Site Day Privacy Policy
Effective date: 13 October 2026
Site Day is a health and safety and time recording app for construction crews, made by ThreeNineteen Limited (“we”, “us”), a New Zealand company. The office schedules health and safety work, crews complete and sign it on site, and the records go back to the office.
This policy explains what personal information Site Day collects, why, who can see it, where it is stored, and your rights under the New Zealand Privacy Act 2020.
The employment context
Site Day is a workplace tool. You use it because the company you work for or contract to (“your company”) uses it to run health and safety and time recording on its sites. Your company decides who has access, what is scheduled, and how long records are kept. We operate the app and the systems behind it. Questions about how your company uses your information should go to your company. Questions about the app itself can come to us (contact details at the end).
What we collect
Account and profile information. Your name, email address, role (worker, supervisor or admin) and the projects you are assigned to. Your company provides this when your account is set up. Accounts are created by your company; you cannot sign up from inside the app.
Health and safety records. The content of records you create, complete or sign in the app: toolbox talks, Task Analysis, site and equipment inspections, hazard reports, incident reports, worker sign-offs, notes and document acknowledgements. This includes free-text notes and details you enter.
Signatures. When you sign a record, your drawn signature is captured as an image and attached to that record. Signed records are locked and cannot be edited by field users. If you decline to sign a record you are asked to sign, the reason you give is kept with the record.
Photos. Photos you choose to attach to records, taken with the camera or picked from your photo library. The app only uses the camera or your photos when you use those features.
Incident and injury details. Incident reports can include descriptions of injuries, the people involved and witnesses. We treat this as sensitive information. Access is restricted (see “Who can see your information”), and your company keeps it because health and safety law requires a record of serious events.
Training records. Your company can keep a register of the training and tickets its workers hold.
Time records. If your company uses time tracking, the hours you record: the date, the site, start and finish times, breaks and notes, and the weekly timesheets you submit. Changes made to a time entry after it is submitted are logged with who made them and why.
Site check-in events. If your company uses site check-in and you switch it on, the app records when you arrive at or leave an assigned job site. See “Site check-in and location” below for exactly what is and is not recorded.
Automatic record stamps. Records are stamped with the date and time they were created and submitted, and the project (site) they belong to. The stamped values are shown on the record.
Device push token. If you allow notifications, we store a push notification token for your device so the office can send schedule and sign-off reminders to your phone. Declining notifications does not limit the app. The in-app notification list still works.
We do not collect advertising identifiers, we do not use third-party analytics or tracking, and we never sell personal information.
Site check-in and location
The app works without your location, and recording your time by hand always remains available. Site check-in only runs if your company has turned it on for a site and you have switched it on in the app and allowed location access on your phone. You can switch it off at any time, in the app or in your phone’s settings.
Your company chooses how site check-in is used. It can leave it off, make it optional, or require it for some or all of its workers as part of how it records time. If your company requires it, the check-in card in the app says so. Whether you are required to use it is decided by your company, not by us. Questions about that policy should go to your company.
When it is on:
- Your phone watches for you arriving at or leaving your assigned job sites, using a boundary your company has set around each site. To do this while the app is closed, iOS asks for “Always” location access.
- The app then suggests a clock-in or clock-out. You confirm it. Nothing is added to your timesheet without you.
- Your coordinates are never sent to us or stored. A check-in event records only who, which site, arrived or left, and when.
- Site Day does not track you away from job sites. There is no route history, no live map of the crew and no “last seen”.
- Check-in events are kept for the current and previous week, then deleted.
- Check-in events can be seen by you and by the supervisors and administrators of that site.
Separately, an administrator setting up a site boundary can use their own phone’s current location once to mark the centre of the site. That stores the location of the site, not of a person.
How we use your information
- To run the app: show you your day, your projects, your records, your timesheet and your notifications.
- To create the official health and safety record: completed records are made into PDF reports, filed against the project, and emailed to the report recipients your company has nominated.
- To record hours worked so your company can approve timesheets.
- To meet your company’s legal duties under the Health and Safety at Work Act 2015, including incident recordkeeping and, where required, notification to WorkSafe New Zealand.
- To keep the service secure: access records and audit logs help us and your company’s administrators look into misuse.
We do not use your information for advertising, profiling or any purpose unrelated to workplace health and safety, time recording and the running of the app.
Who can see your information
Access follows your role and the projects you are assigned to, and is enforced by the database itself:
- Workers see their own records and timesheets, and the shared safety information for projects they are assigned to (site documents, registers, schedules).
- Supervisors also see records and timesheets for the crews and projects they supervise, including incident reports on those projects.
- Administrators at your company (the office) see all of the company’s records, manage the registers, approve timesheets and receive filed reports.
- Report recipients nominated by your company receive filed record PDFs by email.
- Our staff can access data only to operate, support and secure the service.
Incident and injury details can be seen by the person who reported them, supervisors of the affected project and administrators. They are not shown to the wider crew.
Where your information is stored
Your information is stored with our hosting provider Supabase, in the Sydney, Australia region (Amazon Web Services infrastructure), encrypted in transit and at rest.
Because this is outside New Zealand, the Privacy Act 2020 requires us to tell you: Australia’s privacy law provides safeguards comparable to New Zealand’s, and our providers are bound by contract to protect your information.
We use a small number of service providers to run specific parts of the service:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, file storage and sign-in | Sydney, Australia |
| Resend | Delivers filed-report emails to your company’s nominated recipients | United States |
| Expo and Apple | Deliver push notifications to your device | United States |
| Cloudflare | Serves our web systems, including making the PDF reports | Global network |
These providers handle data only on our instructions to provide their service. We do not share personal information with anyone else except where the law requires it (for example, a WorkSafe New Zealand investigation).
How long records are kept
Your company is responsible for keeping its health and safety and time records, and it decides how long they are kept. We hold them on your company’s behalf for as long as it uses Site Day.
The law sets minimum periods for some records, and those duties sit with your company:
- Notifiable events: a record of each notifiable injury, illness or incident must be kept for at least 5 years under the Health and Safety at Work Act 2015. Some records, such as certain health and exposure monitoring, must be kept longer under the regulations.
- Wage, time, holiday and leave records: at least 6 years under the Employment Relations Act 2000 and the Holidays Act 2003.
What we do on our side:
- Site check-in events: kept for the current and previous week, then deleted.
- Profile information: kept while your account is active. When you leave your company, your access is removed. Your name stays on records you signed, because a signed safety record must stay intact.
- Audit logs: kept as long as the records they relate to.
- When a company stops using Site Day: we give the company its records, keep them for 90 days, then delete our copies. After that the company holds the only copy.
Security
- All data is encrypted in transit (TLS) and at rest.
- The role and project rules above are applied by the database itself, not only by the app screens.
- Signed records are locked, and each signature is tied to its record.
- Office edits to a filed record and changes to time entries are logged.
No system is perfectly secure. If we become aware of a privacy breach likely to cause serious harm, we will notify the people affected and the Office of the Privacy Commissioner as the Privacy Act 2020 requires.
Your rights
Under the Privacy Act 2020 you have the right to:
- Access the personal information we hold about you.
- Ask for it to be corrected if it is wrong. A signed, locked health and safety record is not rewritten; your company’s office can correct it with the change logged, or note your request against it.
You can also ask for your account to be closed. Your access is removed, and the records you made or signed stay with your company, which is required by law to keep them.
To use these rights, contact your company’s administrator or contact us directly (details below). We will respond within the time the Privacy Act sets (normally 20 working days).
If you are not satisfied with how a privacy concern is handled, you can complain to the Office of the Privacy Commissioner: privacy.org.nz | 0800 803 909.
Children
Site Day is a workplace tool for construction crews and is not intended for children.
Changes to this policy
If we change this policy, we will update the effective date at the top. For significant changes we will tell your company before the change takes effect.
Contact
ThreeNineteen Limited, New Zealand
Email: privacy@threenineteen.co.nz