Privacy Policy

Overview

BarRosta is a staff rostering web application for hospitality venues, built around data minimisation: it is designed to run on the least personal information a roster can run on. This policy covers the BarRosta website at barrosta.com and the interactive demo at barrosta.com/demo.

What BarRosta never collects

By design, BarRosta does not collect, store, or provide fields for:

• Staff photographs
• Reasons for leave or unavailability
• GPS or location data
• Bank details, tax file numbers, or superannuation details
• Pay rates or wages
• Dates of birth, home addresses, or government identity documents

The website

The BarRosta website sets no cookies and uses no analytics, tracking pixels, or advertising technology. Our hosting provider (Vercel) keeps standard, short-lived server request logs (such as IP address and requested page) for operational and security purposes, as any web host does.

The demo

The demo at barrosta.com/demo runs entirely in your browser. Anything you enter in the demo is stored in your browser's local storage on your own device and is never transmitted to us or anyone else. The demo is seeded with fictional venues and staff. Clearing your browser data removes it completely.

When you contact us

If you email us to register interest or ask a question, we receive your email address and whatever you choose to tell us. We use it to respond to you and, if you register a site, to set up your service. We do not add you to marketing lists or share your details with anyone.

Hosted accounts

BarRosta is live and server-backed. The following describes what is collected when you use a hosted BarRosta account.

Where your data lives: Australia. Our database and hosting run on Supabase (Sydney region); our server functions run on Vercel (Sydney region). We do not store your data outside Australia.

What we collect:

• Staff: name, email address (if provided), shifts assigned, availability responses, and actual start/finish times recorded by the manager.
• Owners and managers: account email, organisation and venue names, and subscription status.
• Payments: handled by Stripe. Card details are entered directly with Stripe and never pass through or get stored on BarRosta's servers.
• Email delivery: invitations and roster emails are sent via Resend.

How your data is protected: Data is encrypted in transit (HTTPS/TLS) and at rest by our hosting provider. Access is enforced at the database level — staff can see only their own records; a manager can see only the venues they are granted; the owner sees only their own organisation.

How long we keep it: While your account is active. After termination, your account becomes read/export-only for 45 days — you can access and export all your data during this window — then it is permanently deleted, subject to any legal retention obligation. Our own billing/transaction records are kept for the period required by Australian tax law.

Sub-processors: Supabase (hosting/database, Australia) · Vercel (server functions, Australia) · Stripe (payments) · Resend (email).

Australian Privacy Principles

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You may request access to, correction of, or deletion of any personal information we hold about you using the contact below.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "last updated" date above.

Contact

Philip Vieyra, ProductivityByPhil · admin@productivitybyphil.com