Reparo is a maintenance-management app for hospitality businesses, built and operated by Timothy Short trading as Ordo Operis (Australia) ("Reparo", "we", "us"). This policy explains what information we collect through the Reparo mobile app and web dashboard (together, the "Service"), why we collect it, who we share it with, and the choices you have.
If you're a hotel or venue's staff member (owner, manager, cleaner, or maintenance worker), or a guest reporting an issue via a QR code, this policy applies to you.
1. Information we collect
Staff accounts
When your organisation signs up or invites you, we collect your name, email address, and a password (which we never store in plain text — see Security below). We also store your assigned role (for example owner, manager, reception, cleaner, or maintenance) and which buildings, floors, or rooms you're responsible for. We do not collect your phone number or home address.
Rostering and working-time information
If your organisation uses Reparo's roster, we store the information it enters or generates about your work:
- Shifts — dates, start and end times, unpaid breaks, the area of work, notes, whether a shift has been published to you, and whether you confirmed or declined it; shift swaps and open shifts you claim.
- Employment details your employer chooses to add: your employment type (full-time, part-time or casual) and, optionally, your date of birth. Date of birth is only used to apply working-time limits for workers under 18 (where those rules are included for the building's location or added by your organisation). Only owners, admins and managers of your organisation can see these.
- Pay rate, if your employer enters one, and any weekend, public holiday, overtime or other pay rates that apply to you, used only to estimate labour cost and, if a manager chooses to fill open shifts by lowest cost in Fill for me, to rank those suggestions. Your organisation's owner and admins can see and set it. They can also let other managers (for example building managers) see or set pay for staff in their own buildings; nobody can see their own pay this way, and nobody below them can see theirs.
- Labour-rule records — when a shift is saved, claimed or swapped despite breaking a working-time rule, we record which rule, who did it, their role, when, and any reason they gave. These records exist so your employer can show how rostering decisions were made.
- The country and region of each building (worked out from its timezone, or set by a manager), used to pick the working-time rules and public holidays that apply.
- Time off and availability — leave you request (type, dates, an optional note), whether it was approved and by whom, times you've said you can't work, and a leave balance your employer may keep for you.
- Sick calls — if you call in sick for a shift from the app, we record that you did, for which shift, when, and any note you choose to add. You don't have to give a reason or any medical details, and we ask you not to. Your managers see it so they can approve it and cover the shift.
- Shift preferences — hours per week you'd like, the kinds of shifts you prefer, and whether you'd like more hours, if you choose to tell your manager.
- Shift offers and briefings — shifts you put up for colleagues to take (with any note you add), shifts you take, who was asked to cover a shift, any extra pay offered for it, and notes a manager adds to a shift.
- Clock in and out — if your employer uses it: when you clock in, start and end breaks, and clock out, any note you add, and any corrections a manager makes (who and when). These form your timesheet, which your managers review and approve for pay.
- Reminders and calendar sync — whether you want shift reminders, and, if you turn on calendar sync, a private link that lets your calendar app read your published shifts.
- Qualifications your employer records for you (for example first aid or RSA): which ones, when they expire, an optional certificate number, and a link to the certificate if it's filed in your organisation's compliance documents. They decide which shifts you can be rostered on or pick up, and you and your managers get a reminder before one expires.
- Contracted hours a week, if your employer enters them, shown against your rostered hours.
- Payroll details — your employee or card ID in your employer's payroll system, if they enter it, and the approved clock times your employer exports for payroll. Pay periods your employer has closed are recorded with who closed or reopened them and why.
- Missed clock-ins — if your employer uses clock-in and you haven't clocked in after your shift starts, we send you a reminder and then tell the managers who approve timesheets. If you tell the app you're running late, we keep the time you said you'd arrive.
Location when clocking in
Your employer can choose to require that staff are at work to clock in. Only then, when you tap Clock in, the app asks your phone for its current location (your phone asks your permission first) and sends it to us once. We compare it with the building's location and keep only how far away you were, in metres — we don't store your coordinates, and we never track your location in the background or at any other time. If you say no, you won't be able to clock in from the app; ask your manager to add your hours instead. An owner or admin may also save each building's location, which isn't information about you.
Widgets on your phone
If you add Reparo's Next shift widget to your lock screen or home screen, the app saves your upcoming shift times, areas and building names on your phone so the widget can show them. This stays on your device and isn't shared with anyone — but anyone who can see your lock screen can see what the widget shows. Remove the widget to stop it; signing out clears it.
Guest reports (QR code)
Guests can report a maintenance issue by scanning a room QR code — no account or sign-up is required. We only collect what you choose to submit: a description of the issue, an optional photo, the room the report relates to, and, only if you provide it, an email address so we can send you a link to check your report's status. We never ask guests for their name.
Photos
Photos attached to a maintenance issue (by staff or by a guest) are stored so the report can be reviewed and resolved. Photos are stored privately and are only ever accessed via short-lived, expiring links — they are never made permanently public.
Profile photos are optional. If you add one, everyone in your organisation can see it next to your name. We shrink it to a small square image and remove its hidden details (such as the location and camera information phones add to photos) before storing it. It is served from a private, unguessable link that changes whenever you change or remove the photo, and it is deleted when you remove it or delete your account.
Vendor/contractor details
If your organisation adds a maintenance vendor or contractor to Reparo, we store the name, trade, phone number, and email address that your organisation enters for that vendor.
Two-factor sign-in and signed-in devices
If you turn on two-factor sign-in (Account → Two-factor sign-in), we store the key your authenticator app uses, encrypted, and your recovery codes only as scrambled (hashed) copies. We use them only to check the codes you enter when you sign in.
For each active sign-in session, we also keep a short device or browser description (for example "iPhone · iOS" or "Chrome on Mac") and when that session was last used, so you can review your active sessions and sign out of any other device in the app (Signed-in devices).
Team chat, shift handovers, noticeboard, and building compliance
We store the messages, photos, and files you and your colleagues post in team chat, shift handover notes, noticeboard posts (including who has read or acknowledged a notice), and building-compliance records (uploaded certificates and who completed a recurring safety or maintenance check and when). When someone posts a web link in team chat, our server fetches the public title, summary, and preview image from that webpage to display a link preview; no information about you or your organisation is sent to that website.
Workplace safety, duress alerts, lone-worker check-ins, and key register
If your organisation uses Reparo's workplace safety features, we store:
- Incident, near-miss, and hazard reports — what happened, when and where, how serious, who reported it, anyone listed as involved or hurt, whether first aid or emergency services were used, and the manager's follow-up notes, controls, and regulator-notification reference. Please only enter the minimum personal or injury details your employer needs for its workplace health and safety obligations.
- Duress alerts and lone-worker check-ins — when you trigger a duress alert or start, complete, or miss a working-alone check-in (how often and when you last checked in, never your location), the building, any optional message you add, and who acknowledged and closed the alert. A duress alert or a missed check-in is sent at once to your organisation's safety contacts, even during their quiet hours.
- Chemicals, emergency info, fire wardens, and key register — your organisation's chemical register and emergency information, whether your employer has listed you as a fire warden for a building (shown alongside whether you're currently on shift), and records of keys or access cards issued to, returned by, or reported lost by staff or contractors.
API keys and outbound webhooks
If your organisation's owner or admin creates an API key or configures an outbound webhook (for example to connect a property management system), Reparo sends and receives the relevant operational records (such as room or bed readiness status) to and from the external system your organisation configured, on your organisation's instructions.
Support conversations
You can message Reparo support from inside the app (Help → Contact support, or "Need help signing in?" on the sign-in screen). We reply in the app. You can also email support@reparoapp.net (for example for a privacy request, or if you can't sign in); we keep those emails in our support mailbox while we deal with your request and for up to 12 months after it's resolved.
- What we keep: your messages, any screenshots you add, the topic you chose, and technical details the app adds so we can help (app version, platform such as iOS or Android, and the operating system version). We never ask for your password.
- If you're signed in, the conversation is linked to your account, so we also see your name, email, role, organisation and its plan.
- If you're signed out, the conversation is linked to the phone or browser you used. The app keeps a random key in secure storage on that device; our servers only keep a scrambled (hashed) copy of it. We keep the name you give us and, if you choose to give it, the email you sign in with — only so we can find your account, never to email you. If you later sign in on that device, the conversation moves to your account. A name or email typed into a signed-out conversation doesn't prove who someone is, so support won't change an account because of one; we'll point you to "Forgot password" or your organisation's manager instead.
- Screenshots are shrunk and have their hidden details (such as location and camera information) removed before we store them. They're stored privately and only shown through short-lived links. Please crop out anything private first.
- Who sees it: only Reparo support staff whose admin role includes the support inbox. Support can add internal notes to a conversation that you don't see. Your organisation doesn't see your support conversations.
Push notification token
If you enable notifications, we store a device push token so we can send you alerts (e.g. a new issue assigned to you, or a reply from Reparo support). This token identifies your device for notification delivery only. If you're signed out and allow notifications for a support conversation, we keep that device's token with the conversation so we can tell you when we reply.
Billing information
If your organisation subscribes to a paid plan, payment is handled entirely by our payment processor, Stripe. Reparo's servers never see or store your card details — we only keep a reference ID linking your organisation to its Stripe customer/subscription record.
Biometric login (Face ID / fingerprint)
If you enable Face ID or fingerprint sign-in, this is handled entirely by your device's operating system. Reparo never receives, transmits, or stores any biometric data — we only receive a yes/no result from your device confirming the check succeeded.
Usage and activity logs
To keep your organisation's data secure and auditable, we log account activity such as sign-ins, issue status changes, and comments, associated with the staff member who performed them.
App diagnostics
If the Reparo app hits an error, it sends us an error report: the error message and technical trace, the screen you were on, your device platform (iOS, Android or web), the app version, and — if you're signed in — your organisation and user ID, so we can find and fix the problem. We don't put your password, photos or the content of your records in error reports, and they're deleted after 90 days. Apple and Google may also share anonymous crash reports with us if you've allowed that in your device settings.
2. How we use your information
- To operate the Service — creating and tracking maintenance issues, assigning staff, and keeping your organisation's team in sync.
- To send you account-related emails (password resets, team invitations) and, if you're a guest, a confirmation of your report.
- To send push notifications you've opted into (e.g. a new assignment, an urgent issue, or a reply from support).
- To answer your support requests, and to find and fix the problem you've told us about.
- To process subscription billing, via Stripe.
- To maintain the security of the Service (e.g. rate-limiting, fraud prevention, audit logging).
- To run your organisation's roster — publishing shifts, confirmations, swaps and open shifts — and to check shifts against the working-time rules for the building's location and your organisation's own rules, showing warnings to managers and staff.
- To handle time off, sick calls and leave balances, and to keep timesheets from clock times so your employer can check and pay the hours worked.
Automated labour-rule checks (automated decisions)
Reparo automatically compares shifts with working-time rules for the building's location (for example rest between shifts, weekly hours, breaks, and limits for workers under 18) and with any rules your organisation adds.
- Information used: your shifts (dates, times, breaks), your role, and — only if your employer has entered them — your date of birth and employment type.
- Decisions it can make: depending on settings chosen by your organisation's owner, the check can stop you claiming an open shift, accepting or requesting a swap, or stop a manager saving a shift, where that would break a rule. Otherwise it shows a warning and records who chose to go ahead.
- Human review: the rules and settings are chosen by your employer, and rostering decisions about you are made by your employer, not by Reparo. If you think a check has wrongly affected you, ask your manager — they can review the roster — or contact us.
Public holidays are calculated on our servers from a bundled data set; no information about you is sent to anyone to do this.
Roster suggestions
Some tools suggest rather than decide: Fill for me proposes who could take open shifts, Find cover ranks who could take a shift, and the fairness and who's free views summarise how shifts are spread. They use your shifts, time off, availability, labour-rule limits and the preferences you've shared. A manager always reviews a suggestion before anything changes. These suggestions don't use your pay rate except when a manager with permission to see pay chooses the "lowest cost" option in Fill for me; your age only counts where the rules for the building's location (or rules your organisation adds) set stricter limits for workers under 18, and only if your employer has entered your date of birth. Timesheets flag differences between rostered and clocked times (for example late or left early) for a manager to review — they don't change your pay by themselves.
The roster also suggests people for a shift as a manager writes it, shows where the week falls short of the organisation's minimum staffing, and estimates housekeeping hours from the number of check-outs, stayovers and arrivals (counts only, not who the guests are). These are suggestions for a manager to act on.
Roster assistant (optional, uses Anthropic's AI)
If your organisation's owner turns it on (it's off unless they do), managers can ask the roster assistant questions such as "who can cover Tuesday's late shift?". To answer, Reparo sends Anthropic (the company that makes the Claude AI model) the roster details for the building being asked about: people's names and roles, shifts, rostered, contracted and preferred hours, whether someone wants more hours, qualifications, time off and availability, staffing gaps, and labour-rule limits a change would break, together with the manager's question. It does not receive pay rates, dates of birth, employment type, contact details or clock-in locations. The assistant can only suggest changes; a manager reviews and applies each one, and nothing reaches staff until it's published. Reparo doesn't store the conversation, only how many questions were asked and how much processing they used. Anthropic processes the data under its commercial terms, which don't allow it to train its models on it. The owner can turn the assistant off at any time.
Legal bases (EEA, UK and similar laws)
Where laws such as the GDPR or UK GDPR apply to our own processing, we rely on: performance of our contract with your organisation to provide the Service; our legitimate interests in securing, supporting and improving the Service (for example audit logs and error monitoring); legal obligations (for example tax records and responding to lawful requests); and consent where we ask for it (for example push notifications, which you can switch off at any time). For staff information we process for an organisation, the organisation decides the legal basis — see below.
Who is responsible for staff information
For information about staff that an organisation puts into Reparo (including rostering, employment and pay details), the organisation is the controller and Reparo processes it on the organisation's behalf and instructions to provide the Service, under our Data Processing Addendum. Your employer is responsible for having a lawful basis to use it (for example, meeting its employment-law obligations) and for telling you about it. Requests about that information are best made to your employer; we'll help them respond.
We do not use your information for advertising, and we do not sell your information to third parties. Reparo does not include any advertising or analytics/tracking SDKs.
3. Who we share information with
We share information only with the service providers necessary to run Reparo, and only to the extent needed:
| Provider | Purpose | What they receive |
|---|---|---|
| Stripe | Subscription billing | Billing/contact details you provide directly to Stripe's checkout; Reparo only holds a customer/subscription reference ID. |
| Resend | Transactional email | Recipient email address and the email content (e.g. a password reset link, invite, or report confirmation). |
| Cloudflare | File storage (R2); bot check on the guest report page (Turnstile); delivering email sent to support@reparoapp.net (Email Routing) | Files you or your organisation upload (photos, documents, chat attachments, support screenshots), stored privately. On the guest report page, the bot check sees technical details of your browser and connection. Email you send to our support address passes through it on its way to our mailbox. |
| Google (Gmail) | Our support mailbox | Email you send to support@reparoapp.net, and our own service alerts (for example a new organisation's name and owner email, or a technical error). |
| Fly.io | Application hosting (Sydney, Australia) | All data described in this policy passes through our servers there. |
| Supabase | Database hosting (Sydney, Australia) | All data described in this policy is stored in our database there. |
| Expo | App updates and push notifications | Your device's push token and the notification text. |
| Anthropic | Roster assistant (AI), only if your organisation's owner turns it on | The roster details for the building a manager asks about and the manager's question, as described in section 2. Not pay, dates of birth, employment type or contact details. |
We may also disclose information if required by law, or to protect the rights, property, or safety of Reparo, our customers, or others.
If your organisation's plan changes ownership or Reparo is involved in a merger or acquisition, your information may be transferred as part of that transaction, subject to this policy.
4. Where your information is processed
We're based in Australia. Our servers and database are in Sydney, Australia. Some of our service providers (for example Stripe, Resend, Expo, Cloudflare, Google and, if the roster assistant is on, Anthropic) process data mainly in the United States, and may also use facilities in other countries where they operate (including the European Union, the United Kingdom and Australia). When we transfer personal information across borders we take reasonable steps to make sure it stays protected — including using providers bound by contractual data-protection commitments, and, for data from the EEA, UK or Switzerland, the Standard Contractual Clauses (and UK Addendum) or another lawful transfer mechanism such as the EU–US Data Privacy Framework where the provider is certified.
5. Data retention and deletion
| Information | How long we keep it |
|---|---|
| Your organisation's records (issues, rosters, labour-rule records, notices, chat) | While the organisation's account is active. When an organisation's deletion is processed, personal details are anonymised straight away; the anonymous operational records remain. |
| An account you delete yourself | Personal details erased immediately (no recovery period); anonymous work records remain with your organisation. |
| A removed team member's recovery data | 90 days (so they can be restored), then name, email, date of birth, employment type and pay rate are erased. |
| Guest report email addresses | With the report, for as long as the organisation keeps its records. |
| Clock times and timesheets | With your organisation's roster records while its account is active. If you delete your account, your notes and the distance recorded at clock-in are erased; the times stay with your employer's records against an anonymous identity. |
| Time off, sick calls and leave balances | With your organisation's roster records. If you delete your account, notes on your requests are erased and times you said you can't work are deleted. |
| Qualifications, payroll ID and contracted hours | While you're part of the organisation. Deleted when you delete your account, 90 days after you're removed from the organisation, or when the organisation is deleted. |
| Roster assistant | Reparo keeps only a count of questions and the processing used, with the organisation's records. The questions, answers and the roster details sent aren't stored by Reparo. |
| Location at clock-in | Your coordinates are not stored. The distance from the building is kept with the clock-in until the account or organisation is deleted. |
| App error reports | 90 days. |
| Safety records | With your organisation's records while its account is active; employers often have to keep incident records for years under work health and safety law. Names typed into safety reports and key loans are erased when the organisation is deleted. Working-alone check-ins and fire-warden roles are deleted when you delete your account. |
| Support conversations | Deleted automatically 12 months after the last message, or sooner if you ask us or support deletes it. Deleting your account deletes the conversations linked to it. |
| Emails to support@reparoapp.net | Kept while we deal with your request and for up to 12 months after it's resolved, then deleted. |
| Support screenshots | Deleted automatically 90 days after the conversation is closed (the conversation itself stays until it's deleted as above). |
| A signed-out device's support key | Deleted after 12 months without use once it has no conversations left. |
| Files no longer used | When a file isn't attached to anything any more — an upload that was never saved, a photo removed from a job, or files of a deleted organisation — it's deleted automatically, usually within about a week. |
| Security and activity logs | As long as needed to secure the Service and investigate problems, and for the life of the organisation's account where they form part of its audit trail. |
| Billing references | As long as tax and accounting law requires (generally 5–7 years). |
We retain your information for as long as your organisation's account is active, and afterwards for as long as reasonably necessary for record-keeping, dispute resolution, and legal compliance. Roster records, including labour-rule records, are kept as part of your organisation's records because employers often need them to show working-time compliance.
When a team member is permanently removed, or an organisation is deleted, their date of birth, employment type and pay rate are erased along with their name and email; shift history is kept against an anonymous identity. A data export by your organisation (its owner can download one in the app, or ask us) includes roster records but never passwords or device tokens.
You can delete your account yourself, at any time, in the app (Manage → Account & settings → Delete account for managers, or Profile → Delete account for staff), on iPhone, Android or the web; step-by-step instructions are at reparoapp.net/delete-account. Deletion takes effect immediately and can't be undone: your name, email, password, date of birth, employment type, pay rate, shift preferences, calendar link, notifications and sign-in sessions (including signed-in device labels) are erased, your future shifts are unassigned, and you can no longer sign in. Work records your organisation may need to keep (issues, past shifts, handovers, chat messages, compliance check logs) stay in its history but are attributed to "Deleted user", not to you. If you're an organisation's only owner, you can hand the organisation to another member first or delete the whole organisation, which also cancels its subscription. If you can't sign in, email support@reparoapp.net from your account's email address and we'll complete the deletion within 30 days.
6. Security
We take reasonable technical and organisational measures to protect your information, including:
- Passwords are hashed (never stored in plain text) using industry-standard bcrypt hashing.
- New passwords are checked against passwords exposed in known data breaches (the Have I Been Pwned service). Only the first five characters of a one-way fingerprint of the password are sent, never the password itself, and nothing that identifies you.
- Sign-in sessions use short-lived access tokens with separately stored, rotating refresh tokens. You can add two-factor sign-in to your account.
- All traffic between the app and our servers is encrypted in transit (HTTPS/TLS), and our web pages only run code from Reparo's own servers, plus Cloudflare's bot check on the guest report page (a Content Security Policy).
- Access to your organisation's data is restricted to members of that organisation and authorised Reparo support staff. Within your organisation, what each person can see and do is set by your organisation's permissions.
- More detail, and how to report a security problem: reparoapp.net/security.
- Every Reparo support account must sign in with two-factor sign-in, and can only use our admin tools from the Reparo app or reparoapp.net. Each account can only use the parts of those tools its role allows (for example the support inbox, or looking up an organisation), and every action is logged. Deleting a file your organisation still uses needs a senior permission and a reason, and shows in your organisation's activity log.
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
7. Cookies and local storage
Reparo uses one cookie and no third-party tracking. The mobile app stores your sign-in session securely on your device using your device's secure storage (Keychain on iOS, Keystore on Android). On the web, your sign-in is kept in a single strictly necessary cookie (reparo_rt) that only Reparo's sign-in service can read: scripts on the page can't, and other websites can't use it. It lasts up to 30 days and is removed when you sign out. A short-lived part of the sign-in is kept in the browser tab's session storage. If you add a Reparo widget, your upcoming shifts are stored on your phone for it (see "Widgets on your phone"). If you start a support conversation while signed out, the app keeps that conversation's random device key in the same secure storage (or the browser's local storage). None of this is shared with third parties.
8. Children's privacy
Reparo is intended for use by hospitality business staff and their guests, and is not directed at children. An organisation may give an account to a worker under 18 who is old enough to work where they are; the organisation is responsible for that, and may record their date of birth so working-time limits for young workers (where included for the building's location or added by the organisation) are applied. We do not knowingly collect personal information from children under 13 (or the higher minimum age where you live). Guest issue reports do not require a name or any identity information, and can only include an email address if the guest chooses to provide one. If you believe a child has provided us with personal information, contact us at support@reparoapp.net and we will delete it.
9. Your rights
You can ask to access or correct the personal information we hold about you, and depending on where you live you may also have rights to request deletion, to object to or restrict certain processing, to data portability, and to withdraw consent. Many details (your name, email, notification settings) you can change yourself in the app; your employer can correct roster and employment details.
To make a request, message us in the app (Help → Contact support) or email support@reparoapp.net. We'll confirm your identity, respond within 30 days, and won't charge you for a reasonable request. If the information is held for your employer (see "Who is responsible for staff information"), we'll pass your request to them and help them respond. If we refuse a request we'll explain why.
Complaints
If you have a concern about how we handle your information, contact us first in the app (Help → Contact support) or at support@reparoapp.net — we aim to respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au), or, if you're in the EEA or UK, to your local data protection authority or the Information Commissioner's Office (ico.org.uk).
Data breaches
If a data breach is likely to result in serious harm, we'll notify affected organisations and individuals and the relevant regulator (including under Australia's Notifiable Data Breaches scheme) as the law requires. Where we process information for an organisation, we'll tell that organisation without undue delay so it can meet its own obligations.
10. Changes to this policy
We may update this policy from time to time. If we make material changes, we'll update the "Last updated" date above. Continuing to use Reparo after a change means you accept the updated policy.
11. Contact us
Questions about this policy or how we handle your information? Message us in the app (Help → Contact support, or "Need help signing in?" on the sign-in screen), or email support@reparoapp.net.