Privacy policy

What personal information WeRoster collects, how we use it and how we keep it safe.

Last updated 22 October 2026 (rewritten to describe exactly how WeRoster handles personal information today). First published 5 August 2016.

Who we are

WeRoster ("WeRoster", "we", "us" or "our") is operated by JCK XYZ LTD, a company registered in the United Kingdom. Most of our customers are businesses in New Zealand.

This policy explains what personal information WeRoster collects, why, who we share it with, and the choices and rights you have. It is written to meet the New Zealand Privacy Act 2020 and, because we are a UK company, the UK GDPR and the Data Protection Act 2018.

For account, billing and website information, JCK XYZ LTD is responsible for your information (the "controller" under UK law). For information about staff that an employer enters into WeRoster, we act on behalf of that employer. See if your employer uses WeRoster below.

We have not appointed a data protection officer. Questions go to Jack at [email protected].

What we collect

Your account

When you sign up, or when an employer adds you as a staff member or manager, we store:

your first and last name, email address and, if you add it, phone number;
your password, stored only as a one-way hash (we can't see it);
whether you have verified your email address, the date you signed up and when you were last active;
your settings, such as whether you want shift reminder emails;
a four-digit clock-in PIN if your employer uses the clock-in terminal, stored only as a one-way hash;
if you signed up through a referral link, which account referred you.

Information employers enter about their staff

Owners and managers use WeRoster to run their workplace, so they enter and manage information about their team, including:

staff names, email addresses, phone numbers and a display nickname;
pay rates and contracted hours;
rosters: who is working when, in which role, at which store;
availability that staff submit;
leave requests, including the type of leave, dates, any reason given and the manager's response;
worked shifts: clock-in and clock-out times, breaks, the job worked and any comments, whether recorded on the clock-in terminal or in the app;
messages posted to a store's timeline and announcements sent to staff;
store details such as name, location, opening hours, time zone, expected sales and a terminal PIN (also stored only as a one-way hash).

Please only enter what your team needs. For example, a leave reason doesn't need to include health details.

Billing

Subscriptions are paid by card through Stripe. You type your card details into Stripe's secure form, so they go straight to Stripe and never reach our servers. We keep the Stripe customer and subscription IDs, your plan, trial dates, and the card brand and last four digits so we can show you which card is on file.

Usage and technical information

Our hosting and network providers record standard request information such as your IP address, browser, the pages you request and when.
For debugging, our application records errors, failed requests and background jobs, scheduled tasks and slow database queries, with passwords, PINs and security tokens removed, and deletes these records after about a day.
When something breaks, we send an error report to Sentry (see below).
On our website and in the app, analytics and advertising tools collect information about how you use them (see cookies and analytics).

Communications

If you email us, use the contact form or send feedback from inside the app, we keep your message, your name and email address and our reply so we can help you. You can send in-app feedback anonymously.

Ros, our AI assistant

Ros answers questions about WeRoster on our website and inside the app. When you chat with Ros, we send the AI model the last 20 messages in the conversation and the page you're on. If you're signed in, we also send your name, your account type (owner, manager or staff), your stores and your roles.

Ros finds answers in our public help articles. To search them by meaning, the help articles and the short search phrase Ros writes to look up an answer (based on your question) are also sent to DigitalOcean serverless inference to be turned into embeddings. That doesn't include your account details or anything Ros looks up in your account.

Ros can look things up in your account to answer you. What it looks up is sent to the AI model too, and is limited to what your role already lets you see. For owners and managers this can include pay rates, staff email addresses, wage totals, leave and availability.

We keep each conversation so you can carry on where you left off. It is linked to your account, or for visitors to a scrambled (hashed) session ID, and deleted automatically 12 months after its last message. Jack, as the site administrator, can read conversations to fix problems and improve Ros. If you ask Ros to pass you on to support, the conversation is emailed to [email protected].

How we use it

To provide WeRoster: building and sharing rosters, availability, leave, timesheets, exports (PDF, spreadsheet and calendar feeds), the clock-in terminal and announcements.
To send service emails: email verification, password resets, welcome emails, roster published and changed notices, new leave requests for managers, leave request outcomes, announcements from your manager and subscription changes.
To take payment and manage your subscription, including applying a referral discount.
To answer support requests and feedback, including through Ros, our AI assistant.
To keep WeRoster secure and working: preventing abuse, finding and fixing errors.
To understand how people use our website and app, and to measure whether our advertising works.
To keep the business records we are required to keep by law.

We don't sell personal information, and we don't use it to make automated decisions that have legal or similarly significant effects on you. We don't send marketing newsletters from WeRoster; if we ever do, they will only go to people who have agreed and will include an unsubscribe link.

Legal bases (UK GDPR)

If UK data protection law applies to you, we rely on these legal bases:

Contract: to provide the account and subscription you signed up for, and to take payment.
Legitimate interests: to keep the service secure and reliable, fix errors, provide support, understand how the website is used and measure our advertising. We balance these against your rights, and you can object at any time.
Legal obligation: to keep tax and accounting records and to respond to lawful requests.
Consent: where we ask for it. You can withdraw consent at any time.

For staff information entered by an employer, the employer decides the legal basis, and we process it on their instructions.

We use the following service providers to run WeRoster. They only get the information they need to do their job for us.

DigitalOcean (United States): hosts our application server and database, including database backups. All WeRoster data is stored here, in DigitalOcean's San Francisco region.
Laravel Forge (United States): the tool we use to manage and deploy our server. It has administrative access to the server.
Cloudflare (United States, global network): all traffic to weroster.co.nz passes through Cloudflare for security and performance, and it also serves the icon font our pages use.
Stripe (United States): card payments, subscriptions and invoices. Stripe receives your card details, billing email and payment history.
Postmark (United States): sends our emails, so it processes the recipient's name and email address and the email's content (for example a roster or leave outcome).
Google Workspace (United States): our support mailbox, where emails and contact form messages arrive.
DigitalOcean serverless inference: runs the AI model behind Ros (GLM-5.2) and the embeddings for its help search. It receives what we send to answer each message, the public help articles and Ros's search phrases, described under Ros, our AI assistant.
Sentry (United States): error monitoring. Error reports identify you only by your account ID (never your name or email address). Reports from our server can include details of the request that failed, but not the values used in database queries.
Google (Google Ads) and Meta (Facebook Pixel): advertising measurement, described under cookies and analytics.
Bunny Fonts (European Union): serves a font used on our marketing pages, so it receives your IP address when you visit.

Inside WeRoster, information is shared with the people in your workplace who need it. Owners and managers can see their staff's details, rosters, availability, leave and timesheets. Store owners choose whether managers can see pay rates. Staff see published rosters for their stores, their own information and posts on their store's timeline.

We may also disclose information if the law requires it, to protect people's safety, or to a buyer if WeRoster or JCK XYZ LTD is ever sold, in which case this policy would continue to apply.

International transfers

JCK XYZ LTD is in the United Kingdom, our data is stored in the United States, and most of our customers are in New Zealand, so your information is held and accessed outside New Zealand. Our service providers above are mainly in the United States, and some use servers in other countries.

Under the New Zealand Privacy Act, we take reasonable steps to make sure your information is protected in a way that is comparable to New Zealand law: we only use established providers who are bound by contract to keep it secure and use it only for us. For UK GDPR, transfers out of the UK rely on safeguards in each provider's data processing terms, such as the UK International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework. Ask us if you'd like more detail.

Cookies and analytics

Cookies are small files that a website stores in your browser. WeRoster uses:

Essential cookies: a session cookie that keeps you signed in (it lasts up to 90 days unless you sign out) and a security cookie that protects forms from forgery.
Browser storage: if you arrive through a referral link, your browser remembers the referrer so your discount applies when you sign up. On a clock-in terminal, the device keeps a random terminal token so it stays unlocked. It never stores the store's PIN.
Payments: Stripe's script runs in the app and may set cookies to help prevent fraud.
Advertising: on weroster.co.nz and inside the app, we load the Google Ads conversion tag and the Meta (Facebook) Pixel. They record the pages you view and, for Google Ads, when you sign up or subscribe, and they set their own cookies. Google and Meta process this under their own privacy policies. We don't use Google Analytics, Hotjar or any other session recording tool.

You can block or delete cookies in your browser settings, or use a content blocker to stop analytics and advertising scripts. WeRoster still works if you do, although blocking essential cookies will stop you staying signed in. You can also opt out with your Google ad settings and your Facebook ad settings.

How long we keep it

Accounts and workplace data are kept while the account is open. When an employer removes a staff member or archives a store, it is hidden but kept, so that past rosters and timesheets stay accurate.
Closing an account: email us and we will delete your account and its workplace data within 30 days, apart from what we must keep by law.
Billing records are kept for seven years to meet tax and accounting rules.
Database backups are kept by DigitalOcean for about seven days, so deleted information disappears from backups within that time.
Ros conversations are deleted automatically 12 months after their last message.
Debugging records on our server are deleted after about a day. Error reports are kept by Sentry for a limited period set by Sentry.
Support emails are kept for as long as they are useful for helping you, and deleted on request.

Security

All connections to WeRoster are encrypted with HTTPS, and our server connects to the database over an encrypted connection.
Passwords and clock-in PINs are stored as one-way hashes, and card details are handled by Stripe, not us.
Wrong clock-in PINs are limited: after five wrong tries, that PIN is locked for 15 minutes.
Our database is a managed DigitalOcean database, which encrypts its storage.
Only the founder has administrative access to the server, the database and our admin tools.
Inside WeRoster, what each person can see is limited by their role (owner, manager or staff) and the stores they belong to.

No system is perfectly secure. If a privacy breach is likely to cause serious harm, we will tell the people affected and the Privacy Commissioner (New Zealand) or the ICO (United Kingdom) as the law requires.

Calendar feed links are private random links that can't be worked out from your account details. Anyone with the link can see the shifts in it, so please keep it private. You can reset your link at any time from your account settings, which stops the old one working.

Your rights

You can ask us to:

give you a copy of the personal information we hold about you;
correct information that is wrong (you can also edit your own details on your account settings page);
delete your information;
and, under UK law, restrict or object to how we use it, or give you your information in a portable format.

Email [email protected]. We may need to confirm who you are. We won't charge you, and we'll respond within 20 working days (New Zealand) or one month (United Kingdom).

If you're not happy with how we handle your information, please tell us first so we can try to fix it. You can also complain to the Office of the Privacy Commissioner in New Zealand or the Information Commissioner's Office in the United Kingdom.

If your employer uses WeRoster

If your employer added you to WeRoster, they decide what information about you goes in and how it's used, and they are responsible for it. We hold and process it on their behalf and only to provide WeRoster to them.

For access, correction or deletion of information your employer manages, such as your pay rate, rosters, leave or timesheets, please contact your employer first. If you contact us, we will pass your request on and help your employer respond. You can always contact us directly about your own login, your email preferences and any information you entered yourself.

Children

WeRoster is a tool for businesses and isn't aimed at children. You must be 16 or over to create your own account as a business owner. Employers sometimes add younger staff, and are responsible for doing so lawfully; their information is protected in the same way as everyone else's.

Changes to this policy

We'll update this page when the way we handle personal information changes, and change the "last updated" date above. If a change is significant, we'll also tell account owners by email or in the app.

Contact us

Questions about this policy or your personal information? Email [email protected] or use our contact form. JCK XYZ LTD (jck.xyz) is registered in the United Kingdom. You can also read our terms of use.