Last updated 13 November 2026
This Privacy Policy explains how Backfyl handles personal information. Backfyl is operated by Backfyl Pty Ltd (ACN 704 109 437, ABN 36 704 109 437) of Sydney, NSW, Australia ("Backfyl", "we", "us", "our"). We've written this policy to follow the Australian Privacy Principles as good practice for how we handle your information, regardless of whether the small business exemption under the Privacy Act 1988 currently applies to a business our size.
The short version: we never sell your information or your team's, to anyone. We don't use it for advertising. Each team's data sits in its own database, and only the Backfyl team can reach it, to give support or fix a problem.
When you create a workspace, we collect the team or organisation name, your name and email address, and the answers you give during setup (role names, reply options, time zone and similar). Payment details go straight to Stripe (section 5). We never receive or store your card number.
When someone joins a team, we collect the name they enter, their email address, their role in the team, and any tags they or their manager apply to them (for example which station or shift type they work).
An email address is required for everyone. Backfyl has no passwords. You sign in with a six-digit code sent to your email, so we need an address that reaches you. We also use it to get you back in on a new phone, and to tell you if the email on your account is changed. We don't use it for marketing.
Face ID, if you turn it on: your phone (or computer, or password manager) makes a passkey for signing in to Backfyl. We keep its public half, a random number it's filed under, which email it signs in, a name for it (for example "iPhone") and when it was set up and last used. Your face or fingerprint never leaves your phone, and we never see it.
What your team puts into Backfyl: requests for cover, replies, private questions and answers about a request, who a shift was given to, roster and calendar entries (including any break and note on a shift), and shifts swapped between colleagues, with any note about the swap.
Availability and leave: the times you say you can't work (every week on certain days, or on certain dates; all day or between two times), with any note you add, and the leave you ask for: its kind (annual, personal/carer's, unpaid, long service or other), the dates, any note, and whether a manager approved or declined it, with their note. Notes are optional. Please don't put health details in them: "personal leave" is enough.
Certificates, if your team records them (for example RSA, RSG or Food Safety Supervisor): which ones you hold, each one's number and expiry date if they're entered, and whether a manager has marked it as checked. The number is optional: it's the certificate's or registration's own number, never a tax file, Medicare, passport or driver's licence number.
If your team connects Xero (payroll, which your team's admin chooses to connect): to match people to their Xero employee records, Backfyl reads your team's employee list from Xero (names, email addresses and Xero's employee IDs) and keeps each match. When someone who manages timesheets sends a pay period to Xero, each matched person's approved hours, day by day, go to your team's Xero account as draft timesheets, and Backfyl keeps a record of what was sent. The keys for the connection, issued by Xero, are kept in your team's database.
If your team adds you from a list: your name and email address, which your manager gives us so we can email you your invite. We use them only for that. If you don't join, the invite expires and nobody can use it but you.
If your team uses tap on and off (time and attendance, which your team's admin chooses to turn on): when you tap on, start and end a break, and tap off; the hours you send if you forgot to tap; and any change a manager makes to your hours, with the note they give. If your admin also has location recording on, your phone's location, and how accurate the phone says it is, is recorded at the moment you tap, never in between, and compared with the workplaces your admin has saved. You can only tap on once you're at your workplace: if you're not, the tap doesn't go through and your location isn't kept. While a shift is ready to tap on and that screen is open, the app checks your location on your phone to light up the button. That check stays on your phone and isn't sent to anyone. Your phone asks your permission first. You can say no: you then can't tap on for a shift at a workplace with a saved location, and you send your hours afterwards for your manager to approve. Tap off and breaks still count, and are marked "No location".
A record of changes: when a manager or admin changes the roster, an allocation, leave, a swap, cover, timesheets, people or the team's settings, Backfyl keeps a line saying who did it, when and what (for example, who moved a shift and from when to when), and the reason when one was given. Changes to pay say what was changed, not the amounts.
From your device: a record of each device you're signed in on and, if you turn notifications on, the address your browser gives us to deliver them to that device.
Technical logs: like any website, our servers record the IP address, browser type, time and page for each request.
Support and feedback: if you email us, or write to us from the app (Menu, then “Tell us how to improve Backfyl”), we keep the correspondence. Feedback from the app comes with your name, email address, role, team and the screen you were on, so we can reply to you. It goes to the Backfyl team only: your team's managers don't see it.
We don't ask for sensitive information, such as health details, or government identifiers like tax file, Medicare, passport or driver's licence numbers, and Backfyl isn't built to hold it. Please don't put it into names, tags, requests or messages. That includes information about patients. A certificate's number (an RSA or AHPRA registration number, say) is the one exception, and it's optional.
We use this information to run your workspace (showing requests and replies to the right people, recording the hours worked if your team uses tap on and off, and following the rules your team chose), to sign you in, to send notifications and service emails (sign-in codes, invites, account and billing notices), to give support when you ask for it, and to bill through Stripe. We don't sell personal information and we don't use it for advertising.
A request for cover goes to the people its sender picks. Your admin chooses whether the rest of the team can also see that a request exists, or only the people it was sent to. Either way, a reply is seen only by the person who sent the request and the team's managers, not by the rest of the team. Timesheets (tap on and off) are seen by the person they belong to, by the team's admins, and by anyone an admin has allowed to manage timesheets, including where each tap was made when location recording is on. Your availability, leave and certificates are seen by you and by the team's managers (those allowed to run the roster), not by the rest of the team. Managers can also see whether each person can get Backfyl's notifications, but not which devices they use. The record of changes is seen by the team's admins; managers see the part about the venues and departments they run, and changes to pay are seen by admins and anyone with Payroll access. One team can never see another team's data.
We never sell personal information. We don't rent it, trade it or pass it to advertisers or data brokers either.
We use a small number of providers to run Backfyl. Each one handles only what it needs for its part of the service:
We don't share personal information with anyone else unless the law requires it, it's needed to protect someone's safety or rights, or you've agreed.
Billing is handled entirely by Stripe. You enter your payment details on Stripe's own checkout page. They don't pass through Backfyl's servers and we don't store them.
For Backfyl Workforce, which is billed by the number of people in a workspace, backfyl.com asks each workspace a few times a day how many people can sign in to it, keeps each day's highest count, and passes the count to Stripe. Only the number is kept, not who the people are.
Each workspace's app and database run in Railway's EU West region in the Netherlands, unless the workspace's Enterprise agreement with Backfyl includes hosting in Australia. For such a workspace, its app, its database and the database's backups run in Microsoft Azure's Australia East region in Sydney, so its workspace data is stored in Australia.
Either way, the backfyl.com website runs in the Netherlands. It keeps each workspace's account and billing records (the organisation's name, the owner's email address and the plan). Your email address passes through it when you sign in to the Backfyl app, and a passkey you set up is registered there. It also passes notifications on to the iPhone and Android apps. Emails, payments and error reports are handled by the providers in section 4, in the United States and the other countries they operate in. By using Backfyl you agree to your information being handled in those places.
If personal information is ever exposed in a way likely to cause serious harm, we'll tell the affected teams' admins promptly and notify the Office of the Australian Information Commissioner where the law requires it. No online service can promise absolute security, and we don't.
Apart from downloading timesheets and deleting your own account, there's no self-service export or delete button in the app yet. Email us (section 10) and we'll do either for you.
You can ask us to show you, correct or delete the personal information we hold about you, or ask how it's handled, using the contact details below. If you're a team member rather than the admin, you can also ask your team's admin, since they control who is on the team and what's recorded about you.
Questions, requests or complaints about how we handle personal information: [email protected]. We'll respond as promptly as we can. If you're not satisfied with our response, you can raise a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
We may update this policy as Backfyl or our practices change. We'll update the "Last updated" date above, and for material changes we'll make a reasonable effort to let active admins know.
← Back to Backfyl