Privacy Policy

Last updated: 16 May 2026

This Privacy Policy describes how Umall Pty Ltd (ABN 19 607 555 331) ("we", "us", "our") collects, uses, and discloses personal information when you use Roster Pro (roster.easyworks.app). We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Information We Collect

Account information: your email address, shop/business name, and hashed password (or Google OAuth identifier if you sign in with Google).
Roster and payroll data: staff names, scheduled shifts, hours worked, pay rates, and sales figures that you enter into the service.
Billing information: your Stripe customer ID and subscription status. We do not store credit card numbers — payments are processed by Stripe.
Usage data: your IP address (used for rate limiting and fraud prevention) and browser user-agent.
OCR content: images you upload for roster recognition are sent to Google Gemini for processing and are not retained by us after processing.

2. How We Use Your Information

To provide, operate, and improve the Roster Pro service.
To process payments and manage your subscription via Stripe.
To send transactional emails (welcome, password reset, trial reminders, payment failure notices).
To prevent fraud, abuse, and unauthorised access.
To comply with legal obligations.

3. Disclosure to Third Parties

We disclose personal information to the following third-party service providers only to the extent necessary to operate the service:

Stripe (stripe.com) — payment processing and subscription management.
Resend (resend.com) — transactional email delivery.
Upstash (upstash.com) — cloud database (Redis) for storing your account and roster data.
Vercel (vercel.com) — hosting and serverless function execution.
Google (google.com) — OAuth login (if you choose "Sign in with Google") and Gemini OCR image processing.

We do not sell your personal information to third parties.

4. Cross-Border Disclosure

Our service providers (Stripe, Resend, Upstash, Vercel, Google) are based primarily in the United States. By using Roster Pro, you consent to your personal information being processed and stored outside Australia. We take reasonable steps to ensure these providers maintain privacy standards consistent with the APPs.

5. Data Retention

Account and roster data: retained while your account is active, plus 90 days after account deletion.
Password reset tokens: automatically deleted after 1 hour.
Stripe webhook idempotency keys: retained for 24 hours.
Rate-limiting records: retained for up to 1 hour.

6. Cookies and Session Storage

Roster Pro stores your authentication token in your browser's sessionStorage. This is cleared when you close your browser tab. We do not use persistent cookies or third-party tracking cookies.

7. Security

We use industry-standard security measures including HTTPS, HMAC-signed tokens, bcrypt password hashing, and timing-safe secret comparison. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Children

Roster Pro is not directed at persons under 18 years of age. We do not knowingly collect personal information from children.

9. Your Rights

Under the APPs, you have the right to:

Access the personal information we hold about you (use the "Export My Data" feature in Settings).
Request correction of inaccurate information.
Request deletion of your account and data (use "Delete Account" in Settings).
Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10. Contact Us

For privacy enquiries or to exercise your rights, contact us at:

Email: support@easyworks.app

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "last updated" date. Continued use of the service after changes constitutes acceptance of the updated policy.