Privacy Policy

1. About this policy

Muster is a workforce rostering, timesheet and job-costing platform operated by Quantum CC Pty Ltd (ABN 37 626 515 508), trading as Muster App Co ("Muster", "we", "us", "our"). This policy explains how we collect, use, store, disclose and protect personal information when you use our website and application (the "Service").

We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. The two roles we play

Businesses use Muster to manage their own workforces. For information about a customer’s own staff and operations that the customer enters into the Service, the customer is responsible for that information and Muster acts as a service provider that processes it on the customer’s behalf and under its instructions.

For information about our direct account holders (the people who sign up and administer an account), Muster is responsible as described in this policy. If you are an employee of a business that uses Muster, please contact that business about its own privacy practices.

3. Information we collect

Depending on how the Service is used, we may collect:

• Account and profile information: your name, email address and role, and — if you sign in with Google — your Google account email and basic profile.
• Workforce and operational data entered by customers: employee names and contact details, roles, certifications and licences, rosters, shifts, timesheets, leave, pay and cost rates, jobs, purchase orders, suppliers, customers and invoices.
• Files you upload, such as timesheets, receipts and documents.
• Payment information: subscription and billing details. Card payments are handled by our payment provider (Stripe); we do not store full card numbers.
• Technical information: log data, device and browser information, and cookies needed to keep you signed in and operate the Service.

4. How we use information

We use personal information to provide, operate, secure and improve the Service; to authenticate and manage sign-in; to process subscriptions and billing; to provide support; to send service-related communications; and to comply with our legal obligations.

We do not sell personal information, and we do not use it for advertising.

5. Signing in with Google

If you choose to sign in with Google, we receive your Google account email address and basic profile information solely to create and authenticate your account.

Muster’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising and do not transfer it to others except as needed to provide the Service to you.

6. Disclosure and service providers

We share personal information only with service providers that help us operate the Service, under confidentiality obligations, including:

• Supabase — database, file storage and authentication hosting.
• Vercel — application hosting.
• Stripe — subscription and card payment processing.
• Xero — accounting integration, where you choose to connect it.
• Google — sign-in, where you choose to use it.
• Resend — transactional and notification email.

7. Where your data is stored

Our primary database and files are hosted in Australia (Sydney region). Some of the service providers listed above may process limited data outside Australia; where they do, we take reasonable steps to ensure it is handled with protections consistent with the APPs.

8. Data retention

We retain personal information for as long as your account is active and as needed to provide the Service, and afterwards for any period required to meet legal, tax, accounting or dispute-resolution obligations. When it is no longer needed, we delete or de-identify it.

9. Security

We use technical and organisational measures to protect personal information, including encryption in transit, access controls, and tenant isolation so that each business’s data is kept separate from every other business’s data. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident.

10. Your rights

You may request access to, or correction of, the personal information we hold about you. Account holders can also update much of their information directly within the Service.

If you have a concern about how we handle personal information, please contact us using the details below. You may also lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

11. Cookies

We use only the cookies necessary to keep you signed in and to operate the Service. We do not use advertising or third-party tracking cookies.

12. Children

The Service is intended for business use and is not directed at children. We do not knowingly collect personal information from anyone under 16.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and change the "Last updated" date shown above.

14. Contact us

If you have any questions or requests about this policy or your personal information, contact us at privacy@musterco.com.