Privacy notice

Who we are

StaffOPs is made by JOYTECH, a New Zealand business. If you are a business using StaffOPs to roster your staff, you are the controller of your staff's information and we process it on your behalf. If you are a member of staff, the business that invited you decides what goes in here — ask them first, and us if they cannot help.

Where your data lives

In Sydney, Australia, on Supabase infrastructure, with the application running in the same region. We chose that deliberately: New Zealand and Australia are our first markets, and keeping the data close keeps it both fast and inside a jurisdiction both countries recognise.

Australian data therefore stays onshore. New Zealand law permits sending personal information overseas where the destination has comparable safeguards, which Australia does.

We are not currently set up to serve UK or EU customers. If we open those markets we will host their data in the UK rather than send it here.

What we hold

• Your name, email address, job title, and your mobile number if one has been added.
• The teams you are in, and whether you manage them.
• Shifts you have been asked to work, your answer, and what you were rostered on — including if you were later told you were not needed, and any request you made to come off a shift you had accepted.
• When you clocked in and out, and the hours that produced.
• Your pay rate, if the business has set one — you may have a different rate in each team. A manager can see rates only for teams they manage; the company account can see all of them.
• Leave a manager has recorded for you: the type (sick, annual, bereavement, public holiday, unpaid or other) and the hours.
• Dates and times you have said you are not available to work. You enter these yourself, and you are never asked for a reason.
• The messages the app sends you about your own shifts.
• Messages you send to the built-in assistant.

Location

If your employer switches on the clock-in check, your device is asked for its position at the moment you clock in or out. It is compared against the address of the place you are working and then discarded.

We do not store it. There is no column for it in our database. We cannot tell your employer where you were, because we do not know — only whether you were close enough at that moment. Nothing tracks you between clock-ins, and declining the permission prevents clock-in rather than being recorded.

How long we keep it

• Assistant messages: 12 months, then deleted automatically.
• Records of who was asked to work a shift and who declined: 24 months, then deleted automatically.
• Timesheets, hours and pay records: kept while the account exists. These are wage and time records, and employment law requires your employer to keep them — six years in New Zealand, seven in Australia. Deleting them for you would put your employer in breach of their own obligations.
• Everything else — rosters, teams, locations, your profile — stays while the account exists and goes when it is closed.

Closing an account

The company account can close the business's StaffOPs account at any time. Access ends immediately for everyone, and everything is permanently erased 30 days later. The delay exists so a mistake can be undone; erasure cannot.

The whole account can be downloaded as a single file at any point, including after closure is requested and up until erasure.

Who else touches it

We use a small number of other companies to run StaffOPs — hosting, the database, email delivery, address lookup, and the assistant. They process data on our instructions and are listed, with what each one receives, in our sub-processor register. Ask and we will send you the current version.

We do not sell your data, and we do not advertise.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. If you use StaffOPs through your employer, start with them — they decide what is held. Where we hold it on their behalf we will help them respond.

In New Zealand you may complain to the Office of the Privacy Commissioner; in Australia, to the Office of the Australian Information Commissioner.

Contact

hello@joytech.nz