Rostrix Privacy Policy

1. Introduction

Rostrix provides software that helps businesses manage rostering, timekeeping, leave, tasks, operations workflows and related workforce activities.

We are designed to handle personal information responsibly and in accordance with applicable privacy obligations, including the Australian Privacy Principles where they apply to us.

2. Who we are

Rostrix is operated by Muhammad Ariful Islam (ABN 94 457 251 150), trading as Rostrix.

Primary privacy and support contact: admin@rostrix.app. Secondary contact: contact@rostrix.app.

3. Scope

This Policy covers personal information processed through the Rostrix website, application and related services.

If your employer uses Rostrix, your employer is typically the organisation that decides what employee information is entered into Rostrix and how Rostrix is configured for its workplace. Rostrix provides the platform and processes that information to deliver the service.

4. Information we collect

The information Rostrix processes depends on how a customer configures and uses the service. Categories may include the information described in the following sections.

5. Business / customer information

• Business name, type and workspace settings
• Branch and location details configured by the customer
• Account owner and administrator contact details
• Subscription and billing-related account identifiers
• Support and contact messages you send to us

6. Employee information

Where an employer uses Rostrix for workforce management, Rostrix may process employee information that the employer (or authorised users) enter or generate in the system.

• Name and contact details (such as email and phone)
• Address and emergency contact details where entered
• Employment and roster-related information
• Attendance / time records and leave information
• Pay rate or salary information where entered by the employer
• Profile photographs where uploaded
• Employee-related documents uploaded by the employer or authorised users
• Location captured at clock-in or clock-out where location-based timekeeping is enabled

Rostrix is not designed to collect tax file numbers (TFNs), bank account details, superannuation details or dates of birth as part of the current product. Do not upload those details into Rostrix fields that are not intended for them.

7. Account information

• Name, email, optional username and authentication credentials (passwords are stored as secure hashes, not in plaintext)
• Membership, role and permission information within an organisation
• Session and active organisation/branch preferences needed to operate the product
• Legal acceptance metadata for Terms and Privacy acknowledgements where collected at registration

8. Information collected through timekeeping

Rostrix may process clock-in and clock-out times, break records, timesheet edits, approvals, device or kiosk identifiers used for premise time clocks, and related audit fields configured by the customer.

Where an employer enables clock-in photo capture, Rostrix may store a photo taken at clock-in for audit purposes.

9. Location / GPS information

Rostrix may capture your location when you clock in or clock out when location-based timekeeping is enabled. Rostrix does not continuously track your location.

Location is requested for the clock action itself (for example to check a workplace geofence). Rostrix does not monitor employee location while the employee is working through continuous or background GPS tracking.

Access to stored clock location information is restricted to authorised users within the relevant organisation according to product permissions.

10. Employee documents

Employers and authorised users may upload documents related to employees or workplace operations (for example leave supporting documents or operational attachments).

Rostrix stores those files to provide the service. Access is restricted to authenticated, authorised users belonging to the relevant Rostrix organisation, subject to role and permission rules.

Documents should not be treated as publicly shareable merely because a link exists. Authorised access controls apply.

11. Profile photographs

Where a profile photo or clock-in audit photo is uploaded, Rostrix stores the image to provide the relevant feature and display it to authorised users in the organisation.

12. Leave and workforce information

Rostrix may process leave requests, leave balances or entries configured by the customer, roster and shift information, task and operations workflow records, and related workplace activity data entered into the product.

13. Pay rate / salary information

Where an employer enters pay rate or salary information, Rostrix stores and displays it only to users authorised under the organisation’s role and permission settings. Rostrix does not process payroll bank transfers or store full card payment credentials for employee wages.

14. Device / browser / technical information

Like most web applications, Rostrix may process technical information needed to operate and secure the service, such as IP address, browser type, device information, timestamps, and diagnostic logs. We aim to avoid placing unnecessary sensitive employee details into logs.

15. Analytics

Rostrix includes first-party product analytics and operational reporting inside the application (for example labour or operations metrics configured for your organisation).

Marketing pages may use a lightweight first-party event stub (for example button click events). Those click names stay in the browser and are not sent to a vendor.

When a Meta Pixel ID is configured, public marketing pages, the sign-in and registration pages, and business setup load Meta’s pixel (Meta Platforms, Inc.) so Facebook and Instagram ads can be measured. The pixel records a page view. After a business workspace is created, the browser and, when a conversions access token is configured, the server each record one registration event (Meta’s standard CompleteRegistration event) with the same event id. That event does not include the person’s name, email address, business name, or account id. The server copy can include the IP address, browser type, and Meta’s existing click cookie so the two copies match. Creating an account or accepting a team invitation does not send that event. A fresh visit to the signed-in application does not load the pixel. Meta’s handling of that data is described on the Subprocessors page.

16. Payment information

Paid subscriptions are processed by Stripe. Rostrix stores Stripe customer and subscription identifiers and billing status metadata needed to manage entitlements.

Rostrix does not store full card numbers, CVV codes or complete payment card credentials. Payment method details are handled by Stripe according to Stripe’s terms and privacy disclosures.

17. How information is collected

• Directly from account holders and users
• From employers and authorised administrators entering workforce information
• Through product features such as rostering, timekeeping, leave, messaging and operations tools
• Automatically through technical and security logs needed to run the service
• From payment providers (Stripe) for subscription status
• From Meta’s pixel on public marketing, sign-in, registration, and business setup pages, when a Meta Pixel ID is configured: a page view, and one registration event after a business workspace is created

18. Why we collect and use information

• To provide, maintain and improve the Rostrix services
• To create and manage accounts, organisations and permissions
• To enable rostering, timekeeping, leave, tasks and related workforce features
• To process subscriptions and billing
• To communicate about the service, support and security
• To protect the service against abuse, fraud and security threats
• To comply with law and enforce our agreements

19. How Rostrix handles customer-provided employee information

When a business customer submits employee information to Rostrix, Rostrix processes that information as needed to provide the configured services to that customer’s organisation.

Rostrix isolates organisation data so that users of one organisation are not intended to access another organisation’s employee records.

20. Customer responsibilities

Businesses using Rostrix remain responsible for the personal information they provide to Rostrix and for ensuring that their collection, use and disclosure of employee information is lawful and appropriately notified to employees under applicable workplace and privacy requirements.

Customers are also responsible for configuring Rostrix appropriately, managing user access, and using features such as location-based timekeeping in a manner consistent with their legal obligations.

21. Disclosure of information

Rostrix does not sell personal information.

We may disclose personal information to service providers who help us operate the platform (for example hosting, storage, email and payment processing), to other authorised users within the relevant customer organisation, where required by law, or to protect rights, safety and security.

We do not claim that information is never disclosed. Disclosures are limited to what is reasonably necessary for the purposes described in this Policy.

22. Service providers

Rostrix uses selected providers to host infrastructure, store files, send transactional email and process payments. See the Rostrix Subprocessors & Service Providers page for the current list.

23. Overseas disclosures

Some service providers may process data in locations outside Australia depending on their infrastructure and configuration. Where exact processing locations are not fixed in Rostrix configuration, we describe providers at a high level rather than inventing specific data-centre claims.

By using Rostrix, customers acknowledge that service-provider processing may involve overseas disclosures as part of operating a modern cloud software service.

24. Data storage

Rostrix stores application data in PostgreSQL databases and related application storage operated on our hosting infrastructure, and stores certain files (such as documents and images) using Cloudflare R2 object storage.

We do not claim a specific exclusive Australian data-residency guarantee unless separately confirmed in writing for a particular arrangement.

25. Data security

Rostrix uses security measures appropriate to a SaaS product of this type, including encrypted connections (HTTPS), authentication, role-based access controls, organisation-level data isolation, private handling of stored documents through authorised access pathways, and monitoring for operational issues.

No method of transmission or storage is completely secure. See the Rostrix Security page for a plain-English summary of controls.

26. Access and correction

Account holders can update many profile and organisation settings directly in Rostrix.

Employees should generally contact their employer first about information their employer controls in Rostrix.

You may also contact admin@rostrix.app to request privacy assistance. We may need to verify identity and, for employee records, coordinate with the relevant customer organisation.

27. Data retention

Rostrix retains information for as long as reasonably necessary to provide the services, operate the business, maintain security, resolve disputes, enforce agreements and meet legal or regulatory obligations.

Clock-in and clock-out audit photos (when enabled by the employer) are automatically deleted after 90 days. Timesheet times and other attendance records are retained separately under the organisation’s normal retention practices.

Automated retention schedules may evolve over time. This Policy does not promise a fixed deletion period for every data category unless a specific process has been implemented and communicated.

28. Account deletion

Customers may request organisation closure or deletion through Rostrix settings workflows or by contacting support. Some deletion steps may be processed manually to avoid unsafe or incomplete destruction of production data.

Residual copies may remain for a period in backups, logs or records retained for security, dispute or legal reasons.

29. Data breach response

If Rostrix becomes aware of a data breach that is likely to cause serious harm, we will assess the incident and take steps consistent with applicable obligations, which may include containment, investigation, remediation and notification where required.

30. Privacy complaints

1. Contact Rostrix at admin@rostrix.app and describe your concern with enough detail for us to investigate.

2. Rostrix will review the complaint and respond appropriately.

3. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) where applicable.

We do not publish a guaranteed response timeframe in this Policy unless Rostrix has formally adopted one.

31. Contact information

Privacy and support: admin@rostrix.app

General contact: contact@rostrix.app

Web: https://www.rostrix.app/contact

32. Google Workspace data

Rostrix uses the Google Calendar API on the Rostrix organiser account when someone books a demo. The visitor does not sign in with Google. Rostrix does not use the Google Photos API. Rostrix does not create aggregated or anonymized datasets from Google user data.

Data access. The raw Google user data Rostrix receives is limited to free/busy start and end times on the organiser calendar, and, after Rostrix creates a demo event, that event’s id, calendar link, and Google Meet link. Free/busy results do not include titles, descriptions, or attendee lists from existing events.

Data use. Free/busy times are used only to show which demo slots are still open. The event id, calendar link, and Meet link are used to confirm the booking, email the person who booked, and let authorised Rostrix staff open, reschedule, or cancel that demo. Rostrix does not sell this data, use it for advertising, or use it to train models.

Data transfer. Rostrix stores the demo request, including the Meet link and calendar link, in its application database. Rostrix emails the Meet link to the address the person entered when they booked. Authorised Rostrix staff can see the demo request. The calendar event remains in the organiser’s Google Calendar. Rostrix does not transfer Google Calendar or Meet data to OpenAI, advertisers, or any other service to create, train, or improve machine-learning or artificial-intelligence models. Hosting and email providers that operate Rostrix process this data only to run the service. The current list is on the Subprocessors page.

Data protection. Calls to Google use encrypted connections (HTTPS). The organiser OAuth credential is held in server configuration and is not placed in the visitor’s browser. Demo records are shown to signed-in Rostrix staff who are allowed to manage demo requests. Section 25 describes the other controls used for Rostrix data, including authentication and role-based access.

Data retention and deletion. Free/busy responses are used for that slot check and are not stored as a copy of the calendar. Rostrix keeps the demo request, including the Meet link and calendar link, while that demo request record is kept. If Rostrix cancels the demo, Rostrix deletes the Google Calendar event. The demo request in Rostrix is then marked cancelled and may still show the previous link. To ask for deletion of a demo request, email admin@rostrix.app. Residual copies may remain for a period in backups, logs, or records kept for security, dispute, or legal reasons, as described in section 28.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

33. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The version number and last updated date appear at the top of this page. Material changes will be reflected here, and where appropriate we may also notify account holders through the product or email.