify worker data

Lede applies a three-tier data classification to information in the Lede platform:

Tier 3 information is processed by our AI provider to generate summaries and briefings, in the same way as other content. It is secured under APP 11, is not used for AI training or product improvement, is not surfaced in management dashboards at an individual level, and access within Lede is otherwise restricted to authorised personnel only. This does not limit your own organisation: where your organisation enables a connected client (see "Clients you connect yourself"), its authorised users may read the freeform notes that can contain Tier 3 information through that client, just as they can within the Lede apps.

How we use your data

To provide the Lede platform

We use operator and worker data to operate the Lede platform - processing shift notes, generating AI summaries and briefings, enabling manager dashboards, and delivering operational insights. This is the primary purpose for which data is collected.

Some features apply rules automatically to manage access to accounts, for example when an organisation's plan changes or when an operator turns on location rules. These use account information such as your role, how long you have been a member and your account status.

To deliver AI features

The AI features of Handover - including shift summaries, incoming briefings, pattern detection, and the Manager Dashboard - are powered by large language model processing of shift note content. This processing occurs on a per-session basis and is used to generate outputs for workers and managers.

Lede also provides an interactive "Ask" assistant (part of Intelligence) that lets authorised users type free-text questions about their organisation's data. The questions you ask and the resulting conversation history are stored against your account and processed by our AI provider to generate answers. Our primary and default AI provider is Anthropic; we may also use AI models from other providers, including OpenAI, served to us through Amazon Bedrock.

Where AI pattern analysis is available (Free, Starter, Growth and Enterprise tiers), the AI identifies patterns across multiple shifts. This analysis is designed to surface operational signals at a site or team level. AI outputs are framed as patterns for human review - not findings or conclusions. Lede prohibits the use of AI outputs as the sole basis for any employment decision.

Where Forum (team chat) is enabled, the AI also generates theme summaries of a channel's recent messages - a synthesis of what has been discussed, surfaced to managers as an operational theme. This uses the same large language model processing and AI providers described above, and involves disclosing that message content to our AI provider. As with other AI outputs, theme summaries are framed as patterns for human review, not findings or conclusions.

To support privacy, fairness, and responsible use of AI, our AI features are designed to surface operational patterns rather than to assess or rank individual workers.

To improve Lede for everyone

AI-generated outputs, system performance metrics, and aggregated usage patterns may be analysed to monitor service quality, evaluate system performance, and improve product functionality. This analysis is conducted at an aggregated level and is not used to identify individual workers or operators, nor is it linked back to specific accounts. Tier 3 (Sensitive) data is excluded from this process.

To communicate with operators

We send product updates, onboarding information, and service notifications to operators via email. Where you have enabled them, we also send operational notifications to operators and workers via push notifications - these are opt-in, and you can turn them off at any time in the app or through your device's notification settings. Operators can opt out of marketing communications at any time by emailing privacy@workwithlede.com.

We do not sell personal data to third parties. (See Cookies and tracking for how advertising partners such as Meta and LinkedIn are used.)

Worker consent and awareness

Workers use Handover because their employer has deployed it as an operational platform. Operators are responsible for ensuring their workers are informed about the ways in which their personal information will be handled, including the kinds of information collected, the purposes of collection, use and disclosure, and the fact that some AI features may involve cross-border disclosures in connection with APP 8.

This notification must be given before personal information is collected and whenever the handling of their information changes in a material way, including that:

• their shift notes and clock-in data and, where Forum is enabled, the messages they write in team chat are recorded and stored in the Lede platform;
• managers and site owners can access shift note history for the sites they manage;
• AI features process shift note content - and, where Forum is enabled, forum message content - to generate summaries, briefings, theme summaries, and operational insights; and
• where AI pattern features are active on any tier (including Free), note content may be analysed across multiple shifts.

Lede provides suggested worker disclosure language on request. Operators are contractually required to provide this disclosure before workers first use the platform.

Where AI features are upgraded or extended - for example, when an operator moves from Free to a paid tier (Starter, Growth, or Enterprise) - operators must ensure workers receive updated disclosure before those AI features are activated on their account.

Who has access to your data

Your data is accessible to the Lede team. We use the following third-party services to operate the platform, each governed by their own privacy policies:

We take reasonable steps to ensure these providers handle personal data securely and in accordance with applicable law. All providers are engaged under data processing terms consistent with APP 8 cross-border disclosure obligations.

Clients you connect yourself

Where your organisation connects an external client to your account (for example through Lede's developer or Model Context Protocol connection), that client acts on the authority of the user who connected it and can read the same data that user can read within the Lede apps. When data is read through a client you have connected, it leaves Lede's control and is handled by that client and its provider under their own terms, which may include processing overseas. You are responsible for the clients you connect, and you can review and revoke them at any time in your account settings.

Data storage location

All Lede operational data - including shift notes, worker records, and account information - is stored on infrastructure located in Australia.

To deliver our AI features, shift-note content is disclosed to our AI provider for processing. Our primary and default AI provider is Anthropic; we may also select AI models from other providers, including OpenAI, served to us through Amazon Bedrock. AI processing on Bedrock normally occurs in Australia (ap-southeast-2); however, our global inference routing option, when enabled, processes shift-note content, imported submission records, Forum message content, onboarding interview conversations, and questions asked through our marketing-site 'Ask Lede' chat outside Australia. Separately, some alternative AI models are not offered in an Australian region at all, so where we use one the content it processes is always processed outside Australia. Each of these is a cross-border disclosure for the purposes of APP 8.

The other providers we use are listed in the table above, together with what each receives and where it is hosted. Every provider hosted outside Australia is a cross-border disclosure for the purposes of APP 8, and we take reasonable steps to ensure each is handled in accordance with the Australian Privacy Principles. Enquiries and contact-form submissions are stored in Salesforce on Australian infrastructure, so that disclosure does not cross a border. Aside from these disclosures, we do not transfer operational data offshore without explicit operator consent.

Data retention

Operator account data is retained for as long as the subscription is active. What happens to it when a subscription ends is set out below.

Raw worker submissions (the content workers enter, including shift notes and forum messages) are deleted on the same storage ceiling as the submission summaries derived from them, according to your subscription tier (see the table below).

Two tier-based limits apply to AI-generated submission summaries and briefings (the end-of-shift content derived from shift notes):

• Visible history window - how far back the AI features analyse and display submission history.
• Storage ceiling - submission summaries older than this are deleted, even while the account is active. How a change of tier affects this ceiling is described below. Raw shift notes are deleted on this same ceiling.

An Enterprise agreement may set a shorter negotiated retention window; where it does, that window applies to both the visible history window and the submission deletion ceiling for that account.

Free trial - During a free trial your content is retained based on the plan you're trialling. A Starter trial follows the Starter window (visible for 60 days, deleted after 90).

A Growth trial is retained and not automatically deleted, and content created during a Growth trial is kept even if you later move to Free.

Operators on the Free and Starter tiers receive an in-app warning before submission summaries are deleted, with the option to upgrade to retain them.

If your tier changes. If your tier changes, each submission summary keeps the deletion limit it had when it was created, and that limit can only be extended. Upgrading increases the limit for existing summaries; downgrading does not reduce it, and only new summaries follow the lower tier's limit. Your visible history updates immediately to match your current tier, so after a downgrade you may see less than we still store. Exception: if you leave the Growth tier, summaries that were kept indefinitely will instead be kept for at least 12 months from the change date, then deleted.

The Cover Story front page is held differently, because each edition is a synthesis of recent submissions rather than a record of a single shift. Cover Story editions are deleted against the ceiling for the tier you are on now, not the tier they were created under, and after a downgrade we allow a grace period of one full retention period before the shorter ceiling is applied to them.

If your payment fails. A failed payment does not close your account. Stripe will retry the charge, and your account will continue to work during these retries.

If all retries fail, your subscription is marked unpaid and your organisation is suspended. During a suspension, no one in your organisation can access the information in the account, but billing settings remain available so you can pay the outstanding amount. A suspension does not delete anything and does not start any deletion period.

Any handover summaries in the account keep their existing deletion dates and will be deleted when those dates arrive, even if you cannot access them. The unpaid invoice remains outstanding (it is not cancelled) so the record of what was owed is preserved. Once you pay, the suspension is lifted and access is restored.

A suspension does not lift automatically. If the amount is not paid, we may end the subscription; if we do, the account is closed and the information in it is deleted.

If you cancel. Cancellation ends your subscription and begins the removal of your account. The clock runs from the end of the period you have paid for: your account becomes inaccessible 30 days after that point - it can no longer be used, and nobody in your organisation can reach the information held in it - and everything in it is permanently deleted once 90 days have passed. Retrieve anything you want to keep before your access ends: you can export your data at any time from your account settings, and a deletion cannot be reversed.

Coming back is a fresh start. We do not restore a deleted account or your data. Apart from the limited anti-abuse signals described above, we hold nothing back in case you return. Once your account has been deleted, signing up again gives you a new account with none of your previous data in it.

What we keep. Financial records - invoices and payment history - are retained for five years as Australian tax law requires. We also keep an audit record of the deletion itself, as evidence it was carried out. Separately, we retain limited anti-abuse signals, such as one-way (hashed) identifiers derived from account, payment, device and network details (including your IP address), to prevent repeat abuse of free trials and similar misuse, for as long as needed for that purpose. Everything else is destroyed: shift notes, submission summaries, worker records, reports and account information.

Backups. Deleted data may persist in encrypted database backups until those backups expire on their normal schedule.

Operators can request deletion of their site's shift note history at any time by emailing privacy@workwithlede.com. Workers who wish to request deletion of their own records should contact their employer in the first instance, or contact us directly at the same address.

Your rights

Under the Privacy Act and the APPs, you have the right to:

• request access to the personal information we hold about you;
• ask us to correct information that is inaccurate or out of date;
• ask us to delete your personal information, subject to our legal obligations; and
• make a complaint about how we have handled your personal information.

To make any of these requests, email privacy@workwithlede.com. We will respond within 30 calendar days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Data breaches

Lede maintains a written data breach response plan. In the event of an eligible data breach as defined under the Notifiable Data Breaches (NDB) scheme (Privacy Act, Part IIIC), we will:

• assess the breach as soon as practicable, and in any event within 30 days of becoming aware;
• notify the OAIC and all affected individuals as required by law; and
• take immediate steps to contain the breach and prevent recurrence.

To report a suspected security issue or data breach, contact privacy@workwithlede.com immediately.

Operator responsibility

Operators who use Handover are responsible for:

• informing their workers that the Lede platform is in use and that shift notes - and, where Forum is enabled, the messages and any photos or videos workers attach in team chat - are recorded, stored, and processed by AI features, including that some information may be processed overseas as described under APP 8 cross-border disclosure;
• providing worker disclosure in the form required by this policy and our Terms of Service before workers first use the platform, and again before any AI feature upgrade is activated;
• where they import historical submission records from a previous system, confirming they have the right to provide those records to Lede, including any personal information of the workers named in them;
• ensuring workers use pseudonyms or codes (not resident, client, or patient names) when entering notes that reference third parties, particularly in aged care, disability support, and health settings;
• ensuring workers do not insert or upload medical records or clinical documents into Handover (including in shift notes, messages, or attachments);
• not using submission data, including AI outputs, as the sole basis for any employment decision; and
• maintaining an internal response protocol for any safety or compliance signals surfaced by the platform.

Lede provides template disclosure language and recommended usage guidelines to all operators on request. Operators are encouraged to customise these templates for their workforce and context, and seek further advice when deploying new AI features or integrating third-party clients.

Cookies and tracking

We use cookies on our marketing website and our apps for two purposes. For analytics we use PostHog (hosted in the European Union) to understand how people find and use Lede. For advertising we use the Meta (Facebook) pixel and the LinkedIn Insight Tag on our marketing website (both hosted in the United States) to measure page views and marketing-form conversions so we can run and target ads. We also use Apollo (hosted in the United States), a marketing tool that shows us which companies visit our marketing website. On our marketing website, all of these run only where you have accepted cookies; choose "Essential only" to decline. In the Lede apps, product analytics is on by default, as described below. This is a cross-border disclosure under APP 8.

Analytics on our website are off until you accept them; in the Lede apps they are on by default. On our marketing website, the analytics code does not run until you choose to accept. In the Lede apps, you can turn analytics off in your profile. Our testing environment is the one exception, described at the end of this section.

We use Sentry to detect and fix errors in the Lede apps. It receives technical details of the error and your device.

If you accept, browsing on our website can later be linked to your account. When you accept on our website, PostHog stores an identifier in a cookie scoped to .workwithlede.com, so that the same identifier can be read by our apps at app.workwithlede.com. If you then sign in to Lede and have not turned analytics off in the app, that identifier is attached to your Lede user account. The practical effect is that pages you viewed on our website before you had an account - including pages you viewed before you decided to sign up - become linked to you as an identified person from that point onward.

This happens only if you accept cookies on our website and have not turned analytics off in the app.

Changing your mind. You can change your choice at any time. On our website, use "Cookie settings" in the footer of any page. In our apps, use the analytics setting in your profile. Your choice applies everywhere you use Lede. When you turn analytics off we stop collecting straight away and delete the analytics identifier stored by the Lede page you are on.

One exception to everything in this section: on our testing environment, at addresses ending staging.workwithlede.com, usage analytics and session replay are a condition of access, they cannot be switched off, and the in-app setting is shown but cannot be changed. You can also email privacy@workwithlede.com and we will action it for you.

Session replay. Session replay records what happens on screen while you use the Lede apps - the pages you open, what is displayed on them, and the actions you take - so that we can see where the product is confusing or broken. Unless you have turned analytics off in your profile, your sessions in any of the Lede apps, whether in a browser or in our mobile app, may be recorded in this way.

On our testing environment, at addresses ending staging.workwithlede.com, sessions are recorded as a condition of access, as described above. Where replay is running we record whole sessions rather than a sample of them, and a recording is deleted 30 days after it is made. Fields we know to be sensitive are masked and are never recorded. We do not record your session while a member of the Lede team is signed in to your account to assist you.

Embedded video. Our site uses a click-to-load facade for YouTube video embeds: nothing is requested from YouTube until you choose to play a video. If you play one, YouTube (Google LLC) may set cookies and receive your IP address and device information.

What we do not do. We do not record or replay your screen on our marketing website at workwithlede.com. We do not build a profile of anonymous visitors - no person record is created in PostHog unless and until an account is linked as described above. Separately, where you have accepted cookies, Apollo uses your IP address to identify the company you are browsing from, not you as an individual.

Changes to this policy

We may update this policy from time to time as our product and obligations evolve. We will notify operators of any significant changes via email before they take effect. The current version is always available at workwithlede.com/privacy.

This policy is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Last updated: 25 October 2026

Lede Technologies Pty Ltd (ACN 698 337 718) - privacy@workwithlede.com - workwithlede.com/privacy