Privacy policy
Take 5 Live is a safety inspection tool. This policy explains what personal information it handles, why, where it is kept, who can see it, and what you can do about it.
Version 1.0. In effect from 20 August 2026. Previous versions are available on request.
The short version
If you are a worker who has been asked to use this app, this is what matters to you:
- The app works completely offline. A record you complete is saved on your phone first, every time, whether or not there is a signal.
- If your employer has set up a team account, your completed records upload to that account. Your employer can see them. That is the point of the product, and you should assume that anything you write in a record will be read by your supervisor.
- A record includes the name you type, the signature you draw, your answers and notes, any defect photographs you take, and the date and time.
- On the phone apps, if you allow location access, an approximate position is recorded when you submit and is printed on the PDF.
- We do not sell anything about you, we do not advertise, and this website carries no analytics or tracking of any kind.
Who is responsible for your information
There are two different parties, and which one you deal with depends on what you want.
Your employer
If you use Take 5 Live through a team account, the business that pays for that account decides what is recorded, who in the business may see it, and how long it is kept. In practical terms they hold your records and we hold them on their behalf. Requests about the content of your inspection records, including asking for one to be corrected or removed, go to your employer first. We cannot reach into a customer's records and change them on the say-so of somebody outside that business, because doing so on request would make every other customer's records equally reachable.
Us
Take 5 Live is operated by Jared Neaves (ABN 32 623 644 883), a sole trader in Australia, trading as Take 5 Live. We are responsible for the account and billing information described below, for keeping the service secure, and for storing customer records safely.
Contact: privacy@take5live.com.au
Which privacy law applies
The Privacy Act 1988 (Cth) and the Australian Privacy Principles are the Australian rules for handling personal information.
We want to be straight about this rather than imply more than is true. The Privacy Act exempts most small businesses with an annual turnover of three million dollars or less from the Australian Privacy Principles. Take 5 Live is currently below that threshold, so the exemption presently applies to us.
We handle personal information in accordance with the Australian Privacy Principles anyway, as a matter of policy, and this document is written to them. We do that because the product holds workplace safety records about identifiable people, and because our customers need to be able to point at something when their own workers ask. If the business grows past the threshold the exemption stops applying and nothing in this document needs to change.
We make no claim to hold any privacy certification, accreditation, standards registration or audit. We have none.
What information is handled
1. Inspection records
This is the bulk of it. A completed Take 5 assessment or pre-start inspection contains:
| Item | Where it comes from |
|---|---|
| Operator name | Typed by the person doing the inspection |
| Signature | Drawn on the screen with a finger, stored as an image |
| Equipment or unit number, and any other fields the template asks for | Typed by the operator |
| Answers, hazards ticked, controls chosen, and free text notes | Entered by the operator |
| Defect photographs | Taken with the camera, or chosen from the phone's gallery, only when the operator adds one |
| Date and time of submission | The device clock |
| Approximate location | The phone, on the iOS and Android apps only. See below. |
Free text is a genuine risk worth naming: a notes box will hold whatever somebody types into it, including another person's name or a description of an injury. We do not read customer records, but we cannot filter what goes into them either. If your site records incidents involving people, decide deliberately whether this is the right place for that detail.
2. Location, specifically
On the iOS and Android apps, when a record is submitted the app asks the phone for a position. It asks for a low accuracy fix, waits at most four seconds, and gives up quietly if the phone does not answer. What is stored is a latitude and longitude rounded to five decimal places together with the accuracy figure the phone reported, which is usually a radius of tens or hundreds of metres. The result is printed on the PDF and saved in the record.
You control this through your phone's normal location permission for the app. If you decline it, or you are somewhere with no fix, the record is completed and submitted without a location and nothing is lost. Location is never collected in the background, and never when the app is closed.
This website never asks for your location. The browser is explicitly forbidden from providing it, by a permissions policy served with every page.
3. Where a record goes
Every record is saved on the device first. That is a deliberate design rule: the app has to work at the bottom of a pit with no signal, so nothing depends on a connection.
What happens next depends on the account:
- No team account. Nothing leaves the phone. The record and its PDF stay on the device until the person who made them shares or deletes them. We never receive them and could not produce them if asked.
- A team account. The record, its PDF and any photographs upload to the employer's own storage area in our service, where their supervisors can see them. The copy on the phone stays where it is.
4. Account information
To sign in to this website you give an email address. We store the address, the team you belong to, your role in it, and when you joined. If you sign in with Google we store the identifier Google gives us and the email address on the account, and nothing else from your Google profile.
We do not store passwords, because there are none. Signing in sends a single-use link to your email address. There is no password to guess, reuse or leak.
5. Device enrolment
When a worker joins a team by scanning an invite, that phone is issued a key so it can upload to the right account. We store a one-way hash of that key, never the key itself, a generic label such as "Android phone", and when it was last used. That means a lost phone can be cut off individually without disturbing anyone else, and a copy of our database would not hand anybody a working upload credential.
6. Billing
Subscriptions are handled by Stripe. Card numbers are entered on Stripe's own pages and never pass through our systems. We hold the customer identifier Stripe gives us, the plan, the subscription status, and the invoice history Stripe makes available. Stripe's own privacy policy governs what they do with payment data: stripe.com/au/privacy.
7. When you contact us
If you email us or use the contact form we keep the message and your address so we can answer, and so we have a record of what was asked if the same question comes back later.
8. Technical logs
Our servers keep short-lived operational logs to find faults and to stop abuse: request times, error codes, and counters that limit how often a single device or address can hit the service. We do not write names, email addresses, or the contents of records into logs.
What is deliberately not collected
Naming the absences is more useful than listing the presences, so:
- No analytics. This website runs no Google Analytics, no product analytics, no session recording, no heatmaps.
- No advertising or tracking. No advertising network, no pixels, no remarketing, no cross-site identifiers, and nothing is ever sold or shared for marketing.
- No third-party scripts or fonts at all. Every page loads only files from this domain. The content security policy served with each page forbids anything else, so this is enforced by the browser and not merely promised here.
- No tracking cookies. See the cookies section below.
- No background location, no contacts, no microphone, no health data, no device advertising identifier.
Why we handle it
| Information | Why |
|---|---|
| Inspection records | To store them for the customer and show them to that customer's supervisors. This is the service being bought. |
| Email address | To sign you in, and to send service messages such as a receipt or a notice that a subscription is ending. |
| Team, role and seat count | To decide what you are allowed to see, and to apply the plan limits. |
| Device key hash | To route an upload to the right account and to let a lost device be revoked. |
| Billing details | To take payment and issue invoices. |
| Logs and rate limit counters | To keep the service up and to stop abuse. |
We do not use inspection records to train machine learning models, we do not analyse them across customers, and we do not build any profile of an individual worker.
Who can see what
- Workers see the records on their own phone.
- Supervisors and the owner of a team see every record uploaded to that team, and can export, archive or delete them.
- Nobody in one team can see another team's records. The team a request belongs to is worked out from who is asking, never from anything the request itself claims. A signed-in person is matched to their team membership on the server; a phone is matched by the key it was enrolled with. Neither can name a different team and be believed.
- We can technically reach stored records, because we run the servers. We access them only to fix a fault the customer has reported, or where the law requires it. We do not read them otherwise.
Who else receives information
We share personal information with these service providers, and no one else:
| Who | What they handle | Where |
|---|---|---|
| Cloudflare | Hosting, the API, record and file storage, the database | Global network, including outside Australia |
| Stripe | Payments and invoicing | United States and Australia |
| Our email provider | Sending sign-in links and service email | See the deployment notes; confirmed before launch |
We do not sell personal information. We have never done so and the business does not depend on it.
We will disclose information where we are legally required to, for example under a court order or a lawful request from a regulator. Where we are permitted to tell the affected customer that this has happened, we will.
If the business is ever sold, customer accounts and records would transfer to the buyer, who would be bound by a policy no weaker than this one. Customers would be told before it took effect.
Storage outside Australia
This is the part most Australian customers ask about, so it is stated plainly.
Take 5 Live runs on Cloudflare. Cloudflare is a United States company operating a global network, and your records may be stored and processed on servers outside Australia. Australian Privacy Principle 8 requires that we take reasonable steps to ensure an overseas recipient handles the information consistently with the Principles, and we rely on Cloudflare's contractual data protection terms for that.
If your organisation has a requirement that safety records remain in Australia, tell us before you subscribe. It is a question about how the storage is configured, and it needs answering honestly for your site rather than assumed from this page.
How it is protected
- Everything travels over HTTPS. Plain http is refused for this domain and every subdomain.
- Sign-in uses a single-use link that expires in fifteen minutes and cannot be reused. There are no passwords to steal.
- Your session is held in a cookie the browser will not let JavaScript read, which removes the usual way a session is stolen from a page.
- Device upload keys are stored only as one-way hashes.
- Every request that reads or writes records resolves the team from the caller's proven identity, so a stolen credential reaches one team's data and no further.
- Administrative actions such as removing a member or deleting a record are written to an audit trail.
- This website loads no third-party code, which removes the most common way a site of this kind gets compromised.
No system is perfectly secure and we will not pretend otherwise. If we discover a data breach likely to cause serious harm we will assess it promptly, tell affected customers, and notify the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme applies. We commit to telling affected customers whether or not the scheme strictly binds us.
How long it is kept
| What | Kept for |
|---|---|
| Inspection records in a team account | Until the customer deletes them, or until 60 days after the account is closed |
| Records on a phone with no team account | Entirely up to the person holding the phone. We have no copy. |
| Account and membership details | While the account is open, then 60 days |
| Billing records and invoices | Seven years, because Australian tax law requires it |
| Operational logs | Short-lived, typically days |
| Support email | Two years |
Safety records frequently have to be retained under work health and safety law, and how long is a question for the customer's jurisdiction and industry, not for us. Our service is built around that: the everyday action in the dashboard is archive, which hides a record without destroying it. Permanent deletion is a separate, deliberate step that requires typing the record's reference to confirm.
Your choices
Seeing what we hold about you
Email privacy@take5live.com.au. We will respond within 30 days. We may need to confirm who you are first, and we will not charge you for the request.
Correcting it
Account details can be corrected by asking us. The contents of an inspection record belong to the employer's account and corrections go through them.
Deleting your account
You can delete your account from the app or by asking us. Deletion removes your user record and your team membership. It does not delete inspection records already uploaded to an employer's account, because those are the employer's safety records and they may be legally required to keep them.
Deleting a team's records
The team owner can delete individual records from the dashboard, or ask us to close the account and remove everything.
Being anonymous
You can use the app with no account at all and never send us anything. Within a team account the operator name is required, because a safety record that does not say who did the check is not a safety record.
Complaining
Write to privacy@take5live.com.au and we will respond within 30 days. If you are not satisfied you can take the matter to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
Cookies
There is no cookie banner on this site, and that is a deliberate decision rather than an oversight.
The marketing and legal pages you are reading now set no cookies whatsoever. There is nothing to consent to, and a banner asking you to accept nothing would be theatre.
Once you sign in, one cookie is set. It holds your session so you do not have to sign in again on every page, and a second value used to verify that a request came from this site. Both are strictly necessary to provide a service you asked for by signing in, the session cookie is marked so that JavaScript cannot read it, both are only sent over HTTPS, and they are deleted when you sign out. Australian law and the equivalent rules elsewhere do not require consent for cookies of this kind.
Your session ends by itself. After 12 hours with no activity you are warned and then signed out, and a session ends completely after seven days however busy you have been. A supervisor's dashboard shows the names, signatures and photographs of everyone on the team, and it is often open on a site office computer several people use, so it does not stay open indefinitely.
We set no analytics, advertising or cross-site cookies, so there is no third-party cookie to refuse.
Children
Take 5 Live is a workplace tool for people at work. It is not directed at children and we do not knowingly collect information from anyone under 16 outside a work context. A lawfully employed apprentice or trainee using the app at work is using it as a worker.
Changes to this policy
When this policy changes we update the version and date at the top. For a change that materially affects how personal information is handled we will email account holders before it takes effect. Continuing to use the service after that is taken as acceptance, and if you do not accept it you can close the account and take your records with you.
Contact
Privacy questions, access requests and complaints:
privacy@take5live.com.au
General support:
support@take5live.com.au
Jared Neaves, ABN 32 623 644 883, Australia.
See also the terms of service.