Privacy Policy

1. About This Policy

OneStop IT Talents Pty Ltd ("we", "us", "our") operates Skilio Track, an AI-powered work management platform. This Privacy Policy explains how we collect, hold, use, and disclose personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Policy covers the following categories of people whose information we handle:

• Platform users — administrators, managers, and team members who have an account on Skilio Track.
• Client contacts — individuals at client organisations whose contact details are stored by our users for billing and invoicing purposes.

2. Personal Information We Collect

Platform Users

• Name and email address (via our authentication system)
• Organisation name and ABN (if provided)
• Role, job title, and hourly rate (as configured by your workspace administrator)
• Billing details — name, address (processed by Stripe; we do not store card numbers)
• Time entries — project, task, duration, date, and notes
• Expense records — category, amount, description, and receipts
• Usage data — features accessed, login timestamps, activity logs
• Communications — support requests and emails you send to us

Client Contacts

When our users create client records for billing and invoicing, they may store:

• Client company name and contact person name
• Email address and phone number
• Billing address and currency preferences
• Hourly billing rates and project assignments

3. How We Collect Information

• Directly from you — when you create an account, set up your workspace, log time, or contact us.
• Via our authentication system — collects your email and name when you sign up or sign in with Google.
• Via Stripe — our payment processor collects billing information when you subscribe.
• Through Platform use — time entries, expense records, and project activity are recorded as you use the Platform.
• From workspace administrators — team members may be invited and have their role, job title, and rate configured by an administrator on their behalf.

4. Why We Collect Personal Information

We collect personal information for the following primary purposes:

• Providing, operating, and improving the Skilio Track platform
• Processing subscription payments and issuing GST invoices
• Authenticating users and managing account security
• Enabling time tracking, expense management, and project reporting
• Generating client invoices from tracked time and expenses
• Sending transactional emails (team invitations, invoice notifications, trial alerts)
• Responding to support requests
• Complying with legal obligations, including Fair Work Act record-keeping requirements

We will only use your information for a secondary purpose if it is related to the primary purpose, you would reasonably expect it, or you have consented — as required by APP 6.

5. Disclosure to Third Parties

We do not sell, rent, or trade personal information. We disclose information only to the following service providers, solely to deliver the Platform:

Each provider is bound by contractual obligations to protect personal information and may only use it for the specified purpose.

6. Overseas Disclosure (APP 8)

Some service providers listed above (Stripe) are located in the United States. Before disclosing personal information to these providers, we take reasonable steps to ensure they are bound by privacy obligations comparable to the APPs through contractual arrangements (data processing agreements).

Under APP 8.1, by using the Platform you consent to this overseas disclosure. You acknowledge that the overseas recipient is not required to comply with the APPs in relation to the information.

7. Data Storage and Security (APP 11)

• All data is stored in AWS Sydney (ap-southeast-2) — within Australia.
• All data is encrypted at rest using AES-256.
• All data in transit is encrypted using TLS 1.2 or higher.
• Access to personal data is restricted to authorised staff and systems.
• Platform user accounts can be deleted on request — see Section 9.

In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

8. How Long We Retain Data

9. Access, Correction and Deletion (APP 12 & 13)

You have the right to request access to the personal information we hold about you, and to request corrections if it is inaccurate, incomplete, or out of date.

Platform users can access and update their profile information directly within the Platform settings.

Client contacts whose details have been added by a workspace user should contact that user directly in the first instance. You may also contact us directly if you believe your information has been mishandled.

To request access, correction, or deletion, email us at privacy@skilio.com.au. We will respond within 30 days as required by APP 12.

10. Cookies and Tracking

We use the following cookies and browser storage:

• Authentication cookies — set by our self-hosted authentication system to maintain your signed-in session. These are necessary for the Platform to function.
• Session storage — used to remember UI preferences (e.g. active timer state, dismissed banners) within a single browser session.

We do not use advertising, analytics, or tracking cookies. We do not use Google Analytics or any third-party analytics service.

11. Complaints (APP 1)

If you believe we have breached the APPs or this Privacy Policy, please contact our Privacy Officer at privacy@skilio.com.au or legal@skilio.com.au. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify Platform users by email and post the updated Policy on this page with a revised effective date. Continued use of the Platform after the effective date constitutes acceptance.

13. Contact Our Privacy Officer