Privacy Policy

Last updated: 29 October 2026

TEAM MATE is a staff scheduling and time-tracking service used by businesses (“employers”) and their staff. This policy covers the hosted service and the TEAM MATE mobile apps. Your employer controls the workspace you belong to and most of the data in it; we process that data on their behalf.

TEAM MATE is run by TEAM MATE APP PTY LTD (ACN 703 657 461), an Australian company (“we”, “us”). We are responsible for the personal information we handle under this policy and the Australian Privacy Principles.

What we collect

• Account details — your name, email address, and phone number, provided by you or the employer who invited you. When you set up your account as a new staff member (on the web or in the app), also your date of birth, home address and an emergency contact.
• Employment data — position, certifications, availability, leave, shifts, timesheets, tip shares, and pay-rate information your employer manages in the product. This includes telling your manager you’re running late, a note on your timesheet when a shift lead clocks you in or out with a crew, and simple performance reviews: your probation end date, goals your manager sets, and notes from check-ins and probation checks (you see the goals and the notes your manager shares with you).
• Location at clock-in — only at a work location where your employer has set a clock-in area and turned on a location check. The app records your location at the moment you tap to clock in or out or start or end a break, and nowhere else. If you don’t share it, the punch still goes through and your manager sees that it came without location, unless that workplace has chosen to need it for clocking in. Location is never tracked in the background. The exact location is deleted 90 days after that day’s timesheet is approved (or a year after the day, if it’s never approved); the record of how far you were from the work location stays with the timesheet.
• Clock-in and clock-out selfies — if your employer asks for one at a work location, a selfie taken when you start your shift, finish it, or both, is stored with that clock-in or clock-out record. Selfies are never taken for breaks. If a selfie is required and you don’t take one, the app can’t clock you in or out; ask your manager. With no signal, the phone app keeps a clock-in or clock-out (and its selfie) inside the app until it can send it, then deletes its copy. Selfies are deleted 90 days after that day’s timesheet is approved (or a year after the day, if it’s never approved).
• Shift reports — if you fill one in when you finish a shift: what you wrote, whether something happened (and when and where), and up to three photos. Only you and the people who manage that work location see it.
• Documents your employer adds to your file — such as your employment contract, copies of ID, or certificates, uploaded by a manager, with any expiry date and note. Only you and the people who manage you can see them.
• Task photos — a photo you take for a task or checklist (before or after the job). The person who took it and the people who manage that work location see it.
• Training and policy sign-offs — when your employer sets training courses or policies to read: your quiz score and attempts, when you passed, reminders we sent you, and when you confirmed you’d read a policy, with the name you typed to sign it.
• “I’m OK” check-ins — only where your employer turns them on for people working alone: when your phone asked “All OK?”, when you tapped I’m OK, and whether your managers were alerted because you didn’t answer in time (the alert includes your phone number so they can call you). No location is sent.
• Your calendar link — if you make one, a private web address that lets your calendar app show your shifts. It works without signing in, so anyone you share it with can see your shifts. You can switch it off or make a new one at any time, and changing your password switches it off.
• Profile picture — optional, and only you can add one. If you do, people in your workplace see it next to your name. We shrink it and remove the camera details (including where it was taken) before storing it. You can remove it at any time; your manager can remove it too, and your employer can switch profile pictures off.
• Inductions — if your employer sets up a venue induction, we keep the words and photos they add to it, and a record that you passed it and when. Your quiz answers are not kept.
• Emergency roll calls — when a manager starts a fire or evacuation roll call (or a practice drill), we keep the list of who was on site (name, phone number, role and clock-in time), who ticked each person off and when, and the meeting point, as the venue’s safety record. If the alarm is sent, it reaches your phone as an urgent notification through Apple’s and Google’s notification services. Tapping “I’m out safe” ticks you off the list; it does not send your location.
• Messages and notes — one-to-one messages between you and the people who manage you, plus handover and leave-request notes, and any comment you leave when you clock out (the people who manage you see it on your timesheet). Messages are visible only to the two people in the conversation; not even your employer’s other admins can read them. You can delete a message you sent at any time; its text is then removed for both of you.
• Team and group chats — only where your employer turns team chat on: one-to-one messages with a co-worker (only the two of you can see them) and group chats for your venue, your area, the people on now, or a group a manager makes. A group chat is seen by the people in that group at the time: the venue’s staff in it and its managers, owners and admins. You can delete a message you sent at any time, and mute a chat.
• Polls — when you vote in a poll in the news feed or a group chat, we keep which choice you picked. Everyone who can see the poll sees the counts and, unless the poll hides who voted, your name beside your choice. You can change or take back your vote until the poll ends.
• Shout-outs — when you thank someone you worked a shift with: the thanks you picked, any short note, and whether it went just to them or to the team (then the others on that shift and the venue’s managers see it too).
• Reports and blocks — you can report a chat message or a shout-out, or block a person. A report sends the venue’s managers what it said, the reason you picked, who wrote it and who reported it; we keep that as a record even if the message is later deleted or removed. A manager can remove it for everyone. Your block list is seen only by you, and the person you block isn’t told.
• Photos in messages — optional: a photo you choose to send in a chat, taken with the camera or picked from your photos (only that one photo leaves your phone). We shrink it and remove the camera details (including where it was taken) before storing it. Like the message, only the people in the chat can see it. Deleting the message deletes the photo for good.
• Photos of your tickets — optional: when you send a new or renewed ticket (a Food Handler Card, say) from My tickets, a photo of the card, its expiry date and any note you add. We shrink the photo and remove the camera details (including where it was taken) before storing it. Only you and the people who manage you can see it; they approve it or send it back. A photo that’s sent back is deleted; an approved one is kept as the card on file until a newer card replaces it or the ticket is removed.
• News posts and comments — posts your managers share, any comment you leave on one (everyone who can see the post sees it), and when you confirm you’ve read a must-read. You can delete your own comment at any time. You can hide someone else’s comment just for you, or report it: a report hides it for you and tells the post’s managers who reported it and why, and we keep the comment’s text with the report as a record. A manager can remove a comment; it is then hidden from everyone but kept as a record.
• Bank, tax and super details — where an employer collects these for payroll (you type them in on the web or in the app), they are encrypted at rest with a key held outside the database. If your employer connects its own Xero Payroll account, it can send your hours and — when an admin presses the button to add you — these details to that account, so they don’t have to be typed in again. Xero’s privacy policy applies there.
• Push notification tokens — so shift updates and reminders reach your device. Signing out removes the token. A new-message notification shows the sender’s name and the start of the message (or “Photo” for a photo; never the photo itself), and is delivered through Apple’s and Google’s notification services.
• Signed-in devices — for each place you’re signed in, the kind of phone or browser (like “iPhone 15 Pro” or “Chrome on Mac”), when you signed in and when it was last used, so you can see where you’re signed in and sign any of them out. Only you see it. It goes when that device signs out, or after 30 days unused.
• Your alert settings — quiet hours (on by default, 9 pm to 7 am and never during your shifts), your shift reminder times, which alerts you’ve turned off and whether alerts hide their details on your lock screen. While you’re in quiet hours, someone writing to you sees “off until 7 am” (the time they end) — never your other settings.

Why we use it

We use this information to run TEAM MATE for your employer and for you: rosters, clocking in and out, timesheets and pay exports, leave, messages and the other features above; to keep accounts and workspaces secure; to answer support requests; and to find and fix problems.

What we do not do

We do not sell personal data, show advertising, or use third-party analytics or tracking in the apps. Data is used only to provide the service described above.

Your employer’s own systems

Your employer can connect TEAM MATE to its own systems. It can send workspace data to its Xero account (see “Bank, tax and super details”) and to its own software through our developer connection (Open API) or automatic updates (webhooks), and bring in its Square sales totals (nothing about staff is sent to Square). Once the data reaches those systems, your employer and that system’s own privacy policy look after it.

Error reports

When something breaks on the website, on our server or in the app, an automatic error report goes to Sentry, a service that works for us as a service provider, so we can find and fix the problem. A report says what went wrong and where (the page or screen and the line of code), the kind of phone or browser and its system version, the app version, and the pages and steps just before the error. Before a report leaves, we remove who it happened to: no name, email address, internet (IP) address, password, sign-in details, what was typed into a form, or anything after a “?” in a web address. Error reports are not used for advertising or to track you. Sentry stores them in the European Union.

AI helpers

Some optional features use an AI service, Anthropic, to write an answer. Anthropic works for us as a service provider. We send it only what that answer needs, and only when someone uses the feature:

• Help assistant — the question you type and your role (for example “manager”). It never sees your workplace’s data. We don’t keep the conversation, unless you rate an answer with a thumbs up or down; then we keep that question, the answer and your rating so we can improve the answers.
• Ask TEAM MATE about your own shifts (staff, only if your employer switches it on) — to answer a question about your own work, it also sends your own shift dates and times, job, area and venue names, your rostered and worked hours, your leave types and balances, and the dates, hours and status of your leave requests. It never sends your pay rate or pay, bank, tax or medical details, the note on a leave request, or anyone else’s records, and it doesn’t change anything.
• Roster in plain words — what a manager types about the week, plus that venue’s dates, areas, busy times, job names and staff names. No pay rates, availability or contact details.
• Venue assistant (for owners and managers) — to answer a manager’s question about their own venues, it sends staff names, shift and clock times, job and area names, timesheet issue notes, certificate names and expiry dates, rostered hours against limits, leave types and dates (but never the note you write on a leave request), and venue wage totals per day. It never sends a person’s pay rate or contact details. The assistant doesn’t change anything itself; the manager makes any change.

Apart from the rated help answers above, we don’t keep what is sent to the AI service. Anthropic is based in the United States and handles this data there. Under Anthropic’s commercial terms, what we send through its service isn’t used to train its AI models; Anthropic may keep it for a short time under those terms, for example to check for misuse. We keep a rated question and answer until you delete your account or your employer deletes its workspace.

Payments

Employer subscriptions are processed by Stripe on our website. We never see or store card details; Stripe’s own privacy policy applies to payment processing.

Who helps us run TEAM MATE

These companies work for us as service providers. We send each one only what it needs to do its job for us:

• Replit runs our website and servers, so everything above passes through it. Uploaded photos and documents are kept in Replit’s file storage, which runs on Google Cloud.
• Neon runs our database (through Replit), where the records above are kept.
• Resend sends our emails: your name and email address and what the email says (for example a new roster, an invite or a password reset link).
• Expo passes push notifications to Apple’s and Google’s notification services: your phone’s push token and what the notification says.
• Stripe takes payments for employer subscriptions (see Payments).
• Anthropic writes the AI helpers’ answers (see AI helpers).
• Sentry receives error reports (see Error reports).
• YouTube or Vimeo, only when a training course your employer made includes a video from there: playing it loads their video player, which sees your internet address and device, as any website video does.

Some of these companies are based overseas, mainly in the United States, and may store or handle information there or in other countries.

Retention and deletion

Data is retained while your workspace is active. You can delete your account from within the app (or by contacting us): your login, contact details, bank details, and other personal information (including your profile picture, your clock-in and clock-out selfies and the location saved with each clock-in and clock-out, photos of your tickets and any two-step sign-in set-up) are removed immediately and you are signed out everywhere. Messages and photos you have already sent stay in the other person’s conversation, shown under your name; you can delete any of them first. Past roll-call lists stay with your employer as a safety record under your name, without your phone number. Shift reports you wrote when you finished a shift (what happened, when and where, and their photos) also stay with your employer as its workplace incident record, and so do documents your employer added to your file, such as your employment contract, and photos you took for tasks. Your name and date of birth on past wage and time records stay with your employer for the period employment-record laws require — 7 years in Australia under Fair Work record-keeping rules. Employers can delete their entire workspace, including those records, from the web app’s settings.

To recover from mistakes, our database keeps a restore history: something deleted can stay there for up to 7 days before it is gone for good.

When an employer deletes its workspace, everything in it is deleted straight away, except a short security record: sign-in and password changes, changes to who can do what, downloads and exports, and the deletion itself. We keep that for 12 months, with every name and email address replaced by a neutral label such as “Owner” or “Staff member 3”, so we can look into misuse or a security problem. After 12 months it is deleted too, and we keep only a note of the date the workspace was deleted.

Security

All traffic is encrypted in transit (TLS). Tenant data is isolated per workspace, enforced at the application layer and again with database row-level security. Sensitive payroll fields are additionally encrypted at rest. You can turn on two-step sign-in (a code from an authenticator app), change your password and sign out other devices from your account’s “Sign-in & security” page, or Me in the app. Changing your password signs out every other device and emails you. To stop password guessing, each wrong sign-in keeps a scrambled fingerprint of the email typed and the internet address it came from (never the email, address or password itself) for one day; too many in 15 minutes and sign-in waits.

Contact and complaints

Questions or requests (access, correction, deletion): support@teammateapp.au. Your employer controls most workspace data, so for some requests we may ask them to help or pass your request on to them.

If you think we have mishandled your personal information, email us at the same address with what happened. We will reply within 30 days. If you’re not happy with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.