Draft for review. Have a lawyer check this before you launch, and fill in your details in config.js.

Privacy policy

The company ("we") runs the service. This explains what we collect and why.

What we collect

• Account details: name, email and a password (stored hashed by our authentication provider).
• Business and roster data: business name, staff names and contact details you add, shifts, leave requests, availability and notes.
• Time and location: when staff clock on, take breaks and clock off, and the phone's location at those moments with its reported accuracy. The apps ask for location only when someone clocks on or off or starts or ends a break. We do not track location in the background.
• Documents: files staff attach to leave requests, such as medical certificates. Only that person and their managers can see them.
• Billing: your subscription and invoices are handled by Stripe. We do not see or store full card numbers.
• Messages: chats between a staff member and their managers, and notices a manager sends to staff. Managers of the business can read every chat with their staff, and managers can delete messages. Staff cannot message each other.
• Notifications: a device token so we can send shift and leave notifications.

Why we use it

To provide the service: show rosters and hours, enforce the clock rules your business sets, build attendance reports, send notifications and emails you ask for, and bill your subscription.

Who sees it

Managers in a business see its staff's records. Staff see their own. We use service providers to run the service: Supabase (database and hosting), Stripe (payments), Resend (email), and Expo and Google or Apple (push notifications). They process data for us under their own terms. We do not sell personal information.

Staff

If you are an employee, your employer decides what is recorded and is responsible for telling you. Ask your employer about their use of your data.

Where data is kept and how long

Data is stored with our hosting provider. We keep it while the account is active, and delete a business's data on request, subject to legal record-keeping needs.

Deleting your account

You can delete your account in the app (Account, then "Delete my account"). Your login, contact details, messages, uploaded documents and notification settings are removed. If you are staff, your employer keeps your name and recorded hours and leave without a login, because employers must keep pay records. If you are the only manager, you can delete the whole business and its data, and any subscription is cancelled.

Your rights

You can ask to access or correct your personal information, or make a complaint, by contacting support. In Australia you can also contact the Office of the Australian Information Commissioner.