Privacy Policy

KDR Leave is an internal system run by KDR Technology Solutions for its own staff and contractors. It records when people will be away from work. This page says what it holds about you, who else sees it, where it lives, and how to get a copy or have it removed.

Nobody can sign themselves up: accounts are created by an administrator for people working with KDR. If you have an account here, it is because somebody at KDR made you one.

What is collected

Your account. An email address, which is also how you sign in - there is no password anywhere in this system, so none is stored. A first name and surname, recorded by the administrator who creates the account; you can correct both yourself under Settings. The date the account was created and the date it was last used.

Your working arrangement. Whether you are permanent or a contractor, and which client you are placed with. An administrator records these and you cannot change them yourself, which is deliberate: they are statements KDR makes about an engagement, not preferences. Whether your account is an administrator, and whether it is currently able to sign in, are recorded the same way.

Your leave. A start date, an end date, the kind of leave where that is collected, and any note you add. Whole days only. This is not an approval system - a record exists because you said you would be away, not because anybody agreed to it.

A count of throttled actions. Some requests are limited to a few a day, so the system counts them per day. Nothing else about them is kept.

An audit trail.Every sign-in and every attempt to sign in, including attempts from addresses with no account; leave added, changed and removed; changes to personal details; exports; deletions; and every action an administrator takes on somebody’s record. Each entry records who acted, whose record it concerned, when, and which fields moved. Administrators can read it; you can download your own part of it - see below.

What is shared

Three suppliers, and no one else. Supabase provides the database and handles sign-in. Vercel serves the application. Resend and the mail provider behind the sign-in link deliver email - to you when you request a link, and to administrators when something needs their attention.

Nothing is sold, nothing is shared for advertising, and there is no analytics or tracking of any kind in this application. Your leave is visible to you and to administrators; who is away and when is visible to everyone with an account, which is the point of the system.

Where it is stored

In a Supabase Postgres database hosted in ap-southeast-2, Sydney - your details and your leave stay in Australia. The application itself is served by Vercel from wherever is closest to you, and email necessarily travels through the mail providers above, which are outside Australia.

How long it is kept

Your account and everything attached to it are kept while the account exists. Deleting an account removes it from the sign-in system, and your leave and the throttling counts go with it automatically.

The audit trail is the exception, and it is worth being clear about. Its entries record your email address alongside the event, so that an entry still means something after an account is gone - which is the whole purpose of keeping a record of who did what. Deleting your account therefore does not erase your address from it. Those addresses are blanked seven years after the entry was recorded, leaving the event itself in place.

Two things follow from that. The seven years run from when the entry was written, not from when you leave. And disabling an account is not deleting it - an account that has been switched off still exists, so nothing about it is removed or blanked. When somebody leaves KDR, switching their account off is usually what happens.

Getting a copy, and getting it removed

Both are self-service, under Settings. Download my data gives you a JSON file containing your account details, your leave, the throttling counts and your own entries in the audit trail - including entries recording what an administrator did to your record, and which administrator did it.

Delete my account removes it immediately and permanently, subject to the audit trail above. It cannot be undone, so take the export first if you want one.

You can correct your own name under Settings at any time. Your email address can only be changed by an administrator, because it is what signs you in - you can ask from the same screen, and the request and the change are both recorded.

Cookies

The only cookies set are the Supabase session cookies that keep you signed in. There are no advertising or analytics cookies, because there is no advertising and no analytics.

Contact and complaints

Questions about any of the above, or a request to access or correct something you cannot change yourself: admin@kdrtech.com. This policy is written for the Privacy Act 1988 (Cth) and the Australian Privacy Principles; if you are not satisfied with how a request is handled, the Office of the Australian Information Commissioner takes complaints.

Last updated 10 August 2026. See also the Terms of Service.