Privacy Policy

This Privacy Policy describes how Clandestino Pty Ltd, trading as "Punchr" ("we", "us", "our"), collects, uses, and shares information when you use the Punchr scheduling, payroll, and POS-sync service (the "Service") available at punchr.ai. Clandestino Pty Ltd is the data controller for personal information processed through the Service, and determines the purposes and means of that processing.

1. Information we collect

• Account information — name, email, phone, role, and authentication identifiers (including Google sign-in identifiers when you choose to use Google to sign in).
• Workplace data — schedules, shifts, time punches, leave requests, areas, and pay rates that you or your employer enter into the Service.
• Integration data — data we sync with connected systems you authorise, such as Square (POS time entries and team members) and Xero (employees, pay items, and draft pay runs).
• Usage data — log data, device information, and analytics events to operate and improve the Service.

2. How we use information

We use information to provide the Service, sync data with the integrations you connect, send transactional emails (such as roster notifications, leave updates, and account invitations), prevent abuse, and improve the product.

3. Google user data

When you sign in with Google, we receive your basic Google profile (name, email address, and Google account ID) so we can create or look up your Punchr account. We do not request access to your Gmail, Calendar, Drive, or any other Google product data. Google profile data is used only to authenticate you and link you to the correct Punchr employee record.

4. Sharing

We share your information with the following categories of recipients:

• Your employer's Punchr organisation — managers and payroll admins of the site you work at.
• Integrations you or your employer authorise — Square (POS and time entries) and Xero (payroll).
• Paddle.com — our online reseller and Merchant of Record for all orders. Paddle processes purchases, subscription management, payment data, invoicing, tax compliance and refunds, and provides customer service for orders. See Paddle's Privacy Notice.
• Service providers / sub-processors — hosting, email delivery, and analytics providers that operate parts of the Service.
• Professional advisers and authorities — legal or accounting advisers, and authorities where required by law.

We do not sell personal information.

5. Security

We use industry-standard measures including encryption in transit, role-based access controls, and row-level security on stored data. No system is perfectly secure, but we work to protect your data and notify you of material incidents as required by law.

6. Retention & deletion

We retain account and workplace data for as long as your employer's Punchr organisation is active, plus a reasonable archival period required for payroll and audit purposes. You can request deletion of your account by contacting support@punchr.ai.

7. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. To exercise these rights, email support@punchr.ai.

8. Changes

We may update this Privacy Policy from time to time. Material changes will be announced in the product or by email.

9. Contact

Questions? Email support@punchr.ai.