Privacy Policy
Effective 30 September 2026
1. Who we are
Staff & Roster is operated by InterconX Limited, a company registered in Hong Kong. In this policy, "we", "us" and "our" mean InterconX Limited.
For anything about privacy, email [email protected]. For help using the app, see our Support page.
2. Your employer and us
Staff & Roster is a rostering and time-tracking service that businesses subscribe to. When your employer invites you, your employer decides what information about you goes into the app and uses it to run its workplace: rosters, timesheets, leave and pay costing.
- For that workforce information, your employer is responsible for it (under data-protection law, it is the "controller" or "data user"). We store and process it on the employer's behalf and on its instructions (we are its "processor").
- For your sign-in account, the security of the service, billing, and this website, we are responsible for the information.
If you want to see, correct or remove workforce records, such as a shift, a timesheet or your pay rate, ask your employer first. If you contact us about records your employer controls, we will pass your request to your employer and help it respond.
3. What we collect and why
Your account
- Name, email address and password. To create your account, sign you in and let coworkers see who is on a roster. Passwords are stored only as a one-way hash; we cannot read them.
- Phone number, if you add one. It is optional.
- Two-factor authentication (MFA) settings, if you turn MFA on: an encrypted secret and recovery codes.
- Sign-in and activity times, such as when you last signed in, to keep accounts secure and show managers who is active.
Work information your employer enters or you enter at work
- Employment details: the company and stores you work at, your position, whether you are a manager, and your employment type.
- Pay information: your hourly rate or salary and the calculated cost of each shift. Only people with permission to manage staff can see it; coworkers cannot.
- Rosters and shifts, shift offers and shift swaps.
- Time records: clock-in and clock-out times, breaks, approvals and corrections.
- Availability and leave requests, including the leave type and any reason you write. A request can be marked as sick leave. Please do not include medical details in the reason; your employer only needs to know that you are unavailable.
- Notes you write, such as the reason for a swap or a message about an event.
Location, only when you clock in or out
When you tap Clock in or Clock out, the app reads your device's precise location once to check that you are at the store (within the radius your employer set, 100 metres by default). On Android, a QR-code or NFC clock-in also records a location when one is available. The app never tracks your location in the background or between clock-ins, and it asks for location permission "while using the app" only. The coordinates are saved on that time record and in our security audit log, so your employer can confirm where a clock-in happened.
Camera and NFC
On Android, the camera is used only to scan a store's clock-in QR code, and NFC only to read a store's clock-in tag. The camera image is read live on your device; no photos or videos are saved or uploaded.
Your device
- Push notification token and basic device details (device name, model, operating system and app version), if you allow notifications. We use them to send you roster, shift and approval alerts.
- IP address and browser or app details (user agent), recorded in security and error logs.
- Error reports from the app: the error message, the page, your user ID and your device details, so we can find and fix faults. A copy without your user ID or IP address goes to our own internal monitoring system.
Payments
- Subscriptions. Businesses pay for Staff & Roster through Stripe on the web. Card details are entered on Stripe's pages and go straight to Stripe; we never see or store full card numbers. We keep Stripe's customer reference, the card brand, its last four digits and expiry, and the subscription's status and invoices. The mobile apps do not sell subscriptions.
- Event tickets. If you buy a ticket to an event a business runs through Staff & Roster, we collect your name and email address and the order details (quantity, amount, currency and status) to issue your ticket, and Stripe processes the payment. You do not need an account. We act as the seller of record for these payments, collect them on behalf of the business running the event, and pass the proceeds to it after our commission. The business running the event also receives your name and email address, so it can manage its guest list and check tickets at the door.
This website
- Waitlist email address, if you use the "Notify Me" form, to tell you when Staff & Roster launches.
- Website analytics using Matomo, which we host ourselves. It records page views and visits; there are no advertising trackers.
What we do not collect
We do not collect your contacts, messages, call logs, photos or files, microphone audio, health-sensor data, browsing history or advertising ID. The apps contain no advertising and no third-party analytics or crash-reporting tools. We do not sell personal information and do not use it for advertising or to track you across other companies' apps and websites.
4. Why we are allowed to use it
Where the law asks us to name a reason (a "legal basis"), we rely on:
- Providing the service (contract): running your account, rosters, time records, notifications and ticket orders.
- Our legitimate interests, and those of your employer: keeping the service secure, preventing fraud and misuse, verifying clock-ins, and fixing errors.
- Legal obligations: keeping business, tax and payment records.
- Your permission (consent): location, camera, NFC and notifications are each asked for by your device, and you can turn them off at any time in your device settings. Without location, GPS clock-in will not work, but your manager can still record your times.
For workforce information, your employer decides the purposes and is responsible for having a proper basis for them.
5. Who receives your information
Inside the app, people at your company see what they need for their role: coworkers see your name on rosters and shift offers; managers and administrators also see your time records, availability, leave and, if permitted, pay details. People at other companies cannot see your information.
We use these service providers to run Staff & Roster. Each receives only what it needs and may use it only to provide its service to us:
| Provider | What it does | What it receives |
|---|---|---|
| Stripe | Subscription billing and event ticket payments | Business billing contact, card details (entered directly with Stripe), ticket buyer name, email and order |
| Google Firebase Cloud Messaging | Delivering push notifications (on iPhone, through Apple's push service) | Your device's push token and the notification text |
| Resend | Sending email: invitations, password resets, notifications, tickets | Your email address, name and the message |
| Cloudflare | Network security and delivery in front of our servers | Your IP address and the requests passing through |
| DigitalOcean | Hosting: the cloud server we operate, in San Francisco, USA, which stores the app's data | All app data, stored on a server we administer |
We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a sale or reorganisation of our business, in which case this policy continues to apply.
6. International transfers
We are based in Hong Kong, but the app's data is stored on our server in San Francisco, in the United States, hosted by DigitalOcean. Using Staff & Roster therefore means your information is transferred to the USA. Stripe, Google, Resend and Cloudflare operate worldwide. Where we transfer personal information across borders, we use providers that commit to protecting it under their data-processing terms, including standard contractual clauses where the law requires them.
7. How long we keep it
| Information | How long |
|---|---|
| Your account (name, email, phone, password, MFA) | While your account is open. Removed straight away when you delete your account (see section 8). |
| Rosters, shifts, time records, clock-in locations, leave and pay records | These are your employer's business records. We keep them while your employer's company account is open, so it can meet payroll and employment-record obligations, and for 7 years after it closes. They are then automatically deleted. |
| Security audit log (including IP address and clock-in location) | 7 years, then automatically deleted. |
| Error reports | 90 days, then automatically deleted. |
| Push notification tokens | Until you delete your account. A token stops being used as soon as the push service reports it is no longer valid, and an unused token is deleted 90 days later. |
| Sign-in sessions and access tokens | A sign-in lasts at most one year, or until you sign out or delete your account; expired sign-ins are deleted within a day. |
| Subscription and payment records | 7 years, as Hong Kong tax and accounting record-keeping rules require, then automatically deleted. Stripe keeps its own payment records under its own policy. |
| Event ticket orders | 7 years (they are financial records), then automatically deleted. |
| Website waitlist email | Until launch, or until you ask us to remove it. |
8. Deleting your account
You can delete your account yourself in the app: Profile → Delete account. You will be asked for your password (and your MFA code if MFA is on) and to type DELETE to confirm. If you cannot sign in, email [email protected] from the email address on the account. Full steps are on our Delete your account page.
What is removed: your name, email address, phone number, password, MFA settings, device and push tokens, availability, notifications and sign-in tokens. You are signed out on every device, and you can no longer sign in.
What your employer keeps: the shifts you worked, your time records and roster history stay with your employer, with your name replaced by "Deleted user". Your employer needs these to pay you correctly and to keep the employment records the law requires. Security audit entries are kept for their 7-year period. To have those records changed or removed, contact your employer. The tamper-evident security audit log is not edited when you delete your account, so entries made before then can still show your details as they were at the time; it is deleted automatically after 7 years.
If you are the only administrator of a company that has other active members, you must make someone else an administrator first. If you are the company's only member, the company is closed with your account and its subscription is cancelled at the end of the current billing period.
9. Security
- All connections to the app use HTTPS encryption; the Android app refuses unencrypted connections.
- Passwords are hashed, and MFA is available for every account.
- Each company's data is kept separate, and access inside a company is limited by role and permission.
- Security-relevant actions are written to a tamper-evident audit log.
- The Android app does not allow its data to be copied into device backups.
No system is perfectly secure. If we become aware of a breach that affects your personal information, we will notify you and the relevant authorities where the law requires it.
10. Children
Staff & Roster is a workplace tool and is not intended for anyone under 16. We do not knowingly collect information from children under 16. If you believe a child's information has been entered, contact [email protected] and we will delete it.
11. Your rights
Depending on where you live, including under Hong Kong's Personal Data (Privacy) Ordinance, Australia's Privacy Act 1988, and the GDPR in the EU and UK, you may have the right to:
- get a copy of the personal information we hold about you;
- have it corrected if it is wrong;
- have it deleted;
- object to or limit how we use it, and withdraw a permission you gave;
- receive it in a portable format;
- complain to your data-protection authority, such as Hong Kong's Privacy Commissioner for Personal Data.
You can view and correct most of your account details yourself on your Profile page. For anything else, email [email protected]. We will reply within 30 days and may need to confirm your identity first. For workforce records your employer controls, see section 2.
12. Cookies and similar storage
- The app uses cookies and your device's local storage only to keep you signed in, protect forms against cross-site request forgery, and remember your settings. These are necessary for the app to work.
- This website uses cookies only for Matomo analytics, which we host ourselves. You can block cookies in your browser settings.
We use no advertising cookies.
13. Changes to this policy
We will update this policy when the app or the law changes, and change the date at the top. If a change materially affects how we use your information, we will tell you in the app or by email before it takes effect.
14. Contact
- Privacy: [email protected]
- Help with the app: Support
- InterconX Limited, Hong Kong — please contact us by email.