Privacy Policy

1. Who we are

Ekoni Pty Ltd (ACN: 643 293 083) ("Ekoni", "we", "us", "our") operates the ekoni staff operations platform, a B2B SaaS application for retail and hospitality operators, accessible via our web application and a companion mobile application distributed through the Apple App Store and Google Play (collectively, the "Service").

We are committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. What information we collect

We collect only the information necessary to operate and improve the Service:

Account and identity data. When an operator creates an organisation account, we collect the operator's name and email address. When staff members are invited, we collect their name, email address, mobile number (optional), and job role within the organisation.

Authentication credentials. Passwords are hashed using our authentication provider (bcrypt) and are never stored in plaintext. We do not have access to your password.

Operational data. The Service records shift tasks, stock counts, inventory items, supplier orders, delivery records, schedule and scheduling data, and related operational activity entered by staff and operators. This data belongs to the operator organisation and is processed on their behalf.

Staff personal and employment records. Staff members may add or be asked for a residential address, emergency contact details, employment type and start date, superannuation fund details, tax file number (TFN), and bank account details for payroll. TFNs and bank account numbers are encrypted at rest and only a masked last-3-digit reference is ever displayed in the app; changes to bank details are logged and can trigger a notification to the account holder.

Clock-in selfies. Where an organisation uses ekoni Clock on a store tablet for staff attendance and asks for a photo, a front-camera photo is captured at each clock-in and clock-out as a record of attendance. Selfies are stored in a private file store, are not used for facial recognition or any automated decision-making, and are only viewable by authorised managers investigating a timesheet or payroll dispute.

Job applicant data, including video. When someone applies for a role through an organisation's careers page, we collect the details they submit: name, contact details, work rights, availability, certifications, and, for some roles, a short introduction video. Applicants give explicit consent before a video is recorded. The employer sets how long an application and any interview video are kept, and you are told the period on the listing. It is deleted after that unless you later agree to stay on file. Once the record is deleted, only a de-identified summary (hashed contact details, dates, stage and outcome) is kept, so a repeat application can be recognised.

Interview photos. At an in person interview the interviewer may take a photo of the applicant, only with the applicant's consent, so the team remembers who they met. The photo is stored in a private file store and deleted after the interviews close, whatever the outcome.

Luna AI conversations and voice input. Messages you type or speak to Luna, ekoni's built-in AI assistant, are processed to generate a response and are stored as part of your organisation's operational data. If you use Luna's voice mode, your spoken audio is sent for transcription to text and is not stored by ekoni afterwards. See Section 5 for detail on how Luna's AI processing works, including the third parties involved.

Analytics. The Service computes stock, sales, and hiring statistics from an organisation's own operational data to power in-app dashboards and Luna's insights. This is first-party operational analytics for the organisation that owns the data. We do not use third-party advertising trackers or cross-site tracking scripts in the app.

Push notification tokens. If you enable push notifications on the mobile app, we store a device push token (an anonymous identifier issued by Apple APNs or Google FCM via our push-notification provider) to deliver operational alerts. This token is tied to your staff profile, not to any advertising or tracking identifier.

Marketing site. If you submit your email address via the interest-capture form on ekoni.com, we store your email to send updates about the product. We do not use advertising trackers or analytics cookies on the marketing site.

Technical and usage data. Our hosting infrastructure captures standard server logs including IP addresses, browser user-agent, and request paths. These logs are retained for security and diagnostic purposes and are not used for profiling.

2a. The capacity we act in: processor or controller

For most of the information above we are a processor: the employer organisation that subscribes to the Service decides what is collected and why, and we handle it on their instructions. For a smaller set we are a controller: we decide the purpose ourselves. Which applies to each category:

• Operational data (shift tasks, stock counts, orders, deliveries, schedules): processor. The employer organisation is the controller.
• Staff personal and employment records (address, emergency contacts, employment details, superannuation, TFN, bank details): processor. The employer organisation is the controller and is the entity with the payroll and record-keeping obligations attached to this data.
• Clock-in selfies and attendance records: processor. The employer organisation is the controller and decides whether ekoni Clock is used at all.
• Job applicant data, including video: processor. The organisation running the careers page is the controller and makes the hiring decision.
• Luna AI conversations and voice input: processor. Transcripts form part of the employer organisation's operational data.
• In-app analytics computed from an organisation's own operational data: processor.
• Staff account and identity data, and push notification tokens: processor when acting for the employer organisation, and controller for the limited purposes of authenticating the account and securing the Service.
• The operator's own account and billing contact details: controller. This is our direct relationship with the subscribing business.
• Marketing site enquiries submitted on ekoni.com: controller.
• Technical and usage data (server logs, security and diagnostic records): controller. We decide what is logged and for how long, to keep the Service running and secure.

Where to take an access or correction request. If you are a staff member or job applicant, ask your employer (or the organisation you applied to) first, because they control that data and can action most requests directly in the app. If you come to us instead, we will point you to them, or act on their instructions where we can help. Where we are the controller, come straight to us (see Section 9).

3. Why we collect it: purpose and lawful basis

We process personal information for the following purposes:

• Providing the Service: creating and managing staff accounts, processing operational data, delivering push notifications. Lawful basis: performance of a contract with the operator.
• Account security: authenticating users, detecting and preventing unauthorised access. Lawful basis: legitimate interest in protecting the security of our systems and users' data.
• AI-powered assistance (Luna): answering operational questions, drafting schedules and orders, transcribing voice input to text, and reading replies aloud. Lawful basis: performance of a contract with the operator, and consent for voice input specifically (see Section 5).
• Product communications: sending marketing interest updates to subscribers. Lawful basis: consent (you may unsubscribe at any time via the link in each email).
• Legal and compliance: complying with applicable laws, responding to lawful requests. Lawful basis: legal obligation.

4. Third-party sub-processors

We share personal information only with the following sub-processors to operate the Service. We do not sell personal information to third parties.

• Database, authentication & file storage provider: all user and operational data is stored on a managed database service hosted in Sydney, Australia. Row-level security (RLS) policies ensure each organisation accesses only its own data.
• Push-notification delivery provider: routes push notifications to Apple APNs and Google FCM on our behalf using device push tokens. No message content is retained beyond successful delivery.
• Web hosting & edge-network provider: hosts the web application and marketing site on edge infrastructure globally. This provider processes request logs as described above.
• Apple Inc. / Google LLC: distribute the mobile application and deliver push notifications via APNs / FCM respectively. Their privacy practices are governed by their own privacy policies.
• Anthropic PBC (AI provider, language and vision, processed in the United States): receives the text of Luna conversations, the business operational data needed to answer a question, and supplier invoice documents (images or PDFs) submitted for automated data extraction. See Section 5 and its privacy policy.
• Deepgram, Inc. (AI provider, speech to text, processed in the United States): receives your spoken audio when you use Luna's voice features, and returns a text transcript. Receives nothing while Luna voice is switched off. See Section 5 and its privacy policy.
• ElevenLabs, Inc. (AI provider, text to speech, processed in the United States): receives Luna's reply text and returns synthesised speech audio. Never receives your voice recording, and receives nothing while Luna voice is switched off. See Section 5 and its privacy policy.
• Cartesia, Inc. (AI provider, text to speech, processed in the United States): the automatic text to speech fallback. Receives Luna's reply text only if the main voice service is unavailable, never your voice recording, and nothing while Luna voice is switched off. See Section 5 and its privacy policy.

5. AI processing (Luna)

Luna is ekoni's built-in AI assistant. It answers operational questions, drafts schedules and supplier orders, extracts data from uploaded supplier invoices, transcribes spoken input, and reads replies aloud. This section explains what Luna sends to AI processors, why, and the safeguards that apply.

What is sent, and to whom. When you message Luna, the text of your message and the business operational data needed to answer it (for example stock levels, schedule data, or order history for your organisation) are sent to our language and vision provider, which generates Luna's reply. When you use a voice feature, your spoken audio is sent to our speech to text provider for transcription; your raw audio is never sent to the language and vision provider. When Luna replies aloud, only the reply text, never your voice recording, is sent to our text to speech provider to generate spoken audio. When an operator uploads a supplier invoice for Luna to read, the invoice image or PDF is sent to the language and vision provider to extract line-item data. Section 4 names each AI provider and where it processes data.

Purposes. Answering operational questions, drafting schedules and orders, extracting invoice data, transcribing speech to text, and converting text to speech. Lawful basis: performance of a contract with the operator, and consent for AI processing and for voice input (see "Your choice" below).

Third parties and equal protection. Our AI providers, Anthropic, Deepgram, ElevenLabs and Cartesia, are our sub-processors for Luna. Each is bound by contract to process this data only to provide their service to us, not for any unrelated purpose, and is subject to the same confidentiality and security obligations as every other sub-processor in Section 4. Under Anthropic's commercial terms of service, Anthropic may not train its models on our customers' content. Deepgram processes voice audio strictly on our instructions as a data processor; we are not enrolled in any optional program that would let it use recordings to train its own models. ekoni deletes the stored synthesis record from ElevenLabs after each reply is generated. Our text to speech providers receive reply text only, never your voice recording.

No AI training. Personal information from Luna is never used to train the underlying AI models.

Retention. Voice audio you speak to Luna is not stored by ekoni. It is sent to our speech to text provider for transcription and discarded once the transcript is returned. Luna chat and voice transcripts are stored in our database as part of your organisation's operational data, and are retained and deleted on the same basis as other operational data (see Section 6). Text sent to our text to speech providers is not retained by ekoni beyond generating the audio response.

Your choice. Luna is opt-in. Before your first message reaches any of these services, the app shows you a notice naming them and listing what is sent, and nothing is sent unless you agree. You can withdraw that agreement at any time in the app under Admin, which switches Luna off entirely.

Voice is separately optional. You can keep Luna and switch Luna voice off in the same place. With voice off, no audio is recorded on your device and none is sent to any of our voice providers; you type to Luna and Luna answers in text. Your device or browser will also ask for microphone permission before any voice feature can record you, and you can revoke that permission at any time in your device or browser settings, which disables voice without affecting Luna's text chat.

6. Data retention

We retain personal information for as long as an organisation account is active or as needed to provide the Service. When an operator closes their account, we delete or anonymise personal data within 30 days, unless retention is required by law or for legitimate dispute resolution purposes.

Push notification tokens are deleted when a staff member removes the app, revokes notification permissions, or is removed from an organisation.

Clock-in selfies are kept as attendance evidence for the duration of a staff member's employment and any statutory payroll record-keeping period, then deleted with the rest of the attendance record.

Job applications, including any interview video, are kept for the period the employer sets, shown on the listing (see Job applicant data in Section 2). Interview photos are deleted after the interviews close, whatever the outcome.

Luna chat and voice transcripts are retained with the rest of your organisation's operational data, as described above. See Section 5 for how voice audio itself is handled.

Marketing email addresses are retained until you unsubscribe. You may request deletion at any time (see Section 9).

7. Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, or disclosure. Measures include:

• Encryption in transit (TLS 1.2+) for all connections.
• Encryption at rest for all database storage (hosted in Sydney, Australia).
• Row-level security policies enforced at the database layer. No application code can bypass them.
• Passwords stored as bcrypt hashes; we cannot retrieve your password.
• Access to production data restricted to authorised personnel only.

No method of transmission over the internet is 100% secure. If you become aware of a security issue, please contact us immediately via our support page.

8. Young team members

Some businesses on ekoni employ people under 18, and in some states under 15. Their employer collects the same employment records as for any other worker. The business decides which consents it needs and who gives them, including whether a parent or guardian signs: for the employment itself, and for any optional extras such as appearing in the business's marketing or social media.

AI features and under-15s. Luna, our AI assistant, is switched off for team members under 15, including voice, until their employer records that a parent or guardian has agreed. Until that happens nothing about them is sent to any AI provider. From 15, a team member gives that consent themselves.

Consent is a record, and it can be withdrawn. Every consent is stored with what was agreed, who agreed to it, and when, alongside the signed document. A parent, guardian or team member can ask their employer to withdraw any optional consent at any time; withdrawing AI consent switches Luna off again immediately.

9. Your rights

Under the Australian Privacy Principles you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or out-of-date information.
• Request deletion of your personal information (subject to our legal obligations and legitimate business needs).
• Withdraw consent to marketing communications at any time.

Where to send the request. Staff members and job applicants should exercise access and correction rights with their employer (or the organisation they applied to) first, because that organisation is the controller of the data and can action most requests directly in the app. Where we are the controller (see Section 2a: your operator account, marketing enquiries, technical logs, and staff account and identity data), contact us via our support page. We will respond within 30 days. If you contact us about data we hold as a processor, we will direct you to the controlling organisation and assist them in responding.

10. Complaints

Come to us first. If you think we have mishandled your personal information or breached the Australian Privacy Principles, raise it with us via our support page. Tell us what happened and what outcome you are after. We acknowledge privacy complaints within 5 business days and give you a written response within 30 days.

If your complaint is about data an employer organisation controls (see Section 2a), we will tell you that and pass it to them, because they are the ones who can resolve it. You are free to complain to them directly at the same time.

If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC), the regulator for the Privacy Act 1988 (Cth), at www.oaic.gov.au. The OAIC generally asks that you complain to us first and give us 30 days to respond before it takes the matter on.

11. International data transfers

Our primary database is hosted in Sydney, Australia. Some data may be processed by our hosting provider's global edge network and our push-notification provider's infrastructure, which may be located outside Australia. Our AI providers for Luna process data in the United States; Section 4 lists each one and where it processes data. We take reasonable steps to ensure sub-processors apply privacy protections consistent with the APPs.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will tell account owners by email before the change takes effect.

13. Contact us

Questions or concerns about this Privacy Policy or how we handle your personal information? Reach us via our support page.