Privacy Policy

Account and workspace information — your name, email address, and (if you use email sign-in) a hashed password. When you sign in with Google, we receive the profile information you approve (name, email address, avatar).

Business data you enter into Foreman — clients, contacts, leads, sites, quotes, invoices, jobs, schedules, timesheets, products, forms and any other records you create. This is the data you work with every day; it belongs to you and your business.

Staff and payroll data — the details you keep about your team, described in the next section.

Connected services — when you connect a service such as Gmail, Outlook, Xero, QuickBooks Online or Gusto, we store the encrypted access tokens or API keys that let Foreman talk to it (never your password for that service) and the data you authorise Foreman to sync. See "Connected services" below.

Call data — if you use Foreman's phone receptionist, we record and transcribe calls you direct through it, and keep those recordings and transcripts in your workspace.

Billing information — payment cards and billing details for your Foreman subscription are processed by Stripe. We store your plan, subscription status and invoices, but card numbers never reach our servers.

Technical and usage data — log data, error reports, device and browser details, and how you use Foreman, so we can keep the service reliable and improve it.

If you use Foreman to manage your team, your workspace can hold your staff's names, contact details, roles and crews, emergency contacts, date of birth, pay rates and employment conditions, leave, rosters, clock-ins (including the time and, when the phone shares it, the location of each clock-in and clock-out) and timesheets.

You decide what goes in, and you're responsible for having the right to collect it and for telling your staff how it's used. We handle this data on your behalf, only to provide Foreman to you — for example to calculate hours and costs, build timesheets, and send approved hours to the payroll service you connect.

Access inside your workspace follows the roles and permissions you set, so you can limit who sees pay rates and other sensitive staff details.

When you connect a payroll or accounting service, Foreman sends it only what's needed for the feature you use — such as employee names and email addresses for matching, and approved timesheet hours — and reads back what it needs to link records, such as the employee list, pay calendars and pay types.

We use your information to run Foreman: to sign you in, save and sync your business data, send quotes and invoices, schedule jobs, prepare timesheets, connect the services you choose, and answer your requests with AI.

AI features — Foreman uses AI models to draft quotes, summarise emails, answer calls and help with other tasks. Foreman's AI runs on Microsoft Azure OpenAI Service: content you ask the AI to work on is sent there to generate a response. We don't use your data to train third-party AI models, and Azure OpenAI Service doesn't use it to train models.

Email and SMS delivery — when you send quotes, invoices or messages through Foreman, email is delivered via your connected mailbox, your own SMTP server, or Foreman's default email service, and texts via our SMS provider.

Product analytics — we measure how features are used so we can improve them.

We don't sell your personal information, we don't share it for advertising, and we don't share it with anyone outside the service providers needed to run Foreman.

Foreman only connects to another service after someone in your workspace authorises it — usually by approving that service's own permissions screen, or by pasting in an API key the service gave you. Foreman never sees your password for the other service.

Here's what you can connect, and what data flows:

• Xero — invoices, bills, contacts, items and payments sync between Foreman and your Xero organisation; Foreman can read reports such as profit and loss and aged receivables; and for Xero Payroll AU, employees and pay calendars are read and approved timesheets are sent to Xero.
• QuickBooks Online (Intuit) — invoices, bills, payments, customers, vendors and items sync between Foreman and your QuickBooks company; Foreman can read reports such as profit and loss, trial balance and aged receivables; and approved timesheet hours can be sent as time activities for your employees.
• Gusto (United States) — Foreman reads your Gusto employees and jobs so you can match them to staff, can create employees you choose to add, and sends approved timesheet shifts to Gusto Time Tracking.
• Employment Hero Payroll (Australia, New Zealand, United Kingdom) — Foreman reads the businesses and employees your API key can open and sends approved timesheet lines to the business you choose.
• Stripe — if you connect your own Stripe account to take payments, Foreman creates payment links and card-reader payments on that account and reads back their status.
• Square — if you connect your own Square account, Foreman creates Pay with Square links and Square Terminal payments at the location you choose and reads back their status.
• Google (Gmail, Calendar, Drive, Contacts) and Microsoft Outlook — Foreman reads and sends email from your mailbox, manages calendar events, and works with the files and contacts you authorise. You can also connect another mailbox over IMAP and SMTP.
• CompanyCam — Foreman reads projects and photos and can create projects, using the API token you provide.
• Zapier and AI assistants (such as Claude and ChatGPT) — these connect to Foreman, not the other way round. With the API key or sign-in you approve, they can read and change the workspace data your settings allow.

Payments you take through Stripe or Square go directly from your client to your own Stripe or Square account. Foreman never holds those funds, and card details are entered with Stripe or Square, never stored by Foreman.

We use data from a connected service only to provide the Foreman features you use with it. We don't sell it, use it for advertising, or use it to train AI models.

Access tokens, refresh tokens, API keys and mailbox passwords are encrypted at rest with AES-256-GCM and only decrypted in memory when Foreman needs to call the service.

When you disconnect a service in Foreman, we delete its stored tokens or keys straight away and stop syncing. For Xero and QuickBooks we also clear the company data Foreman had cached, and for QuickBooks and Square we revoke Foreman's access at the provider too. You can also remove Foreman's access from the other service's own settings at any time. Records that were already synced into your workspace — for example invoices or staff you imported — stay in your workspace until you delete them.

Each connected service is run by its own provider under its own terms and privacy policy.

Foreman's use of information received from Google APIs adheres to Google's API Services User Data Policy, including the Limited Use requirements.

When you connect Gmail, Calendar, Drive or Contacts, Foreman only accesses the data you have explicitly authorised, and only to provide the features you use: reading and sending email, managing calendar events, working with documents, and maintaining contacts. You can revoke access at any time in your Google account settings or by disconnecting the integration in Foreman — data Foreman has already synced stays in your workspace until you delete it.

We share information only with the service providers required to operate Foreman, and only what each one needs for its job:

• Hosting — Foreman's servers and database run on a virtual private server from Hostinger. Uploaded files may be stored with Amazon Web Services (S3).
• Network and security — Cloudflare serves our websites and runs the secure sign-in service that completes connections to services such as Google, Xero, QuickBooks, Gusto and Square.
• Payments — Stripe processes Foreman subscriptions. Stripe and Square process payments you take from your clients, on your own accounts.
• AI — Microsoft Azure OpenAI Service runs Foreman's AI features, including chat, voice and transcription, on content you ask them to work on. It doesn't use your data to train AI models.
• Phone and voice — Twilio and LiveKit carry phone-receptionist and voice calls; Deepgram and Cartesia provide speech-to-text and text-to-speech.
• Email and SMS — Hostinger Mail delivers Foreman's default email; Textmagic delivers text messages.
• Maps and push notifications — Google Maps for addresses and routes; Expo delivers notifications to the Foreman phone app.
• Product analytics — PostHog, to understand how Foreman is used.
• Web browsing — Browserbase, when you ask Foreman's AI to look something up on a website.

We may add or change service providers as Foreman grows; when we do, we'll update this list.

We will also disclose information where the law requires it, or to protect the rights and safety of Foreman, our users or the public.

Foreman's main servers are hosted by Hostinger in Kuala Lumpur, Malaysia, with daily backups. We're based in Australia, and several of our service providers are in other countries, including Malaysia and the United States. That means your information may be stored or processed outside the country where you live.

When we send information overseas, we take reasonable steps to make sure it's protected to a standard comparable to Australian privacy law, including by choosing providers with strong security and privacy commitments and, where required, standard contractual clauses.

Your data is transmitted over encrypted connections (TLS) and stored in controlled data centres.

Integration tokens, API keys and mailbox passwords are encrypted at rest with AES-256-GCM before they touch disk, and are only decrypted in memory when needed.

Passwords for Foreman are stored as salted hashes — we never keep them in plain text.

We limit access to your data to the people and systems that need it to run the service, and we regularly review our security practices.

No method of storage or transmission is 100% secure — we work hard to protect your data, but we can't guarantee absolute security.

Found a security issue? Please email security@yesforeman.com. Details are also at https://yesforeman.com/.well-known/security.txt.

We keep your data for as long as your workspace is active, so your history stays intact and searchable.

You can delete individual records at any time. Deleted jobs and crews can be restored for 30 days, then they're permanently removed.

When a workspace is closed, its subscription is cancelled, no one can open it, and its data is permanently deleted 30 days later. We take daily backups; copies in them are overwritten as those backups cycle out.

We may keep some records longer where the law requires it — for example billing records for your Foreman subscription, which we keep for tax purposes.

You can access, correct or export your business data from within Foreman at any time — Settings → Export your data downloads everything as spreadsheets, even after your subscription ends.

You can disconnect any connected service, which deletes its stored tokens and stops new syncs straight away.

You can delete your Foreman account yourself at any time: in the phone app go to Profile → Delete account, or on the web go to Settings → Account → Delete your account (app.yesforeman.com/settings?section=delete-account). Your login, sessions, connected accounts and workspace memberships are deleted straight away; records a business needs to keep (such as job history and timesheets) stay with that business with your name removed. If you're the only person in a workspace, it's closed, its subscription is cancelled and its data is deleted 30 days later.

To close a workspace that has other members, or to ask about anything else in this policy, contact us using the details below.

If you're a client or staff member of a business that uses Foreman, that business decides how your information is used. Please contact them first — we'll help them respond.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You can ask to see the personal information we hold about you and ask us to correct it.

If you have a complaint about how we've handled your personal information, contact us first and we'll respond within 30 days. If you're not satisfied, you can contact the Office of the Australian Information Commissioner (https://www.oaic.gov.au).

If you're in the European Economic Area or the United Kingdom, you have rights under the GDPR and UK GDPR: to access, correct, export or erase your personal information, to restrict or object to certain processing, and to withdraw consent where we rely on it.

We process account information to provide the service you signed up for (performing our contract with you) and for our legitimate interests in keeping Foreman secure and improving it. For the business data a workspace puts into Foreman, the business is in charge of it and we process it on its behalf.

You can also complain to your local data protection authority.

If you live in California or another US state with a consumer privacy law, you have the right to:

• Know what personal information we collect, use and disclose, and get a copy of it.
• Delete personal information we hold about you.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of your personal information. Foreman doesn't sell personal information, or share it for cross-context behavioural advertising, so there's nothing to opt out of — but you're welcome to ask.
• Not be treated differently for using any of these rights.

The categories of personal information we collect are described in "Information we collect" above, and the businesses we disclose them to are listed in "Service providers we use". We don't use sensitive personal information for anything other than providing Foreman.

To make a request, email support@yesforeman.com. We'll confirm your identity before acting on it, and you can use an authorised agent to make a request for you.

Foreman is a tool for businesses and isn't directed at children. We don't knowingly collect personal information from anyone under 16.

If you have questions about this policy or about your data, email us at support@yesforeman.com. For security reports, email security@yesforeman.com.

We may update this policy from time to time. When we make material changes, we'll let you know through the app or by email. The latest version is always at https://yesforeman.com/privacy.