Privacy Policy
1.About this policy
OpsAlo Pty Ltd (ACN 698 043 499) ("OpsAlo", "we", "us") is committed to protecting your privacy. This policy explains how we collect, use, disclose and protect personal information when you use the OpsAlo app (on the web and on iOS) and our website, in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
2.Who this applies to
This policy applies to venue owners and managers who use OpsAlo, staff members invited to OpsAlo by their workplace, staff whose details are received from a service their workplace connects (such as Deputy), and visitors to our website.
3.What we collect
- Account information: your name, email address, password (stored only in encrypted, hashed form), your role, and the venues you belong to.
- Venue information: venue name, address, phone, website, opening hours, cuisine and similar business details entered by the venue owner.
- Content you create or upload: messages to the AI assistant, documents, tasks, reports, training materials and notes.
- Information from connected services: if a venue connects Deputy, Xero or Square, we receive data from that service (see section 7).
- Device notification token: if you allow notifications in the iOS app, a token that lets us send notifications to your device (see section 8).
- Usage and technical data: such as IP address, device and browser type, and app logs used to keep the service running and secure.
We do not collect your device's location. Location-based features (weather, nearby events, transport disruptions) use the venue's saved address, not where you are.
4.How we collect it
Directly from you when you sign up and use OpsAlo; from your employer or venue owner when they invite you; from services your venue chooses to connect (Deputy, Xero, Square); and automatically as you use the app.
5.Why we use it
To provide and operate OpsAlo, answer your questions through the AI assistant, show reports and dashboards, manage accounts and venue access, send service emails (such as verification codes and invites), send notifications you have allowed, provide support, keep the service secure, improve it, and meet our legal obligations. We do not sell your personal information and do not use it for advertising.
Wage and financial information is shown only to owners and managers of the venue, and is used only to show their reports and answer their questions. It is never sold, used for advertising, or used to train AI models.
6.AI processing
OpsAlo's assistant is powered by the Anthropic Claude API. When you send a message, the message and relevant venue context (which may include data from connected services, for owners and managers) are sent to Anthropic to generate a response. Anthropic does not use data sent through its API to train its models.
7.Connected services
An owner or manager can choose to connect third-party services to their venue. When they do, we receive the following from that service:
- Deputy (rostering): staff names and email addresses, shifts, hours and rostered wage costs.
- Xero (accounting): revenue, expenses, bills, invoices and supplier names.
- Square (point of sale): sales totals, orders and items sold.
We only read this data. We don't change anything in these services unless someone at the venue approves the change in OpsAlo. Connection credentials are stored on our servers only and are never shown in the app. A venue can disconnect any service at any time in OpsAlo. The service's own privacy policy applies to data held in its systems.
If your workplace connects Deputy, your name, email and shifts may be added to OpsAlo so your roster appears for you. This does not create an account or send you anything; you only get access to OpsAlo if your workplace invites you.
8.Push notifications
If you allow notifications in the OpsAlo iOS app, we store a notification token for your device so we can send you reminders about your tasks, training, approvals and end-of-day reports. Notification content is delivered through the Apple Push Notification service. You can turn notifications off at any time in your device settings. The token is deleted when you delete your account.
9.Service providers we share information with
We use trusted providers to run OpsAlo. Each receives only what it needs:
- Anthropic: AI assistant responses.
- Supabase: database, sign-in, file storage and server functions.
- Vercel: hosting for our website and web app.
- Resend: sending emails such as verification codes and invites.
- Apple Push Notification service: delivering notifications to iOS devices.
- Deputy, Xero and Square: only for venues that choose to connect them (see section 7).
- Google: address search, mapping, and the venue's public Google reviews.
- Open-Meteo: weather forecasts (receives the venue's coordinates only).
- Ticketmaster: nearby events (receives the venue's coordinates only).
- Transport for NSW: transport disruptions near the venue.
We may also share information with professional advisers under confidentiality obligations, or where required by law.
10.Overseas transfers
Some of our providers store or process data outside Australia, including in the United States. We choose providers with strong security and privacy practices.
11.Data security
We take reasonable steps to protect your information, including encryption in transit and at rest, access controls that separate each venue's data, role-based access so staff only see what their role allows, storing connected-service credentials on our servers only, and restricting internal access.
12.Data retention
We keep your information for as long as your account is active. AI conversation history is kept for up to 12 months. Data received from a connected service is kept while the service is connected and the venue uses OpsAlo. When you delete your account, we delete your personal information as described below, except where we must keep certain records to meet legal obligations.
13.Deleting your account
You can delete your account at any time inside the app: open Settings → Delete account. This:
- permanently deletes your login and profile, and signs you out on all devices;
- deletes your AI conversations, notifications, device notification tokens and personal reports;
- removes your access to all venues;
- if you are the only owner of a venue, deletes that venue as well, and your team loses access to it.
Work records you created for a venue that continues to operate (such as tasks) remain with that venue but are no longer linked to you.
14.Your rights
You can access and correct your information in the app, delete your account as described above, or ask us for a copy of your data or any other privacy request by emailing privacy@opsalo.com.
15.Children
OpsAlo is a workplace tool and is not directed at children under 16.
16.Complaints
If you think we've mishandled your information, email privacy@opsalo.com and we will respond within 30 days. You can also contact the Office of the Australian Information Commissioner at oaic.gov.au.
17.Changes to this policy
We may update this policy from time to time. The current version is always available at opsalo.com/privacy, and we will notify users of significant changes.
18.Contact
OpsAlo Pty Ltd · ACN 698 043 499 · New South Wales, Australia
privacy@opsalo.com