Privacy Policy

Lede Technologies Pty Ltd (ACN 698 337 718)

Last updated: 15 September 2026

Who we are

Lede Technologies Pty Ltd (ACN 698 337 718) (Lede, we, us) is an Australian registered company. We build operational intelligence tools for workforce-facing industries, beginning with Handover — a shift handover platform for teams in aged care, healthcare, cleaning, security, facilities, hospitality, manufacturing, logistics and warehousing, retail, and field services.

We are committed to handling personal information responsibly, transparently, and in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Contact us at: privacy@workwithlede.com

Who this policy covers

This policy covers three types of people who interact with Lede:

Operators — businesses and organisations that create a Lede account and deploy Handover for their workforce. Operators are our direct customers and agree to our Terms of Service on sign-up.

Workers — the employees and contractors who use the Lede apps their employer has deployed to their organisation, to record their submissions and receive briefings. Each worker signs in with their own Lede account, which their employer provisions and manages for them; workers do not sign up themselves and do not hold a subscription.

Website enquirers — people who submit an enquiry through a form on our marketing website. Enquirers are not Lede account holders and do not need to be; we hold their details only to respond to the enquiry and to follow up about Lede.

Managers and site owners are Workers with elevated access permissions within the Lede platform. This policy applies to them in their capacity as Workers, unless otherwise specified.

What we collect

Submissions. Throughout this policy, "submissions" means the notes, entries and other content workers create in a Lede app. In Handover — our first app — submissions are the shift notes workers record during a shift. Where this policy describes how submissions are collected, used, classified and retained, it applies to every Lede app, including Handover, so we do not repeat it for each app.

From operators

• Business name, ABN, and contact details of the account holder
• Name and email address of the account administrator
• Site names and configuration details provided to set up Handover
• Billing information (processed securely by Stripe — we do not store card details)
• For fraud and abuse prevention we may also derive a one-way fingerprint of the payment card used to start a free trial, so the same card cannot open more than one trial. This fingerprint cannot be reversed to your card, and we still never store your card number.
• Usage data including login activity, feature use, and account settings
• Your role, industry, and interests — the job role, industry, and operational topics you share during Intelligence onboarding, used to tailor the insights and Cover Stories you see
• Technical request data, including IP address — used only for security and abuse prevention (for example, rate-limiting sign-in attempts). This is retained only briefly and is not used to profile you.
• Free-trial anti-abuse signals. When you start a free trial, we additionally record a device identifier (a random value your browser stores) and your IP address, both kept only as one-way hashes, never the raw values. We use these solely to prevent repeated abuse of our free-trial offer, enforcing that the same payment card, email address, or device cannot open more than one trial. Unlike the brief technical-request logging described above, these hashes are retained for as long as we run the trial programme so the limit can be enforced over time; they cannot be reversed to identify your device or IP.
• Questions you ask the Intelligence "Ask" assistant, and the resulting conversation history — stored against your account and processed by AI to generate answers
• Push notification subscription details — if you enable push notifications, the device or browser push subscription (endpoint and associated keys) needed to deliver them
• Profile photo (optional) — if the account administrator chooses to upload one
• Imported submission history — where you import your organisation's historical submission records from a previous system, we collect the records you upload: for each entry, the date, site, shift type, the author's name or email address as written in your source file, and the handover text itself.

From workers

• Shift notes — text and voice-transcribed content entered during a shift
• Clock-in and clock-out times
• Clock-in location check — where your operator has enabled geofencing, whether your device was inside the site boundary at clock-in, and the accuracy of that reading. We do not store your coordinates. Where your operator enforces the boundary and you choose to clock in anyway, we also record the reason you give and the time you did so, which is visible to your managers.
• AI-generated end-of-shift summaries and briefing content derived from shift notes
• The site and shift type the note relates to
• General usage data including session timestamps and device type
• Technical request data, including IP address — used only for security and abuse prevention (for example, rate-limiting sign-in attempts). This is retained only briefly and is not used to profile you.
• Push notification subscription details — if you enable push notifications, the device or browser push subscription (endpoint and associated keys) needed to deliver them
• Name and role, as configured by the operator
• Profile photo (optional) — if the worker chooses to upload one
• Historical submission records attributed to you — where your operator imports submission history from a previous system, entries attributed to you (matched by the name or email in that source file) are stored alongside the notes you enter directly.

Workers may, in the course of writing shift notes, include personal information about themselves, colleagues, or clients that was not specifically requested by Lede. We have designed the platform to minimise the collection of sensitive information, but we cannot prevent it from entering freeform note fields. This policy addresses how we handle such information.

We do not collect sensitive information as defined under the Privacy Act (including health information, racial or ethnic origin, or biometric data) intentionally. Where sensitive information is incidentally disclosed in shift notes, it is handled under APP 11 security obligations and is not used for any purpose beyond operational delivery.

From website enquirers

If you submit an enquiry through a form on our marketing website, we collect:

• Your name and email address (both required)
• Your phone number (required)
• Your company, role, and industry, if you choose to provide them
• Any message you write in the enquiry
• Which form you used, so we know what you were asking about
• If you reached a form through one of our quizzes, calculators, or marketing campaigns, we also collect your responses (and any result they produce) and basic information about how you arrived, such as campaign or referral details.

We use this only to respond to you and to follow up about Lede. We do not use it for any other purpose. We disclose it to Salesforce, our customer relationship management provider, which stores it in Australia. Our marketing forms (including the waitlist) are also protected by Google reCAPTCHA, which receives some technical information about your device to tell genuine visitors from bots — see the provider list below. We keep enquiry records until you ask us to delete them — email privacy@workwithlede.com at any time and we will remove your details.

From website chat visitors

If you use the "Ask Lede" chat on our marketing website, we collect the questions you ask and the resulting conversation, together with any name, email address, or company you choose to share (for example, if you ask us to follow you up). We use this to answer you and to follow up about Lede. This is a different assistant from the in-product "Ask" assistant — the website chat is public and governed by this Privacy Policy.

How it's processed. Your messages are answered by an AI assistant, and its replies are AI-generated and may be imperfect. When you send a message, the text you type is transmitted to and processed by Amazon Bedrock (AWS), our AI provider, to generate a reply; Bedrock inference for the website chat normally runs in Australia (AWS ap-southeast-2), subject to the global inference routing option described below.

How long we keep it. We record and store the full text of your conversation, including the messages you send and the assistant's replies. We keep it so that we can understand what visitors ask us, improve the product and the assistant's answers, and help you if you get in touch, and our team can review these conversations for those purposes. We store each conversation for up to 12 months and then delete it automatically; if you would like your conversation removed sooner, email privacy@workwithlede.com and we will delete it.

Security logging and follow-up. Separately, for each message we log technical request data, including your IP address and basic message metadata such as message length, for security, abuse prevention, and rate-limiting; that operational logging is retained only briefly and is not used to profile you. If you share your email address so the team can follow you up, your message and the conversation are also sent to us by email and retained as an enquiry, which we keep until you ask us to delete it; email privacy@workwithlede.com at any time and we will remove your details.

By continuing to chat, you agree to this processing and storage as described in this Privacy Policy.

How we classify worker data

Lede applies a three-tier data classification to information in the Lede platform:

Tier 3 information is handled with the highest level of care. It is secured under APP 11, is not used for AI training or product improvement, is not surfaced in management dashboards at an individual level, and access is restricted to authorised personnel only.

How we use your data

To provide the Lede platform

We use operator and worker data to operate the Lede platform — processing shift notes, generating AI summaries and briefings, enabling manager dashboards, and delivering operational insights. This is the primary purpose for which data is collected.

To deliver AI features

The AI features of Handover — including shift summaries, incoming briefings, pattern detection, and the Manager Dashboard — are powered by large language model processing of shift note content. This processing occurs on a per-session basis and is used to generate outputs for workers and managers.

Lede also provides an interactive "Ask" assistant (part of Intelligence) that lets authorised users type free-text questions about their organisation's data. The questions you ask and the resulting conversation history are stored against your account and processed by our AI provider to generate answers. Our primary and default AI provider is Anthropic; we may also use AI models from other providers, including OpenAI and Google, served to us through Amazon Bedrock.

Where AI pattern analysis is available (Free, Starter, Growth and Enterprise tiers), the AI identifies patterns across multiple shifts. This analysis is designed to surface operational signals at a site or team level. AI outputs are framed as patterns for human review — not findings or conclusions. Lede prohibits the use of AI outputs as the sole basis for any employment decision.

To support privacy, fairness, and responsible use of AI, individual worker attribution in AI-generated outputs is restricted. Outputs that identify or name individual workers are subject to human review and appropriate approval controls.

To improve Lede for everyone

AI-generated outputs, system performance metrics, and aggregated usage patterns may be analysed to monitor service quality, evaluate system performance, and improve product functionality. This analysis is conducted at an aggregated level and is not used to identify individual workers or operators, nor is it linked back to specific accounts. Tier 3 (Sensitive) data is excluded from this process.

To communicate with operators

We send product updates, onboarding information, and service notifications to operators via email. Where you have enabled them, we also send operational notifications to operators and workers via push notifications — these are opt-in, and you can turn them off at any time in the app or through your device's notification settings. Operators can opt out of marketing communications at any time by emailing privacy@workwithlede.com.

We do not sell personal data to third parties — ever.

Worker consent and awareness

Workers use Handover because their employer has deployed it as an operational platform. Operators are responsible for ensuring their workers are informed that:

• their shift notes and clock-in data are recorded and stored in the Lede platform;
• managers and site owners can access shift note history for the sites they manage;
• AI features process shift note content to generate summaries, briefings, and operational insights; and
• where AI pattern features are active on any tier (including Free), note content may be analysed across multiple shifts.

Lede provides suggested worker disclosure language on request. Operators are contractually required to provide this disclosure before workers first use the platform.

Where AI features are upgraded or extended — for example, when an operator moves from Free to a paid tier (Starter, Growth, or Enterprise) — operators must ensure workers receive updated disclosure before those AI features are activated on their account.

Who has access to your data

Your data is accessible to the Lede team. We use the following third-party services to operate the platform, each governed by their own privacy policies:

We take reasonable steps to ensure these providers handle personal data securely and in accordance with applicable law. All providers are engaged under data processing terms consistent with APP 8 cross-border disclosure obligations.

Data storage location

All Lede operational data — including shift notes, worker records, and account information — is stored on infrastructure located in Australia (AWS ap-southeast-2, Sydney region).

To deliver our AI features, shift-note Content is disclosed to our AI provider for processing. Our primary and default AI provider is Anthropic; we may also select AI models from other providers, including OpenAI and Google, served to us through Amazon Bedrock. AI processing on Bedrock normally occurs in Australia (ap-southeast-2); however, our global inference routing option, when enabled, processes shift-note Content, imported submission records, and questions asked through our marketing-site 'Ask Lede' chat outside Australia. Separately, some alternative AI models are not offered in an Australian region at all, so where we use one the Content it processes is always processed outside Australia. Each of these is a cross-border disclosure for the purposes of APP 8.

The other providers we use are listed in the table above, together with what each receives and where it is hosted. Every provider hosted outside Australia is a cross-border disclosure for the purposes of APP 8, and we take reasonable steps to ensure each is handled in accordance with the Australian Privacy Principles. Enquiries and waitlist submissions are stored in Salesforce on Australian infrastructure, so that disclosure does not cross a border. Aside from these disclosures, we do not transfer operational data offshore without explicit operator consent.

Data retention

Operator account data is retained for as long as the subscription is active. What happens to it when a subscription ends is set out below.

Raw worker shift notes (the text and voice-transcribed content workers enter) are deleted on the same storage ceiling as the submission summaries derived from them, according to your subscription tier (see the table below).

Two tier-based limits apply to AI-generated submission summaries and briefings (the end-of-shift content derived from shift notes):

• Visible history window — how far back the AI features analyse and display submission history.
• Storage ceiling — submission summaries older than this are deleted, even while the account is active. How a change of tier affects this ceiling is described below. Raw shift notes are deleted on this same ceiling.

An Enterprise agreement may set a shorter negotiated retention window; where it does, that window applies to both the visible history window and the handover deletion ceiling for that account.

Free trial — During a free trial your content is retained on the basis of the plan you're trialling. A Starter trial follows the Starter window (visible for 60 days, deleted after 90). A Growth trial is retained and not automatically deleted, and content created during a Growth trial is kept even if you later move to Free.

Operators on the Free and Starter tiers receive an in-app warning before submission summaries are deleted, with the option to upgrade to retain them.

If your tier changes. The deletion ceiling in the table above is set for each submission summary when it is created, from the tier the account is on at that moment, and after that it is only ever extended. Upgrading lifts the ceiling on the submission summaries you already have. Downgrading does not lower it: summaries created under the higher tier keep the ceiling they were given, and only summaries created after the change are held to the new tier's ceiling. The visible history window is not held this way — it follows your current tier straight away, so after a downgrade you may be able to see less than we are still storing. One exception applies: if you move off the Growth tier, submission summaries that were being kept indefinitely are instead kept for at least a further twelve months from the date of the change, and are then deleted.

The Cover Story front page is held differently, because each edition is a synthesis of recent submissions rather than a record of a single shift. Cover Story editions are deleted against the ceiling for the tier you are on now, not the tier they were created under, and after a downgrade we allow a grace period of one full retention period before the shorter ceiling is applied to them.

If your payment fails. A failed payment does not close your account. Stripe retries the charge, and the account keeps working while it does. If every retry fails, the subscription is marked unpaid and your organisation is suspended: nobody in your organisation can reach the information held in the account, although your billing settings stay available so the outstanding amount can be settled. A suspension deletes nothing and starts no deletion clock. Handover summaries already in the account keep the deletion date they were given and are deleted when it arrives, so content can pass its ceiling while you are unable to reach it. The unpaid invoice is left outstanding rather than cancelled, so the record of what was owed is preserved. Paying it lifts the suspension and restores access. A suspension does not lift on its own: if the amount is not settled we may end the subscription, and if we do, the account is closed and the information in it is deleted.

If you cancel. Cancellation ends your subscription and begins the removal of your account. The clock runs from the end of the period you have paid for: your account becomes inaccessible 30 days after that point — it can no longer be used, and nobody in your organisation can reach the information held in it — and everything in it is permanently deleted once 90 days have passed. Retrieve anything you want to keep before your access ends: you can export your data at any time from your account settings, and a deletion cannot be reversed.

Coming back is a fresh start. We do not restore a deleted account or your data. Apart from the limited anti-abuse signals described above, we hold nothing back in case you return. Once your account has been deleted, signing up again gives you a new account with none of your previous data in it.

What we keep. Financial records — invoices and payment history — are retained for five years as Australian tax law requires. We also keep an audit record of the deletion itself, as evidence it was carried out. Separately, we retain limited anti-abuse signals, such as one-way (hashed) identifiers derived from account and payment details, to prevent repeat abuse of free trials and similar misuse, for as long as needed for that purpose. Everything else is destroyed: shift notes, submission summaries, worker records, reports and account information.

Backups. Deleted data may persist in encrypted database backups until those backups expire on their normal schedule.

Operators can request deletion of their site's shift note history at any time by emailing privacy@workwithlede.com. Workers who wish to request deletion of their own records should contact their employer in the first instance, or contact us directly at the same address.

Your rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to:

• request access to the personal information we hold about you;
• ask us to correct information that is inaccurate or out of date;
• ask us to delete your personal information, subject to our legal obligations; and
• make a complaint about how we have handled your personal information.

To make any of these requests, email privacy@workwithlede.com. We will respond within 20 working days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Data breaches

Lede maintains a written data breach response plan. In the event of an eligible data breach as defined under the Notifiable Data Breaches (NDB) scheme (Privacy Act 1988, Part IIIC), we will:

• assess the breach within 30 days of becoming aware;
• notify the OAIC and all affected individuals as required by law; and
• take immediate steps to contain the breach and prevent recurrence.

To report a suspected security issue or data breach, contact privacy@workwithlede.com immediately.

Operator responsibility

Operators who use Handover are responsible for:

• informing their workers that the Lede platform is in use and that shift notes are recorded, stored, and processed by AI features;
• providing worker disclosure in the form required by this policy and our Terms of Service before workers first use the platform, and again before any AI feature upgrade is activated;
• where they import historical submission records from a previous system, confirming they have the right to provide those records to Lede, including any personal information of the workers named in them;
• ensuring workers use pseudonyms or codes (not resident, client, or patient names) when entering notes that reference third parties, particularly in aged care, disability support, and health settings;
• not using submission data, including AI outputs, as the sole basis for any employment decision; and
• maintaining an internal response protocol for any safety or compliance signals surfaced by the platform.

Lede provides template disclosure language and recommended usage guidelines to all operators on request.

Cookies and tracking

We use cookies on our marketing website and our apps for two purposes. For analytics we use PostHog (hosted in the European Union) to understand how people find and use Lede. For advertising we use the Meta (Facebook) pixel and the LinkedIn Insight Tag on our marketing website (both hosted in the United States) to measure page views and marketing-form conversions so we can run and target ads. Both run only where you have accepted cookies; choose "Essential only" to decline. This is a cross-border disclosure under APP 8.

Analytics are off until you accept them. On both our marketing website and in the Lede apps, the analytics code is not loaded at all until you choose to accept. Declining leaves no analytics identifier in your browser and sends nothing to PostHog — no page views, no clicks, no other usage, and nothing connected to your account. If you accept and later change your mind, the identifier and any analytics data held in your browser are removed. Our testing environment is the one exception, described at the end of this section.

If you accept, browsing on our website can later be linked to your account. When you accept on our website, PostHog stores an identifier in a cookie scoped to .workwithlede.com, so that the same identifier can be read by our apps at app.workwithlede.com. If you then sign in to Lede, having also accepted analytics in the app, that identifier is attached to your Lede user account. The practical effect is that pages you viewed on our website before you had an account — including pages you viewed before you decided to sign up — become linked to you as an identified person from that point onward.

This happens only if you accept analytics in both places. If you decline in the app, we do not make that link, and your earlier website browsing is not connected to you. The app still stores the randomly generated identifier described above, but it stays in your browser: it is never sent to us and it is never attached to your account.

Changing your mind. You can change your choice at any time. On our website, use "Cookie settings" in the footer of any page. In our apps, use the analytics setting in your profile. Your choice applies everywhere you use Lede. When you withdraw consent we stop collecting straight away and delete the analytics identifier stored by the Lede page you are on. Your browser may still hold an unused identifier, which is never sent to us while analytics is off. If you have another Lede page open in the same browser, it may keep collecting until you reload it, and then it stops and clears its own copy. One exception to everything in this section: on our testing environment, at addresses ending staging.workwithlede.com, usage analytics and session replay are a condition of access, they cannot be switched off, and the in-app setting is shown but cannot be changed. You can also email privacy@workwithlede.com and we will action it for you.

Session replay. Session replay records what happens on screen while you use the Lede apps — the pages you open, what is displayed on them, and the actions you take — so that we can see where the product is confusing or broken. Where you have accepted analytics, your sessions in the Lede apps at app.workwithlede.com and handover.workwithlede.com may be recorded in this way. If you decline analytics, no replay is recorded at all; there is no reduced or partial recording. On our testing environment, at addresses ending staging.workwithlede.com, sessions are recorded as a condition of access, as described above. Where replay is running we record whole sessions rather than a sample of them, and a recording is deleted 30 days after it is made. Fields we know to be sensitive are masked and are never recorded. We do not record your session while a member of the Lede team is signed in to your account to assist you.

Embedded video. Our site uses a click-to-load facade for YouTube video embeds: nothing is requested from YouTube until you choose to play a video. If you play one, YouTube (Google LLC) may set cookies and receive your IP address and device information.

What we do not do. We do not record or replay your screen on our marketing website at workwithlede.com. We do not build a profile of anonymous visitors — no person record is created in PostHog unless and until an account is linked as described above.

Changes to this policy

We may update this policy from time to time as our product and obligations evolve. We will notify operators of any significant changes via email before they take effect. The current version is always available at workwithlede.com/privacy.

This policy is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Last updated: 15 September 2026

Lede Technologies Pty Ltd (ACN 698 337 718) — privacy@workwithlede.com — workwithlede.com/privacy