Privacy Policy

VericoHub ("VericoHub", "we", "us") respects your privacy. This Privacy Policy explains what personal information we collect when you use VericoHub — including the web application at vericohub.com, the VericoHub mobile app for iOS and Android, the VericoHub API, and the VericoHub Microsoft Teams agent ("Service") — how we use it, and the choices available to you. We are committed to handling personal information in line with the Australian Privacy Principles set out in the Privacy Act 1988 (Cth).

1. Information we collect

We collect personal information directly from you and from your organisation's use of the Service:

• Account information — name, email address, mobile number, role, and the VericoHub organisation ("Customer") you belong to. You provide this when an administrator creates your account, when you sign in via Microsoft Entra ID single sign-on, or when you register yourself in the mobile app (see "Mobile application" below).
• Identifiers — your Microsoft Entra ID tenant identifier (tid) and object identifier (oid), used to link your Microsoft identity to your VericoHub user record and to authorise requests from the Teams agent.
• Usage data — pages visited, actions taken, API calls made, and audit log entries (including the Teams agent's tool calls) are stored to provide the Service and meet your organisation's compliance and audit obligations.
• Content you submit — contractor records, form responses, documents, photos, comments, and messages directed at the Teams agent. This is the data your organisation manages in VericoHub.
• Technical data — IP address, browser/device type, app version, and similar telemetry collected via standard server logs and observability tooling to operate the Service securely.

2. How we use information

We use personal information to:

• provide, secure, and improve the Service;
• authenticate users and authorise access to your organisation's data;
• respond to support requests and communicate operational notices;
• generate the audit logs your organisation needs to evidence compliance;
• detect, investigate, and prevent fraud, abuse, and security incidents; and
• comply with our legal obligations.

3. Mobile application

When you use the VericoHub mobile app (iOS and Android):

• Registration — if your email is new to VericoHub, the app asks for your first and last name and mobile number, and you choose the organisation you work with. This creates your VericoHub account. Sign-in uses a one-time code emailed to you; we do not collect a password.
• Camera and photo library — the app requests access to your camera and photo library only so you can attach photos and documents to forms you complete. Photos are used solely for that purpose, are uploaded to your organisation's VericoHub records, and are not accessed at any other time.
• Push notifications — if you enable notifications, we store a device push token so we can deliver in-app alerts. You can turn notifications off at any time in your device settings.
• Device information — standard device model, operating-system version, and app version are collected to operate the app securely and to diagnose issues.

4. Microsoft Teams agent

When you use the VericoHub Teams agent, your messages, Microsoft account identifiers, and the tool calls the agent makes on your behalf are processed to answer your question or perform the requested action. Message content is sent to Azure OpenAI Service for language understanding and tool selection; Microsoft processes that data under its own privacy commitments and does not use it to train foundation models. Tool calls executed by the agent are subject to confirmation cards before any data is changed.

5. Sub-processors

We use the following sub-processors to deliver the Service:

• Microsoft Azure — hosting, database, key management, observability.
• Microsoft Entra ID — identity and single sign-on.
• Azure OpenAI Service — language model for the Teams agent.
• Microsoft Teams platform — message transport for the Teams agent.
• Azure Communication Services — transactional email.
• Apple and Google — mobile app distribution (App Store / TestFlight and Google Play) and mobile push delivery (APNs / Firebase Cloud Messaging) where notifications are enabled.

6. Where data is stored

Your organisation's data is stored in Microsoft Azure data centres in Australia East. Some sub-processor services (e.g. authentication, mobile push) may process limited identifiers in other Microsoft, Apple, or Google regions per their standard architecture.

7. Retention

We retain personal information for as long as your organisation's account is active and for a reasonable period after termination to meet audit, compliance, and legal-hold obligations. On termination of your organisation's agreement we will return or delete personal information in accordance with that agreement.

8. Sharing

We do not sell personal information. We share personal information only: (a) with the sub-processors listed above, under written contracts that require equivalent protection; (b) with your organisation's other authorised users in accordance with the access controls your administrator configures; (c) where you direct us to (for example, when a reminder email is sent to a contractor you nominate); or (d) where required by law.

9. Your rights

You have rights under the Australian Privacy Principles, including the right to access and correct your personal information, and to make a complaint. Contact your VericoHub administrator first for matters about your account; for anything involving how we collect, use or share personal information, email privacy@vericohub.com. We aim to respond within 30 days.

10. Security

We use industry-standard controls — including transport encryption (TLS), encryption at rest, role-based access control, secret management via Azure Key Vault, and audit logging — to protect personal information. No system is perfectly secure; if we become aware of a breach affecting your personal information we will notify your organisation in accordance with applicable law.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent change. Material changes will be communicated to your organisation's administrator.

12. Contact

Questions about this Privacy Policy? Email privacy@vericohub.com.