Version 2026-10-29

Privacy

EmuFlow is operated by EMUFLOW PTY LTD (ACN 703 803 883). EMUFLOW PTY LTD stores shop records in EmuFlow so the business can operate. EmuFlow is the product name. This page says what is collected, why, where it is kept, and how to leave or ask for a copy. When you tick the box at signup, EmuFlow stores the date and this version on your login and, for the owner, on the business.

What is collected, and why

EmuFlow stores the business account, the people on the team, rosters, clock times, orders, recipes, chat, wholesale contacts, waste logs, and safety records. That is so the business can run the shop and keep the records it needs. Pay rates are encrypted in the app. Tax file numbers, bank details, and super details are encrypted and kept only until they reach payroll. After Xero accepts the employee, those details are removed from EmuFlow. For a shop that does not use Xero, the owner can remove them after they have been typed into the payroll system. They can be entered again if they change. Super details stay only when they were not part of the Xero send. A clock can store a location and a selfie when the business turns those on. In New South Wales the owner can issue a written surveillance notice first. The app does not use location or photos for a person until 14 days after that notice, unless they acknowledged a new-hire notice. A profile photo is optional and is only visible to people in the same business. It is not a clock-in selfie, and a clock-in selfie is never used as a profile photo. The file is removed when that person is removed from the business. It is not kept with the seven-year pay records. Square sales and cake deposits stay with the owner. A position can give a shift leader, a 2IC, or a manager a wider view of the team, including the roster, leave, and supplier invoices. A manager can also invite people and change who can open each part of the shop. Wage rates, costing, wholesale prices, tax file numbers, and business settings stay off those positions unless the owner turns that switch on for one person. A waste log names who threw an item out. The owner can see when a quantity changed or a line was removed. A 2IC or a manager who can manage waste can change anyone's log. Someone else can change only their own line from the same day. The owner can also see an activity record of sign-ins, role and permission changes, staff added or removed, pay rate edits, roster publishing, leave decisions, timesheet edits, waste edits and removals, orders sent, notices, data exports and deletions, and settings changes. That record is kept for at least 7 years with the pay records. It does not store passwords, a full tax file number, or bank details. Error reports and server logs have emails, phone numbers, tax file numbers, bank details, addresses, locations, punch photos, and tokens removed before they are saved or emailed.

Invoices and payroll files

Wholesale sales can be emailed as an invoice PDF and a spreadsheet. Supplier bills, including a photo of an order, can be turned into a priced PDF and a spreadsheet. These are draft files the business downloads or emails for its own accounting inbox. They are not posted into Xero from that screen. The owner, or a manager who can manage the business, can download approved timesheets as a file for Xero, MYOB, or Employment Hero (KeyPay) to import. That file is a draft export. It is not sent into those systems from the app, and each export is logged. Xero, Square, and Lightspeed are used only when the owner connects that helper.

Photos

Staff can upload a photo of leftovers or a cabinet. It is saved as a picture for that shop and that day, with who uploaded it and when. The app does not read the products in the photo. A product photo can become a counter sign, with a seasonal border, to share or print. A cleaning photo can become a page with the logo, a title, the date, and the shop, to share or print. The Photos page links to the chemical, cleaning, and promo photo flows. These photos stay with the business. They are not a clock-in selfie.

Help

Help, in the header, lets a signed-in person send a bug, an error, an idea, or a question. A photo is optional. The report is saved for the owner and emailed to the app team through Resend, the same sender as other mail. The photo stays with the report.

Uniforms

Staff can browse a short uniform list and pay on their own card with Stripe Checkout. Printful prints the uniform and sends it. The card number stays with Stripe. EmuFlow does not store the card number. The name, email, phone, and Australian delivery address on the order go to Printful after the payment succeeds, so it can post the uniform. The order reference starts with emuflow-uniform-. This stays inside the company until EmuFlow has its own Stripe account and its own Printful store. People outside the company do not pay until then.

Chat

The owner can remove a group, or a direct chat, from the list. Everyone and the orders chat stay. Removing a chat hides it. The messages are not wiped.

Where it is stored

The app runs on Fly in Sydney (syd). The database is Fly Postgres, managr-db, in Sydney on Fly.io. The browser is told not to embed the app in another site, not to sniff a file as a different type, and to allow the camera and location only for this app. A stricter script rule is reported, not enforced, so the pages still load. Photos, videos, and PDFs are shown only when the file itself is that type. A password change signs out the other devices. Too many wrong passwords, reset emails, or kiosk PINs are paused. Two-step login is offered to everyone and required for accounts that can see pay, bank, or tax file details. A backup of the database can be opened on a separate database to check that it starts, and that copy is removed after the check. It is not a second live shop.

People outside Australia

Some helpers are overseas. Email, including Help, goes through Resend in Tokyo. Reading an uploaded invoice, when a key is set, goes to OpenAI at api.openai.com (model gpt-4o-mini). That address is OpenAI's global API, so the invoice is not limited to one country. A photo of a chemical bottle can use that same reader to fill the product, brand, and size. An ingredient name can use it to suggest allergen flags. Leftover photos, promo photos, cleaning photos, and Help photos are not sent to it. Address lookup goes to Google Places API. That service is global, so it is not limited to one country. If Google Places does not answer, the same search can go to Nominatim, run by the OpenStreetMap Foundation in the Netherlands and Ireland, and then to Photon, run by Komoot in Germany, when a street number still needs a match. Phone alerts can pass through Apple, Google, or Mozilla push services. A uniform payment goes to Stripe in the United States. After it succeeds, the delivery details go to Printful, which sits overseas. Pay and accounting can go to Xero when the owner connects it. Sales can go to Square or Lightspeed. The list, and what each one does, is on the sub-processors page.

Access and correction

You can ask for a copy of your records and ask for a correction. Start with the business owner. You can also write to emuflow.team@gmail.com. The owner can correct a roster, a clock time, or a profile in the app.

Complaints

Write to emuflow.team@gmail.com if something looks wrong. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC).

How to leave

The owner can remove a person from the team. That person's login no longer opens this shop. To close the whole business, write to emuflow.team@gmail.com. Pay and clock records stay for the time the law requires. A profile photo is removed when that person is removed from the business. It is not kept with the seven-year pay records. Closing the shop does not hand over a copy of the software.

Contact

EmuFlow is operated by EMUFLOW PTY LTD (ACN 703 803 883). c/- Findex Tenterfield, 253 Rouse St, Tenterfield NSW 2372. emuflow.team@gmail.com.