Privacy Policy

Raise The Bar Pty Ltd is an Australian company providing operational issue-tracking software for hospitality venues. Our platform allows venue staff to report operational issues via WhatsApp and enables managers to track, assign, and resolve those issues.

For privacy enquiries, contact us at: hello@raisethebar.app

2.1 Account and profile information

When you or your venue administrator creates an account, we collect:

• •Name and display name
• •Email address
• •Phone number (for WhatsApp integration)
• •Role within your venue (e.g. staff, manager, owner)
• •Venue name and location details

2.2 Operational data

When staff use the platform to report issues, we collect:

• •Issue descriptions submitted via WhatsApp or the app
• •Photos and attachments submitted with reports
• •Task assignments, comments, and resolution notes
• •Shift debrief content
• •Timestamps and shift metadata

2.3 WhatsApp communication data

Our platform integrates with WhatsApp Business through the Meta WhatsApp Cloud API (operated by Meta Platforms). Twilio is used to deliver SMS verification codes. When you interact with our WhatsApp bot, we receive and store the content of those messages, including any photos or voice notes you send; voice notes are transcribed to text. Your WhatsApp number is linked to your venue profile. We do not access your personal WhatsApp contacts or conversations outside of messages sent directly to our bot.

2.4 Usage and technical data

• •IP address and device type
• •Browser type and version
• •Pages visited and features used
• •Error logs and performance data

2.5 Demos (website chat and WhatsApp)

Our homepage has a demo chat where you can try Raise The Bar without an account. What you type is sent to our AI provider (Anthropic) to generate the bot's replies; we do not store or log the conversation. To limit misuse, and to see how many visitors try the demo, we record which demo steps were reached (started, finished, shown the email step, gave an email) against a one-way hash of your IP address, never the address itself, together with the approximate location (city, region and country) that our hosting provider works out from it. If you give us your email in the demo, to be sent your demo reports and to try the other half of the demo, we store that email, any venue name you enter, the demo reports, and whether you asked to hear from us. We only send you marketing if you ticked that box; otherwise we use your email only to send the report you asked for. The demo is protected by Vercel BotID, which checks your browser is not an automated script.

After you give us your email in either demo, the links we send you (the buttons in the WhatsApp demo and in your report email) are personal to you, so we can see when you open one. If you have accepted analytics and marketing cookies, opening one also sets a cookie that lets us see which of our website pages you visit afterwards, so we know you came back; we record only the page, not what you type. If you have not accepted cookies we only record that you opened the link. Withdrawing cookie consent stops this.

You can also try the demo on WhatsApp by messaging our demo number. There, we store your WhatsApp phone number, the demo conversation (with any links, email addresses or phone numbers you type removed) and the demo reports, and link the conversation to the email address if you give us one. What you send is passed to our AI provider (Anthropic) to generate the replies, and voice notes to our transcription provider (Groq). By giving your email on WhatsApp you agree to receive your demo report and occasional updates from us by email or WhatsApp; you can opt out at any time by replying STOP on WhatsApp or using the unsubscribe link in any email. We use your number and conversation to follow up with you about Raise The Bar and to improve the product, never to sell to others. We record the same anonymous demo steps as on the website against a one-way hash of your phone number, with the country your number is from. When you tap through to WhatsApp from our homepage we count that tap against a hash of your IP address and its approximate location. The greeting we prefill for you varies slightly between visitors, which lets us connect your homepage visit (its approximate location and timing) to the WhatsApp conversation it started.

2.6 Payment information

Subscription payments are processed by Stripe. We do not store credit card numbers or full payment details. Stripe's privacy policy governs the handling of payment data.

We use the information we collect to:

• •Provide, operate, and improve the Service
• •Process and respond to issue reports submitted by staff
• •Generate AI-assisted task suggestions and shift summaries using Claude (Anthropic)
• •Send WhatsApp and SMS notifications relevant to your shift activity
• •Send pre-shift and post-shift digest messages to managers
• •Process subscription payments via Stripe
• •Respond to support requests and enquiries
• •Detect and prevent fraud, abuse, or security incidents
• •Comply with applicable legal obligations

Raise The Bar uses Claude, an AI model provided by Anthropic, to process issue reports, run the WhatsApp conversation, generate task suggestions, translate content between languages, and produce shift summaries and digests. When you submit an issue report or complete a shift debrief, its content is sent to Anthropic's API for processing.

We also use:

• •A fallback AI provider, used when Anthropic is unavailable, which also performs speech-to-text transcription of WhatsApp voice notes (currently Groq)
• •A text-to-speech provider, for audio playback of report content in the app (currently OpenAI)

We do not use your operational data to train AI models, and these providers' API terms do not permit them to train on it either. Their own policies govern how API-submitted data is handled on their end — see Anthropic, Groq, and OpenAI.

We do not sell your personal information. We may share information with:

5.1 Service providers

We rely on third-party providers to operate the platform. They are described below by the role they perform and the data they handle, since the specific vendor behind a role may change over time:

• •Application hosting and infrastructure — runs the website, dashboard, and background jobs
• •Database, authentication, and file storage — holds your account, issue reports, shift debriefs, and uploaded photos
• •Messaging platforms — deliver WhatsApp messages and SMS verification codes
• •Message queueing — inbound WhatsApp messages pass through a managed queue on their way to being processed
• •AI processing — see section 4
• •Email delivery — sends digests, notifications, and account email
• •Error monitoring — records application errors and performance data, configured not to collect IP addresses, cookies, request bodies, or session recordings
• •Payment processing — see section 2.5

Two of these are worth naming, because they are part of the Service you interact with directly rather than infrastructure behind it. WhatsApp messages are carried by the Meta WhatsApp Business Cloud API, operated by Meta Platforms, so your messages to us pass through Meta's systems. Payments are processed by Stripe. The providers performing AI processing are named in section 4.

Where your venue chooses to connect an optional integration, data is also shared with that provider: Slack (issue and debrief summaries posted to your workspace), and Deputy or Tanda (rostering and timesheet data, to match reports to shifts). These are off unless a venue administrator enables them.

Each provider is bound by their own privacy policies and, where applicable, data processing agreements. A current list of the named providers behind each category above is available on request from hello@raisethebar.app.

5.2 Overseas disclosure

Most of the providers described above process data outside Australia, principally in the United States and the European Union. By using the Service you consent to your personal information being disclosed to those overseas recipients for the purposes described in this policy. We take reasonable steps to ensure each is bound by obligations comparable to the Australian Privacy Principles.

5.3 Within your organisation

Issue reports, tasks, and shift summaries submitted within your venue are visible to other authorised users of your venue account (e.g. managers, shift leads). Venue administrators control which staff members have access.

5.4 Legal requirements

We may disclose information if required to do so by law, court order, or government authority, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of Raise The Bar, our users, or the public.

Our primary database is hosted in Australia. Other components of the Service — application hosting, message delivery, AI processing, and the other provider categories listed in section 5.1 — may process data overseas; see section 5.2. We implement reasonable technical and organisational measures to protect personal information from unauthorised access, loss, misuse, or alteration, including encryption in transit (TLS) and at rest.

While we take security seriously, no system is completely secure. If you believe your account has been compromised, contact us immediately at security@raisethebar.app.

We keep different classes of data for different periods, enforced automatically by a daily deletion job rather than left to manual clean-up:

• •Raw conversation content — the WhatsApp and in-app message threads themselves, including voice-note transcripts and message media, plus operational logs such as notification delivery records: 90 days
• •Business records — reported issues, comments, tasks, shift debriefs, and generated digests: 7 years, matching Australian record-keeping norms for incident and compliance records
• •Administrative audit log: 7 years
• •AI usage and cost telemetry (no message content): 1 year
• •Emails and WhatsApp numbers left in the demos, the WhatsApp demo conversations, the demo reports you asked for, and demo usage counts: 1 year (the WhatsApp demo conversation is kept for a year after your last message)
• •Verification codes: 1 day (the codes themselves are stored hashed and expire within minutes)

An issue report or debrief is a business record and is kept for the full 7 years; the underlying WhatsApp thread it was captured from is deleted after 90 days.

When you close your account or request deletion, we will delete or de-identify your personal information within 30 days, except where retention is required by law. In practice this means your identity records, raw conversation content, and per-person operational data are deleted, while issue reports and shift debriefs are retained in de-identified form — the record survives with your identity removed from it. Where a person has performed administrative actions, the tamper-proof audit log retains a pseudonymous identifier with no identity attached to it.

Under the Australian Privacy Principles, you have the right to:

• •Access the personal information we hold about you
• •Request correction of inaccurate or outdated information
• •Request deletion of your personal information (subject to legal exceptions)
• •Opt out of marketing communications at any time
• •Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

You can delete your own account at any time from Settings → Account → Delete account; it takes effect immediately and signs you out. If you are the only owner of a venue, you will be asked to add another owner or archive the venue first, so that it is not left without anyone to manage it. To exercise any other right, or if you cannot sign in to delete your account, email us at hello@raisethebar.app and we will respond within 30 days.

We use two categories of cookies. Essential cookies are always set, because the Service cannot work without them: your authentication session, your language and currency preference, a random choice of which homepage demo to show you (used to compare the two, with no identifier in it), and short-lived cookies used for administrator support access and for connecting third-party integrations such as Deputy. These are not used for advertising or profiling.

Analytics and marketing cookies are only set if you accept them. When you consent, we load Google Analytics (to understand how visitors use our site), the Meta (Facebook) Pixel (to measure and target our advertising), and Hotjar (to analyse how pages are used). These providers set their own cookies and receive your IP address and browsing activity on our site. This also covers the cookie our demo sets to recognise a returning demo lead (see section 2.5). If you decline, those scripts are never loaded and that cookie is never set. The Meta Pixel runs only on our public marketing and sign-in pages, never inside the signed-in product. Hotjar does run inside the product so we can see how it is used, but with all on-page text suppressed: its recordings show layout and clicks, not the names, phone numbers, reports or messages on screen.

We ask for your choice on your first visit and remember it for 180 days. You can change or withdraw your consent at any time using the Cookie settings link in the site footer, or by clearing cookies in your browser.

Our Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or via an in-app notice at least 14 days before the changes take effect. Continued use of the Service after that date constitutes acceptance of the updated policy.

For any privacy-related questions or complaints:

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).