PRIVACY
What the board holds about you.
A job board holds two things: an account that lets you sign in, and a profile describing the work you want. This page says what is in each, who sees it, and how to remove it.
Who runs the board
Fractional Works runs this board from Newcastle, New South Wales, Australia, and is registered under ABN 35 910 404 693. There is no postal address: write to hello@fractionalworks.com.au about anything on this page, and a person reads it.
What an account holds
An account lets you sign in as an applicant or an advertiser. It holds:
- your email address, which is how you sign in;
- a password stored as an Argon2id hash — the password itself is never stored;
- a time-based one-time password secret, the second factor at sign-in;
- whether the email address has been verified;
- a count of failed sign-ins, and the time a lockout ends;
- when you last signed in, and when the account was created and changed;
- your role on the board: applicant or advertiser.
Verification and reset tokens are stored hashed, with an expiry, alongside a hashed IP.
What a profile holds
An applicant profile holds your name, a headline, a summary, your day rate, how many days a week you are available, whether you will work remotely, your location, your skills and any links you add. A profile is either hidden or discoverable.
By design it holds no email address, no phone number and no postal address, and no field on an advertiser's view could hold one. Contact happens through an application, not a profile.
Who sees a profile
- You, in your portal.
- An advertiser you applied to, and only that one, for the role you applied for. Applying is what shows your profile; an advertiser cannot browse profiles.
- Nobody else. A profile is not indexed, not listed and not passed on.
Discoverability is a separate choice from applying. A discoverable profile may be matched against new roles and is needed to apply; a hidden one is neither matched nor able to apply. Both are changed in your portal, by you.
Adverts and applications
An advert holds the role's title, summary, work description, day rate, days a week, location and whether it is remote. An advert is public; that is the point of it.
An application holds the advert's number, your cover note and its state — submitted, shortlisted or rejected — and both sides see that state in their portal. It is the only channel through which an advertiser sees anything about you.
The audit log
Every sign-in and every administrative action is written to an append-only log: what happened, when, and against which account, with a hashed IP. Raw IP addresses are never written.
Cookies and sessions
Signing in sets a session cookie: __Secure-sk-sess-fractional for the operator area, and one of the same shape for the applicant and advertiser portals. Each is Secure, HttpOnly and SameSite=Strict, so script cannot read it and a cross-site request does not carry it. Each is strictly necessary: without it you would be signed out on every page.
There is no analytics cookie, no advertising cookie, no preference cookie and nothing set by another company. Nothing here tracks you across other sites, so nothing here needs a consent banner.
Why it is held, and what allows it
- To run your account and show you your own applications.
- To carry an application to the advertiser you chose, which is the board's whole function.
- To keep the board secure: failed-login counts, lockouts and hashed IPs exist for that.
- To match a discoverable profile against new roles, which you can switch off at any time.
Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, this information is collected directly from you for a purpose the board states when you create the account (APP 3 and APP 5), used for that purpose (APP 6), and held only as long as it is needed (APP 11).
For a person in the European Union or the United Kingdom, the GDPR bases are: performance of a contract with you (Article 6(1)(b)) for the account, the profile and the application; and legitimate interest in keeping the board secure and free of abuse (Article 6(1)(f)). Matching a discoverable profile runs on your consent, given by making it discoverable and withdrawn by hiding it.
Who else sees it
Four suppliers are involved in running the board. Each sees a narrow slice:
- DreamHost hosts the site on a virtual private server. It stores the database, so accounts, profiles and applications sit on its disk.
- Cloudflare is the authoritative DNS provider for the domain. It answers the lookup that turns the name into that address; the records are DNS-only, not proxied, so requests to the board do not pass through it.
- Let's Encrypt issues the TLS certificate. It sees the domain name, which is published in a public transparency log, and nothing about any person.
- Purelymail provides the mailbox at hello@fractionalworks.com.au. Verification mail, password resets and correspondence pass through it.
Nobody else. We do not sell information, share it as a list, or pass a profile to a recruiter or data broker. A supplier may disclose it if compelled by law; where we may say so, we would tell you.
How long it is kept
- While your account is open, the account and the profile are kept; the board cannot work without them.
- It is deleted when you ask for the account to be closed, or when it is no longer needed for that purpose.
- An application and its state are kept while the account is open, so both sides can see its history.
- The audit log is kept as a record of access while the account it records is open.
- There is no separate archive of deleted content. Closing an account removes the rows; backups are rotated, so a copy leaves them as they rotate.
Your rights
Most of it you can correct yourself: the profile and the applications are in your portal, where you can edit, hide or close them. You can also ask for a copy of what we hold, for correction, or for deletion. Write to hello@fractionalworks.com.au and say which. We answer within 30 days, and may ask one question to confirm the request is yours — writing from the address on the account settles it.
Deletion is real: the rows are removed from the database and the message from the mailbox. It does not reach into a backup already written: backups are rotated, so a deleted record leaves them as they rotate.
If you are in the EU or the UK you may also restrict processing, object to it, and receive your information in a portable form. The same mailbox handles those, and you may complain to a supervisory authority in your country at any time.
In Australia, if you think we have breached the Australian Privacy Principles, write to us first. If the answer is not good enough you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.
Security
Passwords are Argon2id hashes, never text. Sign-in needs a second factor from a time-based one-time password app. Verification and reset tokens are stored hashed and expire. IP addresses are stored only as keyed hashes. Traffic is encrypted with TLS. Server and database access is limited to the people who run the board.
No system is perfect. If something goes wrong and your information is affected, we will tell you, and the OAIC where the Notifiable Data Breaches scheme requires it.
No automated decisions
Nothing on this board decides anything about you. The one automated step is a match: when an advertiser posts a role, a discoverable profile that fits the days, the location and the skills may be shown to them. That step does not score or rank you, does not reject anyone, and produces no legal or similarly significant effect.
Everything that matters is done by a person: you decide whether to apply, an advertiser decides whether to shortlist. The board carries the message; it does not judge.
Changes to this policy
If what the board holds changes, so does this page, and the date below. A material change is described rather than made quietly.
Last updated 13 November 2026.