Privacy policy
Assure is operated by Kyron Pty Ltd. Last updated 9 September 2026.
What Assure is
Assure records work health and safety activity on event and temporary work sites: inductions, plant pre-start checks, toolbox talks, JSAs, Take 5s, incident reports and related records. The organisation running your site (the operator) controls the workspace and the records in it. Kyron Pty Ltd provides the platform.
What we collect
From workers using a site QR link: name, email, phone, company, and where a record calls for it, a signature, photos you take, quiz answers and the certificate issued. Some operators also record position, date of birth, address and emergency contact details on a worker profile. From operator and contractor staff: account email, name, role and multi-factor enrolment. From paying operators: a billing contact, ABN and subscription state, handled by Stripe — card details never touch Assure. Weather data comes from public forecasts for the site’s coordinates, not from your device.
Why we collect it
Site records are WHS records. Operators keep them to meet duties under the WHS Act 2020 (WA), the model WHS laws in other jurisdictions, and their own safety systems. That is the only purpose site records serve. No advertising, no profiling, no sale of data. Our public website uses cookies for its own analytics and advertising measurement — only with your consent, and never inside a workspace or a site QR link. See “Our website and cookies” below.
Who sees it
Your site operator and, for contractor workers, your own company — access is scoped by role and workspace. One deliberate exception: a certificate’s verification page shows the holder’s name, the induction, the site and the dates to anyone holding the certificate number or its QR code. That is what makes the certificate checkable at a gate. Certificates added to Apple Wallet or Google Wallet carry the same details on your own device.
Where it lives
Records are encrypted in transit and stored in Australia (Sydney) with our database provider. Broadcast messages are delivered through our SMS and email providers, which handle the recipient number or address for delivery. We do not hand data to anyone else unless the law requires it.
Sub-processors
Assure runs on a short list of providers, each handling only what its job requires: Supabase (database and file storage, Sydney, Australia), Vercel (application hosting and content delivery), Stripe (payments — card details go to Stripe, not to Assure), Resend (email delivery), Twilio (SMS delivery), and Apple and Google (wallet passes you choose to add to your own device).
Our website and cookies
The public marketing pages (the home page, pricing, and these legal pages) can set analytics and advertising-measurement cookies (Google Analytics, Meta, LinkedIn) — but only after you accept them in the cookie banner. Decline and nothing loads. Change your mind any time via “Cookie settings” in the footer. The worker QR pages and the signed-in app never carry these tags. If you arrive from an ad, we keep the campaign tags from the link (and the referring page) in a first-party cookie so we know which advertising works; it identifies the campaign, not you.
How long we keep it
As long as WHS record-keeping obligations require, which for some records is years. Ask your site operator to correct or delete your details; where a record must be kept by law, it is retained and access-limited instead of deleted.
Your rights
The Australian Privacy Principles apply. You can ask what is held about you, ask for corrections, and complain — first to your site operator, then to Kyron Pty Ltd, then to the OAIC (oaic.gov.au).
Contact
Privacy questions about the platform: Kyron Pty Ltd, hello@assure.events. Questions about a specific site’s records: the site operator named on your induction.