Infaro Hospitality Privacy Policy

Last updated: 14 July 2026

Infaro Hospitality ("the app", "the website") is a staff-management platform for hospitality venues — rostering, timesheets, leave, HR records, checklists and venue reporting — operated by RGL Loans Pty Ltd (ABN 32 611 969 138), PO Box 391, Fortitude Valley QLD 4006, Australia ("we", "us", "our"). It is available as an iPhone app and at infaro.app. This policy explains what is collected, how it is stored, and who it is shared with. We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Infaro Hospitality is a workplace tool. Accounts are created by the venue that employs you — there is no public sign-up. Much of the information in the app is entered and managed by your employer as part of the ordinary administration of your employment, and your employer decides what is recorded. Where this policy says "your employer", it means the venue business that invited you to the platform and its owners and managers.

Information we collect

Account details: your name, email address, and password (stored securely as a hash, never readable by us), created for you by your employer.
Employment records entered by you or your employer: position, employment type and basis, start date, award classification, pay rates, home address, date of birth, gender, and emergency contact details.
Payroll details needed to employ you in Australia: bank account details, superannuation fund and member number, Tax File Number, and tax declarations (residency, tax-free threshold, study loans). These are collected for payroll administration only, and TFNs are handled in accordance with the Privacy (Tax File Number) Rule 2015.
Work records: rosters and shifts, weekly timesheets (including your answers about shifts worked and wellbeing check-ins), leave requests, checklist activity, HR notes made by managers, and employment contracts generated for you.
Medical certificates: if you choose to attach a certificate to a leave request, it is stored in a private area visible only to you and your venue's managers. This is health information and we treat it as sensitive information under the Privacy Act.
Venue business data: sales information from the venue's Square account and payroll details from the venue's Xero account, where the venue has connected those services.

How the information is used

To operate your account and sign you in.
To run the venue: building and publishing rosters, collecting and reviewing timesheets, managing leave, generating employment contracts, and sending workplace notifications.
To show managers business reporting such as sales against targets and labour costs.

We do not sell, rent, or trade personal information. The app contains no advertising and no third-party tracking or analytics.

Who can see your information

Access inside the app follows workplace roles: venue owners and managers can see the staff records, rosters, timesheets and leave for their business; staff can see their own records and the published roster. Manager-only records (such as HR notes and timesheet review ratings) are not visible to staff. Wages and pay rates are visible only to you and to managers.

Who we share information with

Supabase: our database, authentication and file-storage provider. Infaro Hospitality data is hosted in Supabase's Sydney (Australia) region and protected by row-level security.
Square: where a venue connects its own Square account, we read that venue's sales and catalogue data from Square. We do not send your personal information to Square.
Xero: where a venue connects its own Xero organisation, employee payroll details are synchronised between Xero and the venue's staff records to keep payroll accurate.
Apple: distributes the iPhone app under its own terms.

These providers are not permitted to use the data for any purpose other than providing services to us and the venue. We may also disclose information if required by law.

Data retention and deletion

Employment records are retained while you work at the venue and for the period afterwards that Australian employment and tax law requires records to be kept. To access, correct, or request deletion of your information, ask your venue manager, or contact us directly using the details below and we will respond within a reasonable time.

Security

Data is encrypted in transit and at rest. Access to production systems is restricted, passwords are stored only as secure hashes, medical certificates live in a private storage area, and integration credentials for Square and Xero are stored encrypted.

Children

Infaro Hospitality is a workplace tool for venue staff and is not directed at children under 13. Accounts exist only for people employed or engaged by a venue.

Changes to this policy

If we make material changes to this policy we will notify you with a notice in the app or on the website.

Contact

Questions about privacy can be sent to roberto@rglloans.com.au, or by post to RGL Loans Pty Ltd, PO Box 391, Fortitude Valley QLD 4006, Australia. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).