Bob: Permissions and Privacy Policy
1. Who we are
Bob is owned and operated by Subrosa Software Pty Ltd (ABN 38 679 396 028). In this policy, "we", "us" and "our" mean Subrosa Software Pty Ltd, and "you" means the person using the app.
In this document, "Bob" and "the platform" are used interchangeably and refer to the Bob mobile app, the web application and related services and all associated features, services and content provided by Subrosa Software Pty Ltd.
We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
2. What this policy covers
Sections 1 to 19 explain the device permissions Bob asks for, what each one is used for, what we do with the information collected through it, and how we record your consent. Sections 20 to 25 set out the terms on which you are permitted to use the platform.
Where you use Bob through an employer or head contractor, that organisation is generally the entity that decides what information is collected about you and why. We handle that information on their instructions. If you want your information corrected or deleted, we may need to refer you to them.
3. Permissions at a glance
| Permission | Used for | Active when | Optional |
|---|---|---|---|
| Microphone | Speech to text dictation | While dictation is running | Yes |
| Siri and shortcuts (iOS) | Triggering common actions by voice | While you are making a Siri request | Yes |
| Camera | Evidence photos, QR sign in and authorisation | While the camera or scanner screen is open | Yes |
| Photos | Attaching existing images | While the image picker is open | Yes |
| Location | Verifying site check ins | Foreground only, at check in and check out | Yes |
| AI features (in-app setting, managers only) | Automating steps on content you have entered | When you use an AI assisted feature | Yes |
Declining any permission does not lock you out of Bob. It disables the feature that depends on it, and we describe the fallback in each section below.
4. Microphone
Purpose. To convert speech to text so you can dictate notes, observations and form fields rather than typing them.
How it works. The microphone is opened only while dictation is active, and closed as soon as you stop. Bob does not record continuously, does not listen while in the background, and does not use the microphone for any purpose other than dictation.
What is collected. Speech is transcribed by the operating system's own speech recognition. On iOS this uses Apple's native speech APIs and Apple-hosted speech to text, which process your audio on your device or on Apple's servers depending on your device and settings. Either way, your voice is handled by the platform provider under its own privacy policy. It is never sent to Bob's servers and is never stored by us. We receive only the resulting text, which is treated the same as text you typed.
Retention. The transcribed text is stored with the record you attached it to, and follows that record's retention period in section 11.
If you decline. All fields can be typed manually.
5. Siri and shortcuts (iOS)
Purpose. To let you trigger common actions by voice or from a shortcut, such as starting a note or opening a job, without unlocking the phone and navigating the app.
How it works. Bob registers actions with Apple's App Intents system. When you speak a request, Siri interprets it, on your device or on Apple's servers depending on your device and settings, and passes Bob a structured instruction along with any details you named, such as the site. Apple handles the voice. We receive the resolved instruction, not the audio.
Bob also donates the actions you use to the system so that iOS can suggest them at relevant times. That information stays on your device and in your iCloud account. It is not sent to us.
Siri does not use Bob's microphone permission. Siri listens through the system's own microphone access, so you can use Siri actions whether or not you have granted Bob the microphone permission in section 4.
What Apple collects. What you say to Siri is handled by Apple, on your device or on Apple's servers, under Apple's privacy policy, not this one. Your voice is never sent to Bob's servers. Controls over Siri and dictation history are in your device settings.
What we collect. The action you triggered, the details you supplied with it, and the time. Anything you then save in Bob is collected as described in the sections that follow.
Location. Where a Siri action involves checking in or out, Bob opens so the location check happens with the app on screen, as described in section 8.
If you decline. Every action available through Siri is also available in the app. You can remove Bob's shortcuts in your device settings.
6. Camera
Purpose. Two things: capturing daily evidence photos at worksites, and scanning QR codes to authenticate the app.
How it works. The camera activates only while the capture screen or the QR scanner is open. QR frames are decoded in memory and discarded. They are not saved as images and are not sent to us. Evidence photos are only uploaded when you submit them.
What is collected. The evidence photos you submit, plus the time of capture, the job or site they were attached to, and your user account.
Who can see them. Evidence photos are visible to your employer or the site operator through the Bob dashboard, and to anyone they authorise.
If you decline. You can attach photos from your library instead, and sign in using a manual code rather than scanning a QR code.
7. Photos and media library
Purpose. To let you attach images you have already taken to a job, report or checklist.
How it works. Bob opens the system picker and receives only the files you select. We do not read, index or scan the rest of your library. On iOS you can grant access to selected photos only. Nothing is uploaded until you confirm.
What is collected. The images you choose, plus the job or site you attached them to and your user account.
If you decline. Use the camera to capture new images instead.
8. Location
You acknowledge that if you consent to location features being used, that you are giving your informed consent as may be required by state or federal laws in Australia
Purpose. To verify that a check in or check out actually happened at the site it claims to.
How it works. Bob uses your operating system's geofencing service. Your device holds the site boundary and evaluates your position against it locally, so the check of whether you are on site happens on your phone rather than on our servers. Bob records your coordinates only when you enter or leave a designated work site.
Location is read only at the moment of a check in or check out. Bob does not read your location between check ins, and does not track you outside those moments.
What is collected. The site identifier, the check in or check out time, whether the geofence condition was met, your coordinates at that moment, and your user account.
What this means over time. Because each check in is stored with a time and a coordinate, your history in Bob shows which sites you attended and when. It does not show where you went in between, or anything outside the moments you chose to check in or out.
Who can see it. Your employer or the site operator, through attendance and compliance reporting.
If you decline. You can still check in. The record will be flagged as unverified, and your employer may follow up separately.
9. AI features
Purpose. To automate repetitive work inside the app, this feature is only exposed to manager accounts.
What is sent. Only content you have entered into Bob yourself, and only the portion needed for the task you triggered. AI features do not access your contacts, files, messages, camera roll or anything else outside the app.
Who processes it. We send this content to Microsoft Azure, which processes it for us as a service provider under contract and returns a result. Your content is not used to train any models. Our subprocessors are listed in section 13.
Automated decisions. AI output in Bob is a draft or a suggestion. It does not make decisions about you, your pay, your employment or your site access on its own. A person reviews anything consequential.
Accuracy. AI generated text can be wrong. Check anything you are relying on before you submit it.
If you decline. Every AI assisted step in Bob can be completed manually. AI features are opt-in.
10. Recording your consent
Bob records your consent to our policies, when you provided it, and which version of this summary and our privacy policy you were shown. We keep this so we can prove your choices were yours, and so we know to ask again if what we do with a permission changes.
You can review and change every choice in your device settings.
We keep these records so that we can demonstrate your choices were freely given and informed, so that we know which version of our disclosures applied at the time, and so that we know to ask you again if the purpose of a permission changes.
Consent records are retained. Withdrawing a permission does not delete the record that you previously granted it, because the record is the evidence that the earlier collection was authorised.
11. Retention
Most work records in Bob are kept for a period chosen by the organisation whose account you work under, because they are the ones subject to the record keeping obligations the records exist to satisfy. We apply their setting and do not delete their records early without instruction.
| Information | Kept for |
|---|---|
| Account details | While your organisation's subscription is active. Deleted within 30 days of a request. |
| Evidence photos and job records | The period configured by your organisation |
| Check in and attendance records | The same period as evidence photos, configured by your organisation |
| Dictated text | With the record it belongs to |
| Consent records | Retained |
Deletion requests. You or your organisation can ask us to delete an account and its associated records at any time. We action deletion requests within 30 days. Where a record is subject to your organisation's retention setting or to a legal obligation, we will tell you what we cannot delete and why.
If a subscription ends. Where an organisation's subscription lapses, we handle its data as set out in that organisation's agreement with us.
12. Who we share information with
- Your employer or the site operator, where you use Bob under their account.
- Our subprocessors, being Amazon Web Services, Fly.io, Microsoft Azure and Auth0, listed in full in section 13. Each is bound by contract to use the information only to provide their service to us.
- Regulators, insurers or courts, where we are required or authorised by law to disclose.
We do not sell personal information, and we do not disclose it for advertising or marketing by third parties.
13. Subprocessors
We use a small number of third party providers to run the platform. Each acts as our subprocessor: it processes information only to provide its service to us, under contract, and may not use it for its own purposes.
| Subprocessor | Purpose | Data hosting |
|---|---|---|
| Amazon Web Services | API and backend infrastructure | Australia |
| Fly.io | API and backend infrastructure | Australia |
| Microsoft Azure | AI inference for optional AI features | Australia, stateless inference across availability zones |
| Auth0 | Authentication for web identities only | Australia |
We keep this list current and will update it when our providers change, as set out in section 19.
14. Overseas disclosure
Some of the subprocessors listed in section 13 operate outside Australia. Where personal information is disclosed to them, we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles.
15. Security
We use encryption in transit and at rest, access controls limiting staff access to a need to know basis, and logging of administrative access and adhere to industry best practises for security.
16. Changing or withdrawing consent
You can change any permission at any time:
- in your device settings, under the operating system's app permission controls
Withdrawal takes effect immediately for future collection. It does not undo collection that already happened. If you withdraw a permission that a compliance obligation depends on, such as site check in verification, your employer may require an alternative process.
17. Access, correction and complaints
You can ask for a copy of the personal information we hold about you, or ask us to correct it, by contacting us at hello@getbob.au. We will respond within 30 days. Where the information belongs to your employer's account, we will pass the request to them and let you know.
18. Age
Bob is for people aged 18 and over. When you create an account you confirm that you are at least 18, and that confirmation is kept as part of the consent record described in section 10.
We do not knowingly collect personal information from anyone under 18. If we become aware that we have, we will delete it.
19. Changes to this policy
We will update this page when our practices change. If a change affects what a permission is used for, we will ask for your consent again in the app rather than relying on the consent you gave previously. The version number and date at the top of this page indicate the current version, and previous versions are available on request.
20. Licence to use Bob
Bob is a platform built and owned by Subrosa Software Pty Ltd. Your access is granted by way of a limited, non-exclusive, non-transferable, revocable licence to access and use the platform for your ordinary business purposes.
That licence confers a right of access and use only. It gives you no ownership, title or other proprietary interest in the platform or any of its features or components, and it is conditional on you or your organisation maintaining an active subscription. When the subscription ends, the licence ends.
21. Intellectual property
All intellectual property rights in the platform and in every part of it, including copyright, whether existing now or created in the future, are owned exclusively by Subrosa Software Pty Ltd and vest in us immediately on creation without the need for any other act or instrument. This includes but is not limited to the software, source code, interface, design, text, graphics, documentation, and any improvement, modification or derivative work, including anything created in response to your feedback or suggestions.
You must not copy, modify, reverse engineer, decompile, resell, sublicence or create derivative works from any component of the platform.
22. Your content
Section 21 does not apply to your content. As between you and us, you or your organisation retain all rights in the information you put into Bob, including evidence photos, notes, dictated text, form entries and check in records.
You grant us a licence to host, store, transmit and process that content only so far as is needed to provide the platform to you, to keep it secure, and to meet our legal obligations.
23. Liability
Your rights that cannot be excluded. Nothing in this document excludes, restricts or modifies any guarantee, right or remedy you have under the Australian Consumer Law or any other law where doing so would be unlawful. If the Australian Consumer Law applies to your acquisition of Bob, you have guarantees that cannot be contracted out of, and the rest of this section applies only to the extent it does not conflict with them.
Where liability can be limited. Where we are liable for failing to comply with a consumer guarantee in respect of services, and the law permits us to limit that liability, our liability is limited at our election to resupplying the services or paying the cost of having them resupplied.
Otherwise. Subject to the two paragraphs above, and to the maximum extent permitted by law:
- the platform is provided as is, and we exclude all terms, warranties and conditions that would otherwise be implied
- Subrosa Software Pty Ltd, including its affiliates, officers, or employees are not liable for any damages of any kind or any indirect, consequential, special or incidental loss or damage, or for loss of profit, revenue, data, goodwill, anticipated savings or business interruption, however arising
- our total aggregate liability for all damages or claims connected with the platform, whether in contract, tort (including negligence), statute or otherwise, is nil
Your responsibility. We are not liable to the extent that loss is caused by your own act or omission, by use of the platform contrary to this document or our instructions, by inaccurate information entered into it, or by reliance on AI generated output that has not been reviewed by a person.
Records. Bob is a tool for recording information. It does not relieve you or your organisation of any work health and safety, record keeping or other legal obligation, and you remain responsible for meeting those obligations.
24. Governing law
This document is governed by the laws of the State of Victoria, Australia. You and we submit to the exclusive jurisdiction of the courts of Victoria and the courts able to hear appeals from them.
25. Severance
If any provision is found by a court of competent jurisdiction to be invalid, unenforceable or illegal, that provision is read down to the extent necessary to make it valid, or severed if it cannot be read down. The remaining provisions continue in full force as if the severed provision had never been included.
26. Contact
Subrosa Software Pty Ltd
ABN 38 679 396 028
hello@getbob.au
https://getbob.au/app-privacy
© Subrosa Software Pty Ltd. All rights reserved.