Calmain
Start free

Privacy Policy

Calmain Pty Ltd (ACN 661 180 276) ("Calmain", "we", "us") provides the auround software platform for payroll, rostering, bookkeeping and related business tools. This Privacy Policy explains what personal information we collect, why we collect it, and how we handle it.

This policy applies to personal information collected through auround (auround.com) and our website (calmain.au). By using our services, you agree to the practices described here.

1. Information we collect

We collect only the information needed to provide and operate our services:

  • Account information — your name, email address, phone number, and (optionally) avatar, profile details and gender. Passwords and lock-screen PINs are stored only as salted hashes, never in plain text.
  • Address details — your residential and postal address, used for account identification and superannuation fund member matching.
  • Business data — the records you enter while using auround, such as rosters, timesheets, pay rates, pay runs, invoices, quotes, transactions and bookkeeping data.
  • Employee and tax data — for staff you add, the information needed to run payroll and meet your legal obligations: date of birth, employment type, residency status, pay and super rates, tax file number (TFN), tax-free threshold, child support obligations, study or training loan status, and horticulturist/shearer declaration.
  • Financial and superannuation data — bank account details (BSB and account number) used to pay staff, and superannuation fund details (fund name, member number, USI, and SMSF details where applicable).
  • Files and photos — documents, receipt and invoice images, and menu photos that you upload.
  • Payment data — a Stripe customer identifier and payment-related data used to process billing.
  • Technical data — device identifiers, push-notification tokens, IP address and log data used for security, fraud prevention and rate limiting.

2. Sensitive information

To run payroll and meet Australian reporting obligations, we process certain sensitive information, including:

  • Tax file numbers (TFNs) — used only to report to the Australian Taxation Office (ATO) through Single Touch Payroll (STP). We handle TFNs in accordance with the Privacy (Tax File Number) Rule 2015. You or your staff may choose not to provide a TFN, but this may prevent lawful STP reporting and result in higher withholding rates.
  • Bank account details — used only to pay wages and superannuation contributions.
  • Date of birth — used for STP and superannuation compliance.
  • Child support and study loan status — used only to calculate ATO withholding amounts.

This sensitive information is used solely for the payroll, superannuation and compliance purposes described here. It is never used for marketing or sold.

3. How we use your information

  • To provide, operate and improve auround.
  • To run payroll, rostering, bookkeeping and AI features on your behalf.
  • To meet legal obligations, including STP Phase 2 and SuperStream reporting.
  • To secure the platform, including authentication, abuse prevention and audit logging.
  • To respond to support requests.

We do not sell your personal information, and we do not use it to serve third-party advertising.

4. Who we share information with

  • Government and regulators — the ATO for STP reporting, and other authorities where required by law.
  • Superannuation funds — via a Sending Service Provider for SuperStream contributions. This includes member name, date of birth, gender, address, tax file number and contribution amounts, as required to allocate contributions to the correct fund and member.
  • Payment processors — Stripe, to process payments.
  • Service providers — infrastructure providers (such as Google Cloud) that host and process data on our behalf, subject to confidentiality and security obligations.

5. Overseas disclosure

auround data is stored in Australia (Google Cloud, australia-southeast1 region). Payment data may be transferred to Stripe's systems outside Australia, including the United States, where Stripe applies its own privacy protections and applicable data-transfer safeguards.

6. Security

We protect your data with multi-factor authentication, bcrypt-hashed passwords, encryption in transit and at rest, malware scanning of uploads, and a tamper-evident audit log. Access is limited to authorised personnel on a need-to-know basis.

7. Data retention and deletion

  • Account information — retained while your account is active, then deleted.
  • Business data — retained for 30 days after account deletion so you can re-register and recover it, then permanently deleted.
  • Legal requirements — where the law requires (for example, tax record-keeping), some information may be retained for a set period and used only for compliance.

To request deletion, visit the Account & Data Deletion page or contact us at admin@calmain.au.

8. Cookies

We use essential cookies and similar technologies to keep you signed in and to secure the platform. We do not use advertising or cross-site tracking cookies.

9. Your rights

Under the Australian Privacy Principles (Privacy Act 1988 (Cth)), you may request access to or correction of the personal information we hold about you. You may also request deletion of your account and data at any time. To exercise these rights, contact admin@calmain.au.

10. Data breaches

In the unlikely event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in line with the Notifiable Data Breaches scheme.

11. Contact

For privacy questions or requests, contact us at admin@calmain.au.

Last updated: September 2026