Privacy Policy

This Privacy Policy explains how Rinelo ("we", "us", or "our") collects, uses, stores, shares and protects your personal information when you use our shared calendar, rostering and shift-tracking service (the "Service").

By creating an account, downloading, accessing or using the Service, you agree to the practices described in this policy. If you do not agree, you must not use the Service. This policy is designed to be read together with our Terms and Conditions.

The Service is operated by the entity identified in your account or subscription records, which acts as the data controller for your personal information.

This policy applies to:

• Registered account holders, including calendar owners and invited members.
• Crew members, workers and other individuals whose information is entered into the Service by an account holder.
• Visitors to our website or app who browse publicly available information.

If you are invited to a calendar or shift roster, the calendar owner is responsible for ensuring they have your consent or another lawful basis to add your details. We process that information on the owner’s instructions.

We collect several categories of information, described below.

3.1 Information you provide directly

• Account details: email address, password, display name and optional profile photo.
• Calendar and roster content: events, job sites, addresses, rosters, shift times, member permissions, comments, attachments and any notes you add.
• Shift-tracking information: clock-in and clock-out times, location coordinates, off-site trip reasons, break confirmations and timesheet approvals.
• Billing information: name, billing address, payment method details and transaction history. Full card numbers are handled by our payment processor; we do not store them.
• Support messages: any information you send when contacting us through the in-app Help & Support centre or by email.

3.2 Information collected automatically

• Device location: GPS coordinates when you use clock-in, clock-out or geofence features, only while those features are active and with your permission.
• Push notification tokens: tokens provided by your browser or operating system when you opt in to alerts.
• Device and usage data: device type, operating system, app version, IP address, browser type, error logs and aggregated usage patterns used to keep the Service secure and reliable.

3.3 Information from third parties

• Payment information from Stripe to process subscriptions and add-ons.
• Payroll and organisation information from Xero when a calendar owner connects their Xero account and chooses to export timesheet data.

We use your personal information for the following purposes and on the following legal bases:

• To provide the Service — creating and displaying calendars, rosters, events and shifts, sharing them with invited members, and processing clock-in/clock-out data. This is necessary to perform our contract with you.
• To communicate with you — sending reminders, shift alerts, owner notifications, support responses and service updates. We rely on your consent for push alerts, or on our legitimate interest for essential service messages.
• To process payments — billing subscription fees and add-ons, managing renewals, cancellations and payment issues. This is necessary for the contract and to meet our legal obligations.
• To enable integrations — exporting approved timesheet hours to Xero only when a calendar owner chooses to connect Xero.
• To improve and secure the Service — troubleshooting, analytics, fraud prevention and enforcing our Terms. This is based on our legitimate interest in running a safe and reliable service.
• To comply with law — responding to lawful requests, court orders or regulatory requirements.

Rinelo only accesses your device location when you actively use GPS clock-in, clock-out or shift-tracking features. We do not track your location continuously in the background.

When you clock in or out, your location coordinates may be recorded and shared with the calendar owner and any managers they appoint, so they can verify attendance at job sites. You can disable location access through your device settings, but this may prevent clock-in, clock-out and geofence features from working.

We use location data only for shift verification and payroll accuracy, and we do not use it for advertising or unrelated profiling.

We do not sell, rent or trade your personal information. We only share it in the following circumstances:

• Calendar members: other members of calendars you create or join, based on the permissions set by the calendar owner.
• Service providers: trusted providers who help us run the Service, including data hosting services, payment processors (Stripe), payroll integrations (Xero when connected by a calendar owner), email and push-delivery providers, and analytics or security vendors. These providers only receive the information they need to perform their services and are contractually required to protect it.
• Legal and safety purposes: law enforcement, regulators or other parties if we believe disclosure is necessary to comply with applicable law, protect our rights, prevent fraud, or protect the safety of users or the public.
• Business transfers: if we are involved in a merger, acquisition, asset sale or similar transaction, your information may be transferred as part of that deal, subject to confidentiality arrangements.

Your data is stored in a secure database managed by our data hosting services and owned by the operator of Rinelo. We use industry-standard technical and organisational measures to protect it, including encryption in transit, encrypted storage, access controls, authentication requirements and regular backups.

Our data hosting services may store or process data in multiple countries. Where personal information is transferred outside your home jurisdiction, we rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms to protect your information.

No internet-based service can be guaranteed to be completely secure. You are responsible for keeping your account credentials safe and for using a strong, unique password. If you suspect your account has been compromised, contact us immediately through the Help & Support section.

We keep your information for as long as your account is active or as needed to provide the Service, resolve disputes, enforce our Terms, meet legal obligations or protect our legitimate interests.

Specific retention periods include:

• Account and profile information: retained while your account is active and for a reasonable period after deletion to handle disputes, recoveries or legal requirements.
• Calendar, event and shift data: retained according to the calendar owner’s instructions and deleted when the calendar or account is deleted, unless a longer period is required by law.
• Unpaid or past-due accounts: if payment is not received and the account remains in a past-due state, we will keep your account data, calendars, events, shift records and personal information for 30 days from the missed payment date. This gives you time to settle the balance, update your payment method or export important information. After 30 days, if payment is still not received, we may permanently delete the account and its data without further notice. Once deleted, the data generally cannot be recovered.
• Payment records: retained for as long as required by tax, accounting and financial regulations, even if the account is deleted.
• Support messages: retained for as long as necessary to resolve your request and for a reasonable period afterward for quality and legal purposes.

If you delete your account, we will remove your personal information and calendar data from active systems within a reasonable time. Some residual copies may remain in backups for a limited period before being permanently deleted.

Depending on where you live, you may have rights regarding your personal information, which may include:

• Access: requesting a copy of the information we hold about you.
• Correction: updating inaccurate or incomplete information through the app settings or by contacting us.
• Deletion: asking us to delete your account and personal information, subject to legal or contractual exceptions.
• Restriction or objection: asking us to limit or stop certain processing, including direct marketing.
• Data portability: receiving your data in a commonly used, machine-readable format.
• Withdraw consent: turning off push notifications in the app settings or withdrawing consent for optional processing at any time.

You can exercise many of these rights directly in the app through Account and Notifications settings. For other requests, contact us through the Help & Support section. We will respond within the timeframe required by applicable law.

Rinelo uses essential cookies, local storage and similar technologies to keep you signed in, remember your preferences, maintain session state and keep the Service secure. These cookies are strictly necessary for the Service to function and cannot be disabled without affecting your experience.

We do not use tracking cookies, third-party advertising cookies or behavioural profiling cookies. Where we use analytics, the data is aggregated and used only to improve performance and reliability.

You can manage or delete cookies through your browser settings. If you block essential cookies, some features of the Service may not work correctly.

If you opt in, we may send push notifications to your device for shift reminders, calendar alerts, owner notifications and important service updates. You can manage these preferences at any time in the Notifications settings.

Browser or operating-system push tokens are stored securely and are only used to deliver notifications to you. If you revoke permission through your device settings, we will stop sending push notifications.

The Service may contain links to or integrations with third-party services, such as Xero, Stripe or mapping providers. Your use of those services is governed by their own terms and privacy policies. We are not responsible for the content, practices, privacy policies or availability of any third-party services.

When a calendar owner connects Xero, timesheet data is sent to that owner’s Xero account under their control. We do not control how Xero processes that information.