LoginRequest access
Draft — for review only. This Privacy Policy is a working draft and does not constitute final legal advice. It must be reviewed by qualified legal counsel before production use.

Last updated: 3 July 2026

Privacy Policy

This draft policy describes how MandateHQ may handle personal information. It is provided in plain English for early access and must be reviewed by legal counsel before reliance.

Who operates Mandate

MandateHQ (www.mandatehq.com.au) is the website and application through which organisations manage business control workflows. In this policy, “we”, “us”, and “our” refer to the operator of MandateHQ. Our services are intended for use in Australia unless we state otherwise.

What this policy covers

This policy applies to the MandateHQ public website, early-access application, and related support channels. It does not replace separate agreements between an organisation and its employees, or policies an organisation may publish to its own staff.

Personal information we may collect

Depending on how you use Mandate, we may collect:

  • Request and access details — information you provide when requesting access, submitting a setup request, or contacting us (for example name, email, phone, organisation name, and message content).
  • Account and user details — name, email address, role labels, sign-in identifiers, and preferences needed to operate your account.
  • Organisation and user records — organisation name, branch or department context, module settings, and configuration data your administrators enter in Control Centre.
  • Employee and onboarding-related information (future) — where Mandate People and onboarding features are enabled, organisations may store HR-related information about their staff (for example contact details, role, licences, leave, and onboarding form responses). That information is generally controlled by the organisation using Mandate, not by us as the operator.
  • Support and contact information — correspondence when you ask for help or report an issue.
  • Technical information — device/browser type, IP address, log data, and cookies or similar technologies needed to secure and operate the service.

How we use information

We may use personal information to:

  • provide, maintain, and improve the Mandate website and application;
  • create and manage accounts, organisations, and access permissions;
  • respond to requests, support enquiries, and security incidents;
  • send service-related messages (for example invitations, access notices, or important updates);
  • understand usage and reliability of the platform; and
  • meet legal obligations that apply to us.

We do not describe Mandate as providing accounting, legal, payroll, or tax advice. Data you enter is used to operate the platform, not to provide professional advice on our behalf.

Internal development tools and AI-assisted coding

MandateHQ is built using standard software engineering tools, including AI-assisted coding tools such as Cursor. These tools are used internally by our development team to write and maintain the platform. They are not customer-facing features.

AI-assisted coding tools are not part of our production data processing pipeline. They do not collect, store, or handle personal information on our behalf in the same way as our hosting, database, or authentication providers.

Our policy is that we do not intentionally submit customer production data, employee records, payroll information, sensitive information, financial account details, or other regulated data into AI-assisted coding tools. Developers are directed not to paste live customer data, exports, logs containing personal information, or similar material into these tools.

When our developers use such tools, the tool provider may collect usage or technical information about the development session in accordance with that provider's own privacy practices. That information relates to our internal development activity, not to how we process your organisation's data through MandateHQ.

Where privacy or no-training settings are available from a tool provider, we aim to enable and maintain them for our development accounts. Internal development practices may change over time; we will update this policy if our handling of customer-related data through development tools changes materially.

Our use of internal development tools does not change your rights under applicable privacy law. Personal information you provide to MandateHQ continues to be handled under the rest of this policy.

Who information may be disclosed to

We may disclose personal information:

  • Within your organisation — to other users according to roles and permissions set by your organisation.
  • Service providers — to suppliers who help us host, secure, email, or support the platform (see below).
  • Where required by law — if we reasonably believe disclosure is required by law, regulation, court order, or to protect rights, safety, or security.

We do not state that we will sell personal information. Any future change to sharing practices should be reflected in an updated policy after legal review.

Service providers and hosting

Mandate may use third-party infrastructure and tools (for example cloud hosting, database, authentication, and email delivery providers). Those providers may process personal information on our behalf to deliver the service. We aim to use reputable providers and contractual protections appropriate to the nature of the data, but we do not claim certification or compliance with any specific framework unless we publish that separately after legal review.

Security

We take reasonable steps to protect personal information from misuse, loss, unauthorised access, modification, or disclosure. No method of transmission or storage is completely secure. Organisations using Mandate remain responsible for how they configure access, permissions, and sensitive HR or finance data within their account.

Access and correction

You may request access to, or correction of, personal information we hold about you, subject to applicable law and practical limitations (for example where data is controlled by your organisation). Contact us using the details below. If we hold information on behalf of an organisation, we may refer you to that organisation's administrator where appropriate.

Complaints and contact

If you have a privacy concern or complaint, contact us via the request form on www.mandatehq.com.au or the contact details published there. We will aim to respond within a reasonable time. You may also have rights to complain to the Office of the Australian Information Commissioner (OAIC) under applicable privacy law.

Draft note: replace with a dedicated privacy contact address after legal review if required.

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of the page will change when we do. Continued use of the website or application after changes are published may constitute acceptance of the updated policy, to the extent permitted by law. Material changes should be communicated where appropriate.

← Back to MandateHQ