Wellrun information

Privacy policy

This is the privacy policy for Wellrun, the records product operated by ETP Consulting Pty Ltd under the business name Well Run Australia. It says what personal information Wellrun collects and holds, where it is kept, who can reach it, how long it stays, and what to do if you want access to it, a correction, or a complaint dealt with.

We handle personal information under the Australian Privacy Principles in the Privacy Act 1988 (Cth), and this page is written to carry what Australian Privacy Principle 1.4 requires a privacy policy to contain. We do that because of what this product holds, not because of how big we are.

The short version. Your records are held in Sydney. The public pages of this website use Google Analytics to count visits; the product itself, the sign-in page and everything behind it do not load analytics, advertising or tracking of any kind. Nothing is sent to an AI model. Nothing is sold or shared for anyone's benefit. Four things go overseas: your email address and the emails we send you, which our email provider delivers; the internet address your browser connects from, which our host records; your payment details, which Stripe handles when you pay for a plan or a pack; and, on the public pages, a record of the visit, which Google Analytics holds. If you turn on text alerts for yourself, your mobile number and those texts go to our text provider, which may handle them overseas. We do not open your records to run the service, and the product's own administration console has no route to them.

Who we are, and how to reach us

Wellrun is operated by ETP Consulting Pty Ltd as trustee for the ETP Investments Trust, trading as Well Run Australia. The full identifiers are at the foot of this page.

Privacy, access, correction and complaints: privacy@wellrun.com.au
Anything else: hello@wellrun.com.au
Something in the product you cannot use: accessibility@wellrun.com.au

There is no shopfront and no public office. Wellrun is run from Redlands in Queensland, and a postal address is available on request. If you need this policy in another format, ask and we will send it, at no charge.

What we collect about you

Your email address. It is the only thing you have to give us to sign in, because there is no password in this product. You ask for a link and we email you one.
Two-step verification. If you turn it on, your account is linked to an authenticator app on your phone. If you turn it off, the link to that app and your unused recovery codes are deleted. We hold the shared secret that app uses to make its codes, never your phone number, and never a copy of the codes. The ten recovery codes we show you once are kept only as one-way hashes, so we cannot read them back, and we record when one is used and when support resets your second step or your email address, with the reason.
What you put into your workspace: the business name and everything you record about how the business runs, across the twelve sections.
Links you keep instead of files. If you keep a link to a document that lives in Google Drive, OneDrive, Dropbox or anywhere else, Wellrun stores the address you pasted and the name of the website it points to. It stores the address only. It never opens, fetches, copies or previews what is behind the link, so the document itself stays where it is and under that service's own terms, and opening the link takes your own browser there.
Your display preferences and where you got to in setting the workspace up.
Your own alert choices: whether you want an email when a date reaches 60, 30 and 7 days away, and, only if you turn text alerts on, your mobile number and the time you ticked that you agree to be texted. Only you can read or change these. Turning texts off clears that consent; clearing the number deletes it.
A record of access and documents: when an account signed in, which seat it holds, when a seat was granted, changed or ended, and when a document was added, with the date and the time of each.
Your acceptance of the Wellrun Customer Agreement: which version, the words beside the box you ticked, the business it was for, the signed-in account that ticked it, the sign-in it came from, and when. Never your internet address and never your device.
Anything you write to us, and our answer.

There is no enquiry form anywhere on this site. The contact page carries three email addresses instead, which is a smaller promise that we can actually keep.

What you put into Wellrun about other people

This is the part most privacy pages leave out, and for this product it is the part that matters most. Wellrun is a place to keep a business's records, so a great deal of what goes into it is about people who are not you: employees with their start dates, roles and tickets; contractors and their insurances; landlords, agents and recovery contacts; licence holders; and the people named in your own procedures.

The People section is built to hold employee records: who works here, their roles, licences and training certificates. Tax file number declarations, superannuation choice forms and police checks should not be uploaded yet, and the terms of use ask you not to, because Wellrun is not yet ready to hold them to the standard they need. Some of what is held is sensitive information under the Privacy Act. All of it does real harm if it reaches the wrong person, including where the person concerned is under 18, such as an apprentice.

What that means for you. Those records are yours and so is the responsibility for them. You decide what goes in, who gets a seat, and what that seat can see. You are also the one who has to tell your own people what you keep about them and why. Wellrun holds it for you. It does not relieve you of that.

What it means for us. We do not read it, mine it, train on it, sell it or disclose it. The database decides who may see a row, not the screen, so a seat that has not been given a group of sections cannot read those sections by any route. A Wellrun administrator can see how many records exist and who has access to what. A Wellrun administrator cannot open a record. That is structural rather than a promise: the operations console has no path that names a customer's tables, and the list of closed tables is derived from the database itself, so a table added tomorrow is closed on the day it is added.

We will not overstate that. Like every hosted database, ours can be reached at the level underneath the product by the people who run it, which means us and our database provider. We use that access to keep the service running and to fix faults, never to read what is in a workspace.

If your details are in somebody else's Wellrun workspace and you want to know what is held, or want it corrected, ask that business, because the records are theirs. If you cannot get an answer, write to us and we will tell you who holds it and help you reach them.

When you share a sale pack

Wellrun itself passes nothing to any broker. Once a sale pack is issued, the owner or an administrator can choose to share it with one person they name: a broker, an accountant, a buyer's adviser, a buyer or someone else. Sharing is never a default and never a condition of a plan, a discount or the free seat. Nothing is shared until the box naming that person is ticked.

What we keep about the person you share with: their name, their email address, their firm, what they are to you, the words of the box you ticked and when, how long the link lasts (7, 14 or 30 days), and the date and time each time the link is opened. The share holds no internet address and nothing about their device. The owner and administrators of your business can see all of it.
What they receive: one email, sent by Resend, with a link to the issued pack. The link opens the pack read only, so it can be read and printed and nothing else. It never opens another record, a document, the People register or anything about your staff, and an entry about an employee record says only that it is held.
The activity record: each share, each open and each stop is written to the activity record of your business with the person's firm and what they are to you, but not their name or email address, because that record cannot be edited afterwards.
The link: made of 256 random bits, kept by us only as a one-way hash, and carried in the part of the address a browser never sends to a server. It stops opening at the end of the days you chose, the moment you stop it, if the pack is withdrawn, or if the email could not be sent.

What we collect automatically

Our host records the internet address your browser connects from, the page requested, the time and your browser's user agent, in an ordinary server log, so the site can be served and abuse can be spotted.
The sign-in service counts link requests per address and across the whole service, so nobody can make this product email a stranger thirty times.
Errors and refusals are recorded, so we can tell a fault from an attack.

On the public pages only (the home page, What you get, the demo, the contact page, the guides and these legal pages), Google Analytics records the pages you view, the site that sent you, your device and browser type, your approximate location to the level of a city, and the time. Google Analytics does not store your full internet address. We have switched off Google Signals and advertising personalisation, so none of it is used to show you advertisements. It is never loaded on the sign-in page, inside the product, in the operations console or in a shared record room, and it never receives your email address, your workspace or anything you type. The same Google Analytics also records how fast each page loaded and responded, which adds no new information about you.
How you found us. The first time you open a page of this site, your browser keeps a note of the campaign tag in the link you followed, if it had one (the utm_source, utm_medium, utm_campaign and utm_content parts of the address), the name of the website that sent you, and the page you landed on. If you then set up a business, that note is kept with your account so we know which of our posts and advertisements bring people in. It is never the full address you came from, never your internet address and never anything about your device, and it is not shared with anyone.

That is the entire list. There is no advertising pixel, no heat map and no session recorder on this site. The site's content security policy permits scripts only from this domain and from Google's googletagmanager.com, and connections only to our own database and to Google Analytics at google-analytics.com, so any other tracking tag added by mistake would be refused by your browser rather than quietly collecting.

Cookies, and what your browser keeps

Wellrun sets no advertising cookies. The public pages set Google Analytics cookies (named _ga and _ga_ followed by an identifier), which last up to two years and let Google recognise a returning browser rather than a person. You can block them in your browser or with Google's opt-out add-on at tools.google.com/dlpage/gaoptout, and the site works exactly the same without them. The product sets none of these cookies. What the product does keep on your own device, in your browser's local storage, is:

your sign-in session, so you are not asked for a fresh link on every page;
your display preferences and where you got to in setup;
a copy of parts of your own workspace, so a screen paints immediately instead of waiting for the network;
the note of how you found us, described above, until you set up a business.

The People and Premises sections are deliberately left out of that copy, because they are the two that hold other people's details, and a shared or handed-on computer should not show the next person the last person's staff register. Signing out clears all of it. None of it is readable by another website and none of it is sent anywhere except back to us.

Why we collect it

Your email address: to send the link that signs you in, to send you messages about your own account, to send the owner and administrators of a business one email a week with the dates they recorded that come up next (turned off on the Reminders screen), to tell the owner when a free trial is about to end and has ended (with a link to stop those), and to reply when you write to us.
Your workspace content: to hold it, show it to you and to the seats you have granted, and to assemble the documents you ask for, such as a sale pack.
Access and document records: so you can see what changed in your own business and when, and so an argument about when access was given or taken away can be settled. That is a security and accountability purpose, and it is why those records cannot be edited afterwards by you or by us.
Your acceptance of the agreement: so that either of us can show what was agreed, and when. It is kept as it was written, and cannot be edited by you or by us.
Server and rate-limit records: to keep the service running and to stop abuse.

Those purposes, and no others. Nothing in your workspace is used to build a profile of you, to market to anybody, or to improve a product for anyone but you.

Who we disclose it to

Five suppliers for everybody, and a sixth only for a person who turns on text alerts.

Supabase runs the database, the private file storage and the sign-in service. Your records sit in its Sydney region. Supabase is a United States company, so in principle its staff can reach the infrastructure, which is true of every hosted database anywhere and is the reason files are held in a private bucket with no public address rather than an open one.
Netlify serves the website and the small functions behind it, and sees the server log described above. It does not hold your records.
Resend delivers the emails Wellrun sends: your sign-in link, a seat invitation, and the messages about your own account. It receives your email address and the content of the email, and nothing from your workspace beyond what a message itself says. When an owner shares a sale pack, it also receives the address of the person they named and the one email with the link. Resend is a United States company. It sends our mail from its Tokyo region in Japan and keeps its own account records in the United States.
Stripe takes payment for plans and sale packs, as described under Payments below. It receives your business name, email address, billing address and card details, and never a workspace record. Stripe is a United States company.
ClickSend sends the text alerts a person turns on for themselves on the Reminders screen, and nothing else. Only when you turn them on, it receives your mobile number and the text itself: the date you recorded and the name of the record it belongs to, such as a licence or a lease. A ticket held in People is named by the ticket alone, never the person's name. ClickSend Pty Ltd is an Australian company based in Melbourne and part of the Sinch group. It says it stores the content of messages in Australia, on Amazon Web Services, and deletes it after 120 days, and that its monitoring service in North America and other Sinch companies (in Sweden, the United States and the Philippines among others) may also handle it.
Google provides Google Analytics on the public pages of this website only. It receives the visit information described above, and never your email address, your workspace or anything you enter in the product. Google is a United States company and may handle that information in the United States and elsewhere.

There is no advertising platform, no customer relationship system, no mailing list provider and no AI provider, and analytics is not loaded anywhere inside the product. We have never sold or shared personal information for a benefit, and we will not.

We would disclose information if a law or a court required it, and if we were allowed to tell you that it had happened, we would.

If we ever add a supplier who would handle personal information, this page names them before they are switched on, and the same goes for changing the email provider. A policy that lists a service we do not use is as much a defect as one that omits a service we do.

Information that goes overseas

Your records and your uploaded files stay in Australia. Four things leave, and a fifth only if you turn on text alerts:

Your email address, and the emails we send to it, handled by Resend so they can be delivered. Resend sends from Japan and holds its account records in the United States, so your address may be handled in either.
The internet address your browser connects from, which our host records in the United States.
Payment details, which Stripe handles in the United States and elsewhere when you choose a plan or buy a pack.
A record of a visit to the public pages, held by Google Analytics in the United States and elsewhere, as described above.
Only if you turn on text alerts, your mobile number and those texts, which ClickSend holds in Australia and which its monitoring service in North America and other companies in its group, in the United States, Sweden and the Philippines among others, may also handle.

No uploaded file is sent to any of them, and nothing from your workspace beyond what an email or a text you asked for says. Before we use an overseas supplier we check what it publishes about where it holds data and what it does with it, and we remain answerable for what it does with anything we hand it.

Payments

Paid plans and sale packs are paid for through Stripe. When you choose a plan or buy a pack, you are taken to Stripe's own checkout page, and Stripe collects your card details there: Wellrun never sees or stores your card number. Stripe receives your business name, the email address you sign in with, your billing address and, if you give it, your ABN for the tax invoice. It keeps a record of what was charged and when, and sends the tax invoices and receipts. Wellrun keeps only what it needs to know what you have paid for: Stripe's reference for your account and subscription, your plan, how often you pay, the date the current period ends, and the packs you have bought. Stripe is a United States company and handles payment information in the United States and elsewhere. No workspace record is ever sent to Stripe.

Marketing

We do not run a marketing list. Nothing on this site subscribes you to anything and there is no newsletter to get out of.

The messages the product sends are about your own account: a sign-in link, a seat invitation, notices about your plan and payments, and one email a week to the owner and administrators of a business with the dates they recorded that come up next, which is turned off on the Reminders screen. Those are service messages, not marketing, and there is no unsubscribing from a sign-in link. Two messages are treated as commercial: the notice to the owner two days before a free trial ends, and the notice after it has ended. Each says who sent it and why it arrived, and carries an unsubscribe that works in one step, immediately, at no cost. Anything else promotional we ever send will do the same.

Automated decisions

Nothing in Wellrun makes a decision about a person. There is no score, no rating, no eligibility test, and no assessment of whether a business or a person meets an obligation, whether by a rule or by a model. Nothing is sent to an AI model at all, which is set out in full on how we use AI.

One thing does happen on a schedule rather than by hand, and it is about access rather than about a person. An adviser seat is confirmed once a year and suspends itself if nobody uses it for ninety days. The pause is listed on the account owner's Your team screen, and the owner can undo it. We do not regard it as a decision that significantly affects anybody's rights, and if you disagree, write to us and say so.

From 10 December 2026, an Australian privacy policy has to describe computer programs that make, or substantially contribute to, decisions significantly affecting a person's rights or interests. If Wellrun ever contains one, this section will describe it and what it uses before it runs, not after.

How we hold it and protect it

Records and uploaded files are in a database and a private storage bucket in Sydney. Nothing in that bucket has a public address.
Every connection is encrypted in transit. The site refuses plain HTTP and instructs browsers to keep refusing it for two years.
Access is decided by the database, row by row, against the seat you hold and the sections that seat has been given. The interface is not the boundary and is never treated as one.
There is no password to guess, reuse or leak. Signing in is a link, good for one hour, sent to the address that asked for it. Owners and administrators can also confirm sign-in with a six-digit code from an authenticator app. It is optional on every plan, and we strongly recommend it.
Sign-in requests are rate limited, per address and across the whole service.
Anything that changes access is written to an append-only ledger, with the date and the time.
Pages carrying a session, a token or anybody's records are marked never to be cached by a shared cache and never to be archived.

No system is perfect and we are not going to pretend otherwise. What we can tell you is where the boundary is drawn, and that it is drawn in the database rather than in the screen.

How long we keep it

Your records: for as long as your workspace is open. You can change or remove any register entry at any time. An uploaded document is kept, with each version of it, so the record of what was held stays true; the account owner can ask for a document, or the whole account, to be deleted by writing to privacy@wellrun.com.au.
A closed workspace: closing it removes the records and queues the stored files for deletion.
A shared sale pack: the person's name, email address and firm, and the time of each open, for as long as your workspace is open, so you can see who you shared with. They go when the workspace is deleted.
Access and document records: for as long as the account exists, and not editable, because a record of when access changed is worth nothing if the person who changed it can rewrite it. If you close your account and want those removed as well, ask us, and we will tell you what we can remove and what we have to keep.
Server logs: held by our host under its own retention. We do not copy them anywhere else and we do not use them for anything but keeping the service up.
Emails you send us: while the matter is open, and for as long afterwards as we need them to answer a question about it.

Where we no longer need something and no law requires us to keep it, we destroy it or strip it of anything that identifies a person.

Getting access to your information, and correcting it

If you hold an account, most of this is immediate. The workspace is yours: you can read everything in it, and change or remove any register entry, without asking anybody. To have an uploaded document deleted, the account owner writes to us at the address below.

For anything you cannot reach yourself, email privacy@wellrun.com.au, give us the email address the account uses, and say what you are after. We will acknowledge it within five business days and answer within thirty. There is no fee.

We will check you are who you say you are before handing anything over, which for an account holder usually means replying from the address on the account.

If we cannot give you access, or cannot make a correction you have asked for, we will tell you why, in writing, and what you can do next. If we decline a correction, you can ask us to attach a note to the record saying that you disagree with it, and we will.

Complaints

If you think we have mishandled personal information, write to privacy@wellrun.com.au and say so. We will acknowledge it within five business days, tell you who is looking at it, and give you an answer within thirty days.

If you are not satisfied with that answer, you can take the complaint to the Office of the Australian Information Commissioner at oaic.gov.au. You do not need our agreement to do it and it costs you nothing.

If something goes wrong

If we suspect a data breach, one named person assesses it and the clock starts on the day we become aware of it. Australian law allows thirty days at most to finish that assessment, and we treat that as a ceiling rather than a target. Where a breach is likely to cause serious harm, we notify the Office of the Australian Information Commissioner and we notify the people affected: what happened, what information was involved, and what to do about it.

If your workspace is involved you hear from us directly, and you hear what we actually know rather than a reassurance.

Changes to this page

This page is the policy. It is not a summary of one held somewhere else, and there is no longer version waiting to be published. It changes when the product changes, and the date below moves with it. Where a change matters to you, we email account holders rather than relying on anyone to re-read this page. Earlier versions are kept and we will send you one on request.

Last updated 20 October 2026.

Well Run Australia is a registered business name of ETP Consulting Pty Ltd (ACN 601 830 120) as trustee for the ETP Investments Trust (ABN 36 211 950 299).

Return to Wellrun

Privacy · Terms · How we use AI · Accessibility · Contact · Home