Privacy Policy

1. Who this covers

This policy explains how Choice Sushi Marsden Pty Ltd, trading as BraidHQ, handles personal information. We handle personal information in line with the Australian Privacy Principles.

2. Two kinds of people

• Operators and their team — the business owners, admins and managers who use the dashboard.
• Staff — people the business rosters, clocks and pays through BraidHQ. The business is your employer and decides what is collected and why; BraidHQ processes that information on the business's behalf. Questions about your own record go to your employer first; we will help either of you.

3. What we collect

• Account details: name, email address, mobile number, sign-in provider (Google or Microsoft) and security settings.
• Staff records entered by the business or by you in onboarding: name, contact details, date of birth, emergency contact, employment type and position, availability, leave and shifts, right-to-work details, and pay details. Sensitive fields — tax file number, bank account details, superannuation member number and passport number — are encrypted in our database with keys held separately, and are shown only to people the business has authorised.
• Documents: medical certificates attached to leave requests and supplier invoices uploaded or emailed in.
• Time and attendance: clock-in and clock-out times from the staff app or the store kiosk. We do not collect location or photographs at the clock.
• Technical: the device and browser used to sign in, the time of sign-in, and server logs kept for security.

4. Why

To run the service the business has asked for (rostering, attendance, pay, invoices, takings, reports); to secure accounts (sign-in codes, device sessions, fraud checks); to send the messages the service needs (sign-in links, roster and leave notices, invoice alerts); and to meet legal obligations. We do not sell personal information and do not use it for advertising.

5. Where it lives and who helps us process it

• Database and file storage: Supabase, in the Sydney (ap-southeast-2) region — your records stay in Australia at rest.
• Application hosting: Vercel, in the Sydney (syd1) region.
• Invoice reading: when a supplier invoice is uploaded or emailed in, its image or PDF is sent to Anthropic (USA) to read the lines. Only the invoice is sent — never staff records.
• Email: Resend (USA). SMS: Twilio (USA). Each receives only the address or number and the message.
• Sign-in: Google or Microsoft, when you choose them; they tell us your email address and that you signed in.
• Billing (from launch): Stripe. We never see your full card number.

These providers act on our instructions, under their own security commitments. Because some of them are outside Australia, some information is disclosed overseas as described above.

6. Keeping it safe

Encryption in transit and at rest; the sensitive fields above encrypted a second time in the application; role-based access so a manager sees only their stores; multi-factor authentication for operators; device sessions that expire (staff app 90 days, kiosk 365 days); a full audit trail of financial and attendance changes; daily backups. No system is perfectly secure — if a breach is likely to cause serious harm we will notify affected people and the OAIC as the Notifiable Data Breaches scheme requires.

7. How long

For as long as the business's account is open, and afterwards as the business instructs or the law requires (employment and tax records commonly seven years). When an account is closed we delete or return the data on the business's request; backups roll off on their own schedule (7 daily backups).

8. Your rights

You can ask to see or correct personal information we hold about you — staff should ask their employer, who can do it in BraidHQ; anyone can also write to support@braidhq.net. We answer within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

9. Cookies

BraidHQ uses only the cookies needed to keep you signed in and secure. No advertising or analytics cookies.

10. Changes

We will post changes here with a new date and tell operators by email before they take effect.