Privacy Policy

This policy explains how Crosby Ops collects, uses, stores, and shares personal information. Crosby Ops is a workforce operations platform used by hospitality and retail businesses to roster staff, run payroll, manage purchasing, and reconcile takings. The platform is operated by Crosby Ops Pty Ltd, ABN 64 698 286 592.

Crosby Ops is a tool licensed to operating businesses. The app is intended for the staff and managers of those businesses. We are bound by the Australian Privacy Principles set out in the Privacy Act 1988 (Cth).

What we collect

From employees

• Full name, preferred name, date of birth, gender.
• Contact details: email, phone, residential address.
• Emergency contact name, relationship, phone.
• Employment details: position, employment type, start date, hourly rate or annual salary, award classification, hours.
• Tax declaration data: Tax File Number, residency status, claim of the tax-free threshold, HECS/HELP debt status.
• Superannuation details: fund name, ABN, USI, member number.
• Bank details for pay deposit: BSB, account number, account name.
• Photo identification or certifications (e.g. RSA, food handler) uploaded by the employee or their manager.
• Shift activity: punches in and out, hours worked, breaks taken, leave taken.
• An optional avatar colour selected in the profile.

From managers and area managers

• The same employment, contact, and pay data described above (where the manager is also a paid staff member).
• Actions taken in the app: rosters published, shifts edited, invoices uploaded, orders placed, leave decisions made. These actions are logged with the manager's identity for audit purposes.

From device interactions

• If you enable push notifications, we capture an opaque device token so we can deliver notifications. The token does not identify the device beyond that.
• If you use the camera or photo library to upload invoices or certifications, the captured image is stored in the platform. We do not access the camera or library at any other time.
• Crash and performance diagnostics from Apple's standard reporting may be collected anonymously. These are not linked to your identity.

How we use this information

We use the information only to run the platform's core functions:

• Authenticate you and protect your account.
• Show you your roster, your shifts, your leave balance, your pay history.
• Let your manager build the roster, approve timesheets, and run payroll.
• Send payroll data to Xero for the pay run, and to the ATO for Single Touch Payroll reporting via Xero.
• Send rostered hours and revenue data to Square for store reporting.
• Deliver notifications about your roster, shifts, leave decisions, and performance reviews.
• Reconcile supplier invoices against orders and post them to Xero.
• Improve the platform. Aggregate, non-identifying usage patterns help us decide what to build next.

We do not use your information for advertising. We do not sell it. We do not share it with any third party for marketing purposes.

Who we share it with

Crosby Ops shares the minimum amount of personal information needed to perform the function listed. The recipients are:

• Xero (Australia). We send employees, pay rates, timesheet hours, leave, super contributions, and bank details so Xero can run your pay and lodge STP with the ATO. Xero's privacy policy applies to the data once it lands there.
• Square (Australia). We read sales data from the store's Square account and write back labour-cost reporting. We do not send any employee personal data to Square.
• Supabase (United States). Our database and authentication provider. All personal data described above is stored in Supabase's Sydney region (ap-southeast-2).
• Apple Push Notification service. When you enable native notifications, push messages are routed through Apple to your device. The push message contains only the notification title and a short body line. It does not contain any sensitive data.
• Apple App Store and TestFlight. Crash and performance reports may be sent to Apple by the operating system. These are not linked to your identity by Crosby Ops.

We do not transfer personal data to any other third party except where required by law (for example, a lawful request from the ATO or law enforcement).

Where we store it

All personal data is stored in Supabase's Sydney region. Sensitive fields (Tax File Number, bank account number) are encrypted at rest. Access is restricted to the platform's automated systems and to a small number of named administrators on a need-to-know basis.

How long we keep it

We keep employment records for the period required by Australian law, which is 7 years after the end of the employment relationship for payroll and tax data. After that we either delete the records or de-identify them so they can no longer be linked to you.

Shift punches, roster history, and order history are kept for as long as the store needs them to operate.

Push notification tokens are deleted when you turn notifications off in the app or when Apple tells us the token is invalid (you uninstalled the app, signed out, or changed devices).

Your rights

Under the Australian Privacy Act, you can:

• Ask us what personal information we hold about you.
• Ask us to correct anything that is wrong.
• Ask us to delete your personal information, subject to the legal record-keeping obligations above.
• Withdraw consent for push notifications at any time, in Profile inside the app.
• Complain to us first, and if not satisfied, to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To make a request, contact us using the details below. We will respond within 30 days.

Children's privacy

Crosby Ops is a workplace tool. Some employees are aged 15 to 17. Where an employee is under 18, the parent or guardian is welcome to contact us on their behalf about anything in this policy.

Cookies and similar technologies

The web version of Crosby Ops uses local storage and session cookies set by Supabase to keep you signed in and to remember your preferences (such as the week and store you last viewed). No third-party advertising or analytics cookies are set.

Changes to this policy

We will update this page when our practices change. If the change affects how we collect or use your personal data in a substantive way, we will notify you in the app before the change takes effect.

Contact us

For any privacy question, request, or complaint, contact:

Crosby Ops Pty Ltd
Email: support@crosbyops.com