Privacy Policy
Last updated: May 2026 (v3.0)
This Privacy Policy explains how Oraoki ([ABN]) ("Oraoki", "we", "us", or "our") collects, holds, uses, and discloses personal information when authorised users access the Oraoki web app, mobile app, and related services (the "Services").
Oraoki is an all-in-one rostering, housekeeping, maintenance, inspection, and messaging platform for hostels and other accommodation providers. The Services are intended for authorised staff, contractors, managers, and administrators of participating properties.
This policy is written for App Store review and for Australian users. We aim to handle personal information consistently with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Notifiable Data Breaches scheme where those laws apply to us.
Who this policy covers
This policy covers staff and other authorised users of organisations that use Oraoki. The Services are not directed to children under 13, and we do not knowingly collect personal information from children.
In many cases, your employer or the property operator controls the operational data entered into Oraoki. If you are a staff member, your organisation may also have its own privacy or employee records policy.
What personal information we collect
The information we collect depends on the features your organisation enables and your role.
- Account and access information: name, username, email address, role, organisation, permissions, staff code status, password/PIN material stored as hashes, session identifiers, and device identifiers used for sign-in and security.
- Rostering and shift information: schedules, shift assignments, areas, attendance, sign-in/sign-out events, and related staff availability or allocation records.
- Housekeeping and room operations: room status, cleaning progress, bed count requests, task notes, inspection results, and operational comments.
- Maintenance information: maintenance tickets, issue descriptions, priorities, status updates, comments, and related photos or attachments.
- Messages and collaboration content: internal team messages, message metadata, acknowledgements, quick replies, and attachments.
- Guest-related operational data: guest names, room numbers, dates, and notes where your organisation enters them for housekeeping, maintenance, or operational purposes.
- Photos and media: images or files you attach to room reports, inspection reports, maintenance tickets, messages, or similar records.
- Notification information: push notification tokens, device platform, subscription status, and delivery metadata needed to send operational alerts. Apple Push Notification service (APNs) or Google Firebase Cloud Messaging (FCM) may process device tokens to deliver notifications.
- Technical and security information: IP address, browser or app version, device type, timestamps, audit logs, error diagnostics, and security events.
We do not sell personal information. We do not use advertising networks or behavioural advertising SDKs in the mobile app. We do not use personal information for third-party tracking.
How we collect and hold information
We collect information when:
- you or your organisation creates or updates an account;
- you use the app to manage rosters, rooms, housekeeping, inspections, maintenance, or messages;
- you upload photos or attachments;
- your device registers for push notifications; and
- our systems automatically record security, audit, and diagnostic events.
We hold information in access-controlled systems used to provide the Services. We use technical and organisational safeguards such as HTTPS/TLS in transit, credential hashing, role-based access controls, tenant separation, audit logs, backups, and restricted administrator access. No internet service can be guaranteed completely secure, but we work to protect personal information against misuse, interference, loss, unauthorised access, modification, and disclosure.
Why we use information
We collect, hold, use, and disclose personal information to:
- provide rostering, housekeeping, maintenance, inspection, messaging, and reporting features;
- authenticate users and enforce organisation-level and role-based permissions;
- send operational notifications requested or enabled by your organisation;
- support customer service, troubleshooting, security monitoring, and fraud prevention;
- maintain audit records and comply with legal, employment, tax, safety, and accounting obligations;
- improve reliability, performance, and usability of the Services; and
- respond to lawful requests, enforce our terms, and protect our rights, users, and the public.
Who we disclose information to
We disclose personal information only where reasonably necessary for the Services or where required by law. This may include:
- your organisation and authorised users within your organisation;
- hosting, infrastructure, CDN, security, email, notification, storage, and support providers;
- Apple and Google where needed for app distribution, device permissions, crash or diagnostic handling, and push notification delivery;
- professional advisers, insurers, or regulators where necessary; and
- law enforcement, courts, or government agencies where required or permitted by Australian law.
Current subprocessors
Oraoki may use the following service providers to operate the Services:
- Amazon Web Services - hosting, database, storage, backups, logging, and secrets management.
- Cloudflare - DNS, CDN, security, DDoS protection, and reverse proxy services.
- Resend - transactional email such as account, support, and operational emails.
- Apple - App Store distribution, iOS permissions, and APNs push notification delivery.
- Google / Firebase - Android distribution and FCM push notification delivery where Android is used.
We do not permit subprocessors to use personal information for their own advertising purposes.
Overseas disclosure
Oraoki is operated from Australia and is designed for Australian hostel and accommodation operations first. Some service providers may process or store personal information outside Australia, including in the United States and other countries where AWS, Cloudflare, Resend, Apple, or Google operate infrastructure. Where practicable, we use contractual and technical safeguards intended to protect personal information handled by those providers.
Retention and deletion
We keep personal information only for as long as needed for the purposes described in this policy, unless a longer period is required or permitted by law. Retention periods may depend on your organisation's configuration, the type of record, and legal obligations that apply to employment, tax, safety, accounting, dispute, and audit records.
| Category | Typical retention approach |
|---|---|
| Account credentials and active session data | Kept while the account is active; removed or disabled when the account is closed, except where needed for security, audit, or legal reasons. |
| Rosters, shifts, attendance, and payroll-adjacent records | May be retained for up to 7 years where employment, tax, accounting, or audit obligations apply. |
| Housekeeping, inspection, maintenance, and operational records | Kept for operational, audit, safety, support, and customer record purposes, then deleted or anonymised when no longer required. |
| Guest-related operational notes | Minimised and retained only as long as reasonably needed for property operations, audit, support, or legal purposes. |
| Messages and attachments | Kept according to the organisation's operational needs and legal obligations, then deleted or anonymised when no longer required. |
| Push tokens | Deleted or invalidated when you sign out, disable notifications, close your account, or the token is no longer valid. |
| Backups and logs | Retained for security, reliability, disaster recovery, and audit purposes, then overwritten or deleted according to backup schedules. |
Mobile app users with full user accounts can initiate account closure from
Settings > Account > Delete account. Account closure removes or disables the
account credentials and signs the user out. Some operational records may be retained where
required for legitimate business, employment, safety, tax, accounting, dispute, or legal reasons.
Staff-code-only or organisation-managed accounts may require your organisation's administrator
to action the request.
Access and correction
Under APP 12 and APP 13, you may request access to personal information we hold about you and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant, or misleading. You can start by contacting your organisation's administrator or contacting us at [PRIVACY_CONTACT_EMAIL].
We may need to verify your identity and your relationship with the relevant organisation before responding. If we refuse a request, we will explain why where required by law.
Privacy complaints
If you believe we have breached the APPs or mishandled personal information, contact us at [PRIVACY_CONTACT_EMAIL]. Please include enough detail for us to understand and investigate the issue. We aim to acknowledge privacy complaints within a reasonable time and respond after we have investigated.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner.
Data breaches
If we become aware of a data breach that is likely to result in serious harm, we will assess it under the Notifiable Data Breaches scheme and notify affected individuals and the OAIC where required by the Privacy Act.
Cookies, local storage, and permissions
The web app uses cookies and local storage for authentication, session management, security, preferences, and app functionality. The mobile app may request camera, photo-library, and push notification permissions so you can attach evidence to reports and receive operational alerts. You can manage device permissions in your device settings.
Changes to this policy
We may update this policy from time to time. The "Last updated" date will change when we do. Material changes may also be communicated through the Services or by email where appropriate.
Contact
Legal entity: Oraoki ([ABN])
Privacy contact: [PRIVACY_CONTACT_EMAIL]
Support contact: [SUPPORT_EMAIL]