Privacy Policy

1. Introduction

AttendSure (“AttendSure”, “we”, “us” or “our”) provides software designed to support organisations conducting structured online meetings, training, professional development and other facilitated sessions.

AttendSure provides functionality including camera-status monitoring, Live View, alerts, Presence Checks, session records, reporting and related administrative functionality.

We respect the privacy of our customers, users and meeting participants and are committed to handling personal information responsibly and transparently. This Privacy Policy explains how AttendSure collects, uses, stores, discloses and protects personal information when our services, website and platform are used. Where applicable, we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It should be read alongside our Terms of Service.

2. Information we collect

The information AttendSure processes depends on how the service is used.

2.1 Account and organisation information

When an organisation or authorised user creates or manages an AttendSure account, we may collect:

Payment card information may be processed by our payment provider. AttendSure does not need to directly store complete payment card details where payment processing is provided by a third-party payment processor.

Signing in with Google. If you choose “Sign in with Google”, Google tells us your name, your email address and an identifier for your Google account. We use them only to create your account and sign you in. We do not receive your Google password or any access to your Google data, such as your email, files or calendar.

How you found us. When a new organisation is created, we record against it where that first visit came from - the referring website, any campaign tags in the link, the page you arrived on, the approximate country and the type of device - taken from our own analytics described under “Cookies and similar technologies”. We use this only to understand which channels bring us customers.

2.2 Session and participant information

When AttendSure is used in connection with a supported online meeting or training session, we may process information such as:

2.3 Technical and usage information

We may collect technical information necessary to operate, secure and improve AttendSure, including:

We aim to collect only information reasonably required to provide, secure, maintain and improve the service.

3. What AttendSure does not access or record

AttendSure is designed to minimise the amount of meeting content it processes. AttendSure does not record, capture or store meeting video or audio as part of its monitoring functionality.

AttendSure is not designed to:

Where Live View functionality is provided, it is intended to give authorised users live session visibility. It does not mean AttendSure records or stores the underlying meeting video or audio.

The underlying meeting platform, meeting host, participants or other third-party software may separately provide or use recording functionality. Those activities are outside AttendSure’s control and are subject to the practices and policies of the relevant parties.

Microsoft Teams and Google Meet

AttendSure can also monitor sessions held in Microsoft Teams and Google Meet, which work differently from Zoom. Instead of the session host’s own browser joining the meeting, an AttendSure meeting bot joins it as a guest. The bot is operated for us by Recall.ai, an independently audited meeting-bot provider based in the United States, which processes this information on our behalf as a sub-processor. The meeting host must admit the bot from the lobby or “ask to join” list before it can join, and participants see it in the meeting under the name “AttendSure”, with a tile reading “AttendSure - Taking attendance for this session - nothing is recorded”.

What Recall.ai receives

Like any meeting guest, the bot receives what the meeting shares with its guests. AttendSure asks Recall.ai only for:

The bot is created with no video recording, no audio recording and no transcription, and with zero retention at Recall.ai: once the meeting ends, Recall.ai keeps nothing from it. Live View video is streamed live to the session host’s screen and is never recorded or stored.

Meeting chat

Microsoft Teams and Google Meet do not allow a bot to send private messages, so on those platforms a Presence Check is posted as one message in the meeting chat asking participants to reply. AttendSure reads the meeting chat only to recognise those replies and match each one to the participant who sent it. The text of chat messages is never stored: AttendSure keeps only the fact that a participant replied, as part of the Presence Check record described in section 4. Where a session host turns on general camera reminders for a session, they are posted to the whole meeting chat and never name a participant.

On Zoom, AttendSure does not read the meeting chat. Zoom messaging is used only to send private reminders and Presence Check messages.

What AttendSure stores

For a Teams or Meet session, AttendSure stores the same kind of session record as for Zoom, described in section 2.2: participant names, join and leave times, camera on/off changes and Presence Check results. The individual events the bot sends during a session are also kept in short-lived records, which are deleted 7 days after the session. The session record itself is kept for the retention period described in section 10.

4. Presence Check

AttendSure may provide a Presence Check feature that allows an authorised session host to send a request asking a participant to acknowledge their presence at a particular point in time.

When Presence Check is used, AttendSure may process and record:

A successful Presence Check records that an acknowledgement was received at a particular point in time. A Presence Check does not establish or guarantee that a participant was continuously attentive, engaged or present throughout an entire session.

AttendSure does not use Presence Check results to make automated legal or regulatory determinations about a participant.

5. How we use information

We may use information processed through AttendSure to:

We do not use camera-status or Presence Check information to claim that an individual is continuously attentive or engaged.

6. Customer responsibilities and participant notice

Organisations using AttendSure are responsible for determining whether their use of the service is appropriate for their circumstances and for meeting any notice, consent, workplace, training, contractual, privacy or other legal obligations that apply to them.

Customers should provide participants with appropriate notice that AttendSure is being used. Depending on the features enabled, that notice should explain that AttendSure may process information including:

AttendSure provides technology to customers. The customer remains responsible for how monitoring information and resulting reports are used within its organisation.

7. Reports, certificates and session evidence

AttendSure may generate session reports, participant summaries, event logs, spreadsheet exports, certificates or other session evidence. These records may contain factual information such as:

These records document information processed by AttendSure during a session. They should not be interpreted as a guarantee or independent legal certification that a participant satisfied any particular attendance, attention, engagement, training or regulatory requirement.

Customers are responsible for determining how AttendSure records are used in their own compliance, training or administrative processes.

8. Attendance certificates and verification links

A customer organisation may issue an attendance certificate to a participant in a session it ran. The certificate is generated from that session’s own record and is a fixed document: once issued, what it says does not change, even if the session record it came from is later removed. Any member of the issuing organisation may issue one.

8.1 The verification link

Every certificate carries a verification link. Opening that link shows a page confirming the certificate, and that page requires no AttendSure account and no sign-in. Anyone who has the link can open it, and can download a copy of the certificate. The link contains a long random token and is the only thing needed to view the certificate; it can be forwarded by whoever holds it.

The verification page shows:

The link exists so a participant can show a certificate to someone outside the issuing organisation - an employer, a professional body, a regulator - without that person needing an account. AttendSure does not publish certificate links, does not list them anywhere, and asks search engines not to index certificate pages. Deciding who receives a link is the issuing organisation’s decision and the participant’s, not ours.

A link can be replaced, and a certificate can be withdrawn. The person who issued a certificate, and the owners and administrators of the issuing organisation, can replace its link at any time - which immediately stops the old link working, whoever holds it - or withdraw the certificate, after which the page reports it as withdrawn rather than valid. A withdrawn certificate is marked withdrawn and kept, not deleted; see section 10.

A copy downloaded through the verification link does not reproduce the issuer’s signature image. The signed version can only be downloaded by a signed-in user of the issuing organisation.

8.2 Sending a certificate to a participant

A session host may enter a participant’s email address in order to send that participant their certificate. The email contains the verification link rather than an attachment. The address is stored on the certificate record, so the issuing organisation can see where the certificate was sent, and is kept for as long as the certificate is - see section 10. AttendSure does not send a certificate to anyone unless a user of the issuing organisation asks it to.

8.3 What a certificate does and does not establish

A certificate records what AttendSure observed during a session - that a participant’s camera was on, with no single absence longer than the limit the organisation set and, where Presence Checks were used, no missed check. As with the records described in section 7, it is not a guarantee or an independent legal certification that a participant satisfied any particular attendance, attention, engagement, training or regulatory requirement, and AttendSure does not verify a participant’s identity.

9. Storage and security

AttendSure uses reasonable technical and organisational safeguards designed to protect information against unauthorised access, misuse, interference, loss, alteration and disclosure. Depending on the systems and services used to provide AttendSure, these measures may include:

No internet-based service or electronic storage system can guarantee absolute security. Accordingly, while we take reasonable steps to protect information, we cannot guarantee that unauthorised access or a security incident will never occur.

10. Data retention and deletion

AttendSure retains personal information only for as long as reasonably necessary for the purposes for which it was collected, to provide the service, meet customer account requirements, resolve disputes, maintain appropriate business records and comply with applicable legal obligations.

Retention periods may vary depending on:

10.1 Session records: the retention period you set

An organisation’s owners and administrators choose how long AttendSure keeps its session records, from a fixed set of periods: 30 days, 90 days, 12 months, 24 months, or the longest period AttendSure offers, which is 10 years. Until that choice is made, records are kept for the longest period the organisation’s plan allows: 12 months during the free trial and on Solo and Starter, 24 months on Team, and 10 years on Business. Moving to a different plan never shortens a period already in force. Which of the longer periods an organisation can choose depends on its plan; the period currently in force always remains selectable.

Session records older than that period - the session, its participants, camera-status events, alerts, reminders and Presence Check results - are deleted automatically by a process that runs every hour. That deletion is permanent and cannot be undone. Separately, and regardless of that setting, security and administrative event logs are kept for 90 days and a record of emails we have sent is kept for 180 days.

10.2 Certificates are an exception, and are kept indefinitely

An issued certificate is not covered by the retention period above and is not removed when the session it came from is. This is deliberate. A certificate is a document, and a participant or a third party may be holding a copy of it and relying on the verification link still answering; a sweep that blanked it would change what an already-issued document says.

The practical consequence, stated plainly: the participant name, session title, date and duration on a certificate - and the participant email address, where one was entered to send it - are kept indefinitely. Withdrawing a certificate marks it withdrawn so the link reports it as no longer valid; it does not erase it. There is no control that deletes a single certificate.

Certificates are deleted when the organisation that issued them is deleted. An organisation’s owner can delete the organisation and everything belonging to it from within AttendSure, which removes its certificates along with its accounts, sessions and records.

Support requests you send us from within AttendSure, and our replies, are deleted automatically 24 months after the last message in the conversation.

10.3 Access, export and deletion

Where supported, authorised customers may access, export or delete certain information through AttendSure account controls or by contacting us. Information may remain temporarily within backups or system logs after deletion from active systems where reasonably required for security, recovery or technical purposes.

A participant who wants a certificate about them withdrawn, or wants to ask about information AttendSure holds, may contact us using the details in section 20. In most cases we will need to refer the request to the organisation that ran the session, because that organisation - not AttendSure - decides what its records say; see section 15.

11. Third-party service providers

AttendSure may use trusted third-party providers to operate and support the service. These may include providers involved in:

For example, AttendSure integrates with Zoom for meeting-related functionality, uses Recall.ai to join Microsoft Teams and Google Meet meetings, and uses Stripe for payment processing. Third-party providers process information in accordance with their own contractual obligations, privacy practices and applicable laws. We seek to limit information disclosed to service providers to what is reasonably necessary for them to perform the relevant service.

The providers we currently use are: Zoom (meeting integration), Recall.ai (meeting bots for Microsoft Teams and Google Meet, as described under “Microsoft Teams and Google Meet” above), Railway (hosting and database), Google (sign-in, only if you choose “Sign in with Google”), Stripe (payments and invoicing), Resend (transactional email), Sentry (error monitoring, which receives the page address, browser details and the technical error, and is configured not to receive names or email addresses) and Zoho Mail (our support and contact mailboxes, hosted in Australia, which receive the messages you send us). Our typefaces are served from our own servers, so no font service receives your details. We do not use advertising networks or third-party analytics: we measure how our website and the service are used with our own analytics, described under “Cookies and similar technologies” below, and that data is not shared with anyone.

Cookies and similar technologies

AttendSure sets only the cookies the service needs to work. We set no advertising cookie, no marketing cookie and no third-party analytics cookie, and we do not track you across other websites.

You can clear or block these in your browser. Blocking the sign-in session cookie will stop you being able to sign in, and blocking the recognised-browser cookie means we will email a code each time.

12. Overseas disclosure and processing

Some of AttendSure’s service providers, infrastructure or technical systems may be located outside Australia or may process information in other countries. As a result, personal information may be stored or processed outside Australia.

At present the application and its database are hosted in the Netherlands, error monitoring is processed in the United States, and payment processing, transactional email and the Zoom integration are operated by providers that process information in the United States and elsewhere. The meeting bots used for Microsoft Teams and Google Meet are operated by Recall.ai, which processes information in the United States. We can tell you where your organisation’s data is held at any time - just ask.

Where required, AttendSure will take reasonable steps in relation to overseas disclosures in accordance with applicable Australian privacy requirements. The countries in which information may be processed can change as our infrastructure and service providers change. Customers may contact us for further information about relevant overseas processing arrangements.

13. Billing information

AttendSure may use a third-party payment processor to manage subscriptions and payments. AttendSure may receive and retain information such as:

Complete card details are generally handled by the relevant payment processor rather than AttendSure.

When an organisation buys AttendSure Hours, the card it pays with is saved with Stripe so that Auto Top-Up can charge it later, but only if an owner or administrator turns Auto Top-Up on. AttendSure keeps a record of the hours each organisation receives, buys and uses, and of each payment and refund for them. Records of payments and refunds are kept for as long as Australian tax law requires a business to keep records of its sales, including after the organisation’s account is deleted.

14. Direct marketing

AttendSure may use contact information to communicate with customers and prospective customers about AttendSure products, services, updates or offers where permitted by law. Marketing communications will provide a method of opting out or unsubscribing where required.

Operational communications relating to accounts, security, billing, service changes or other necessary service matters may still be sent even where a person has opted out of marketing communications.

15. Access and correction

Individuals may request access to personal information AttendSure holds about them or request correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading. Requests can be made using the contact details below.

In some circumstances, AttendSure may need to refer a request to the relevant customer organisation where that organisation controls the relevant session or participant information. We may need to verify identity before responding to a request.

16. Anonymity and pseudonymity

Where practicable and lawful, individuals may have the option of interacting with AttendSure anonymously or using a pseudonym. However, certain AttendSure functions require identification because the service is designed to associate account, participant and session events with particular authorised users or meeting participants. For example, meaningful session monitoring and participant reporting may require a participant identifier or display name.

17. Data breaches

AttendSure maintains processes for responding to suspected or confirmed data-security incidents. Where a data breach is likely to result in serious harm and the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) applies, we will take appropriate steps, including notification to affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

We may also notify affected customer organisations where appropriate so they can take relevant action.

18. Privacy complaints

If you have a concern or complaint about how AttendSure handles personal information, please contact us using the details below. Please provide sufficient information for us to understand and investigate the issue. We will take reasonable steps to investigate privacy complaints and respond within a reasonable period.

If you are not satisfied with our response, you may be entitled to make a complaint to the Office of the Australian Information Commissioner (OAIC). Information about privacy complaints is available from the OAIC.

19. Changes to this Privacy Policy

AttendSure may update this Privacy Policy from time to time to reflect:

The current version will be published on the AttendSure website with an updated effective or “last updated” date. Where appropriate, we may notify customers of material changes.

20. Contact us

For privacy questions, access or correction requests, complaints or other privacy-related enquiries, contact:

AttendSure
Email: support@attendsure.net
Website: www.attendsure.net
Postal: GPO Box 1538, Sydney NSW 2001, Australia
ABN: 27 934 200 735