Written to be read in five minutes. Last reviewed with the code on 19 September 2026. The short version is on the security page; this is the full one.
Rostru is rostering and attendance software for hospitality venues, made in Melbourne, Australia. In this policy "we" and "Rostru" mean the operator of www.rostru.com, and "you" means the business that signs up (the venue), the people it rosters (staff), or a visitor to the website.
Questions, requests and complaints about privacy go to hello@rostru.com. We answer within a week.
From the venue: the business name, the owner’s and managers’ email addresses, venue addresses and opening hours, roles and pay rates, and the rosters you build. This is what the product is.
From staff: name, email address and mobile number (entered by the venue so you can be rostered and sign in), the availability, leave and shift requests you enter yourself, the hours you are rostered and the times you clock on and off.
Location: only when you tap clock on or clock off, and only if you allow it. We record one position at clock-on and one at clock-off, with its accuracy, and whether it was inside the venue’s geofence. Nothing runs in the background and there is no trail. Location is required to clock on — that is what clock-on is — but everything else in the app works without it.
Payment details: if a venue subscribes, card details go directly to Stripe, our payment provider. We never see or store a card number — we hold a reference to the Stripe customer and the last four digits, expiry and brand of the card so you can recognise it.
Website: we do not use advertising trackers or analytics cookies. Our hosting provider keeps standard web-server logs (IP address, browser, page requested) for security and reliability.
Run the service: build and publish rosters, tell staff their shifts, check attendance against the roster, produce timesheets for payroll.
Sign you in: a one-time code or link is emailed to your address. We do not store passwords.
Bill the venue: through Stripe, at the plan the venue chose.
Support you: if you write to us, we use what you sent to help.
We do not sell personal information, and we do not use it for advertising.
A venue’s data is visible only to that venue. This is enforced in the database itself (row-level security), not just in the app, and it is tested on every release.
Owners and managers of a venue see its rosters, its staff’s contact details, availability, requests, clock times and approved hours.
Staff see their own shifts, hours, requests and availability, and the first names and roles of colleagues they can swap with. Staff never see anyone else’s pay rate or contact details.
Rostru’s operator can see business-level information (which venues exist, what plan they are on, whether they are active) to run the service, and can access a venue’s data only to fix a problem the venue has asked us about.
We use a small number of providers to run Rostru, each under their own privacy terms: Supabase (database and sign-in, hosted in Sydney, Australia), Netlify (website hosting and our server functions), Stripe (payments), Resend (sending email), Mapbox (maps for setting a venue’s geofence — addresses you type into the map search go to Mapbox; staff locations do not).
We share personal information with no one else, except where the law requires it or to protect someone’s safety.
The database and its backups are in Australia (Sydney region). Data is encrypted in transit (TLS) and at rest.
Sign-in is by emailed one-time code or link — there are no passwords to leak. Server secrets are held by our hosting provider, never in the app you download.
If we ever have a data breach likely to cause serious harm, we will tell the affected venues and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
Clock-on and clock-off locations: 90 days by default, then deleted automatically. A venue can shorten this in Setup. The inside-the-fence flag and the approved hours are kept with the timesheet.
Rosters, approved hours and attendance records: seven years, because Australian workplace law requires employers to keep them. The venue is the employer; we keep them on the venue’s behalf.
Availability, leave and swap requests: while the person is on the venue’s roster.
A venue that stops using Rostru: data is kept for 90 days so it can pick up where it left off, then deleted. Ask us to delete it sooner and it is gone within seven days, backups included on their normal cycle.
You can ask what we hold about you and get a copy. Venues can export their roster, people and timesheets as CSV from the app at any time. Staff can ask their venue or us.
You can ask us to correct something that is wrong. Most details can be changed in the app directly.
You can ask us to delete your information. For a venue this closes the account. For a staff member, records the venue must keep by law (hours worked) stay with the venue; everything else is removed.
You can withdraw location permission at any time in your phone’s settings. You then cannot clock on from the phone; your manager records attendance from the roster instead.
If you are not happy with how we handled a request, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
Rostru is a workplace tool. Venues may roster staff under 18 as the law allows; we collect the same details for them and nothing more, and the venue is responsible for the consent their employment requires.
When the product changes what it collects, this page changes with it and the date at the top moves. A change that reduces your privacy is announced in the app before it takes effect.
See also the terms of service.