Privacy policy

1. What we hold

• Your login: name, email address and an encrypted password. If you set up an authenticator app, a secret that lets it make codes.
• Your staff record (entered by your employer or by you): name, preferred name, pronouns, date of birth, email, phone, emergency contact, employment type, start and end dates, whether you’re a school student, any limits on your working hours, the areas you work in, qualifications and notes your manager keeps.
• Availability and leave: when you can and can’t work, leave requests and their notes.
• Rosters: your shifts, and changes to them.
• An activity log of changes (for example who published a roster or changed a role), kept so employers can check what happened.
• Technical information: your IP address while you use the app, to stop password-guessing (stored only as a scrambled code, for up to two days), and error reports with personal details removed.

We use one cookie, to keep you logged in. There are no advertising or tracking cookies.Taveroo doesn’t calculate pay, so it holds no pay rates or bank details.

If your employer turns on a feature that needs more information (such as a time clock), we’ll update this policy before it’s used.

2. Why we hold it

To run Taveroo for your employer: building and sharing rosters, showing you your shifts, handling availability and leave, keeping accounts secure, and giving support. We don’t sell personal information or use it for advertising.

3. Who can see it

• At your workplace: what each person sees depends on their role. Staff see names on the roster, not each other’s private details. Owners and managers see staff records. Only owners see the full activity log.
• Us: only when needed to support your employer or keep the service running, and never to change your records.
• Service providers who help us run Taveroo, under contracts that protect the information (see section 4).

We only share it with anyone else when the law requires it.

4. Where it’s stored, and overseas providers

Taveroo’s database is hosted in Sydney, Australia. Some providers are based overseas:

• Supabase (database and logins): data stored in Sydney, Australia.
• Vercel (hosting): the app runs in Sydney; some request records may be processed in the United States.
• Sentry (error reports), United States: names, emails and phone numbers are removed before reports are sent.
• Anthropic (AI helpers), United States: only if your employer turns AI helpers on, and only the words typed into an availability or roster-instructions box. Never dates of birth, pay, contact details or notes. The AI only suggests; a person always checks and confirms.
• Resend (email), United States: onceTaveroo sends emails, your name and email address to deliver them.

5. Google Calendar (optional)

If you choose to connect your Google account, Taveroo uses Google’s Calendar API to add your published shifts to a calendar you pick: either a separate “<shop name> shifts” calendar that Taveroo creates, or your main calendar. Only the shift times, area and shop location are added. We never add pay, notes or other people’s names. You can change this or disconnect at any time on the Me page. Disconnecting removes the shifts Taveroo added (or the calendar it created) and deletes the saved access tokens.

What we access:

• Your Google account email and ID, so you can see which account is connected.
• Your shift calendar. If Taveroo creates the calendar, Google lets it manage only that calendar and its events. If you chose your main calendar, Google’s permission covers seeing, adding, changing and deleting events on calendars you own; Taveroo only ever adds, changes or removes the shift events it added. It never reads your other events, contacts or files.

How we store it:

• The access and refresh tokens Google gives us are encrypted at rest (AES-256-GCM) in our Sydney database. Only our servers use them, to add, update or remove your shift events. They are deleted when you disconnect.
• We don’t sell or share Google user data, use it for advertising, use it to train AI or machine learning models, or send it to an AI service, and nobody reads it. The only exceptions are as needed to provide the calendar sync, with your consent, for security, or as required by law.

Taveroo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can also remove Taveroo’s access from your Google Account at myaccount.google.com/permissions.

6. Keeping it safe

Information is encrypted on its way to and from the app. Each business’s data is kept separate by the database itself. Anyone can protect their login with an authenticator app, and a business can require it for its owners. Giving someone control of a business always needs one. Attempts to guess passwords are limited, sensitive changes are logged, and the database is backed up daily.

7. How long we keep it

While your employer uses Taveroo. When someone leaves, their record is archived, not deleted, because employers must keep employment records (usually for 7 years). When an employer stops using Taveroo, they can download all their data; we then delete it as agreed with them, unless the law requires us to keep it.

8. Seeing and correcting your information

You can update your contact details and emergency contact in the app, under Your details. For anything else, ask your employer: they control your record. You can also contact us, and we’ll help or pass your request to your employer.

9. Questions and complaints

Email [privacy contact email] or write to [postal address]. We’ll reply within 30 days. If you’re not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

10. Changes to this policy

We’ll update this page when things change, and tell employers about important changes before they apply. See also our terms.