Privacy policy

1. Who we are and our role

OpenRoster is provided by Liew Chen Tong, trading as CTL Studio ("we", "us"). CTL Studio is a sole proprietorship registered with the Companies Commission of Malaysia (SSM) under registration number 202603269827 (PG0594604-U) and based in Johor, Malaysia.

We are the controller of account data: the details of people who create an account and sign in. For the data that customer organizations enter about their workers, and for the data of people who sign contracts that an organization sends, the organization is the controller and we are its processor; we process that data only on the organization's instructions. A data processing agreement is available on request.

We are also the controller of early-access requests.

2. Data we process

Account data: your name, email address, password (stored only as a hash), preferred language, optional avatar and your browser sessions.

Organization data: what an organization enters, such as worker names, contact details, employee codes, identity document numbers and addresses (stored encrypted), map locations, engagement history, roles, invitations and contracts, including pay amounts and signatures.

Contract-signer data: the signer's name, email address, signature, and the time, IP address and browser details of signing and verification steps.

Activity and security data: audit logs of actions in an organization and an account, including the IP address and browser details of actions people take in the web app, and the IP address used for sign-in, invitation and abuse limits.

Early-access requests: when you ask for early access on our website, we store your name, email address, company or organization, team size, your message if you write one, the language of the page, when you sent the request and which version of this privacy policy was published then. We also record our decision and any internal note, when we made it and, if we give you access, when you used it to create your account.

Messages you send us: when you email support@openroster.app or privacy@openroster.app, we receive your email address, your name if you give it, and what you write.

Website statistics: on our website openroster.app (not in the app), we use Cloudflare Web Analytics to count page views. For each page view, Cloudflare receives the page address without its query, the page you came from, how long the page took to load, and your browser type and country, which Cloudflare derives from the request. It sets no cookies and stores nothing in your browser, and we see only totals, not individual visitors.

3. Why we use it

We use this data to provide and secure the service, to send account, invitation, notification and contract emails, to prevent abuse, and to meet legal obligations. We do not sell personal data or use it for advertising. We use early-access requests to decide whether to offer you access, to email you a registration link or our decision, and to manage the access we give, including pausing or ending it. We use messages you send us to reply to you.

We use website statistics to learn how many people visit our website, how they find it and how fast its pages load.

4. IP addresses

Audit logs and contract evidence record IP addresses and browser details. The session list in your account shows a masked IP address for each signed-in browser. Rate limits use the IP address of the request.

Contract evidence is kept as long as the contract record it belongs to, and is deleted with it when the organization is deleted.

When you open our website, Cloudflare receives your IP address with the request, as for every page we serve. According to Cloudflare, Web Analytics does not use your IP address or browser details to identify or fingerprint you.

5. Service providers

We use these providers to run the service: Cloudflare (edge network and security, website statistics on openroster.app, R2 file storage and encrypted backups), DigitalOcean (servers, Singapore), Resend (sending email), Sentry (error reports, configured to leave out personal data such as names, email and IP addresses), Google Maps (address suggestions and the map for confirming a worker's location), and Better Stack (monitoring whether our website and app are available, and the data of our status page at status.openroster.app: when you open that page, your browser loads the current status from Better Stack, which receives your IP address and browser details with that request). When paid plans open, Stripe will process payments. Email sent to our addresses is forwarded by Cloudflare Email Routing to our mailbox at Gmail (Google).

6. Transfers outside Malaysia

The service is hosted by DigitalOcean in Singapore, so personal data is stored and processed outside Malaysia. Cloudflare (edge network and security, website statistics, R2 file storage and encrypted backups), Sentry (error monitoring), Resend (email delivery), Google Maps (the address text you type for suggestions and the maps you view) and Better Stack (the IP address and browser details of visitors to our status page) also process data outside Malaysia. Gmail (Google) stores email sent to our addresses outside Malaysia.

7. How long we keep data

Account data is kept while the account exists, including after you deactivate it; a deactivated account can no longer sign in. Organization data, including contracts and their signing evidence, is kept while the organization exists. An organization's audit log is kept for its plan's retention period: 30 days on the trial and 90 days on Starter. Your account's audit log is kept for 90 days.

When an account is deleted, we delete its name, email address, password, avatar, sessions, notifications, the records of emails sent to its addresses and its account audit log. Where the account was an organization's billing contact, that organization's owner takes its place. Records of emails sent to an earlier address of yours are deleted by our regular notification retention, which removes email records 90 days after they were sent. We keep only a random identifier without personal details, so that the records of organizations that refer to the account stay consistent. Records that an organization keeps about you as its member, worker or contract signer, such as membership history, worker records, contracts with their signing evidence, and audit entries about you or your actions, belong to that organization. They stay with it while the organization exists, except that audit entries end with its retention period. Ask that organization about them (see section 8).

When an organization is deleted, we delete all of its data: memberships, roles, invitations, worker records, contracts, signed documents and their signing evidence, files, notifications, billing records and its audit log. Its members' accounts are not deleted. Signers keep the copies they have downloaded; after the deletion we can no longer provide copies.

A deletion in the app takes effect at once, and stored files are removed within two days. After every deletion of an account or an organization we try to send one automatic confirmation email, to the account's former address or to the organization's owner, and keep no copy of it. Emails already sent cannot be recalled, and our service providers, for example for email delivery logs, delete their own copies under their own retention periods.

Deleted data, including data deleted on request, can remain in our encrypted off-host backups for about three months: normally up to 93 days, and at most 120 days if automatic pruning fails. It can also remain in deployment snapshots that only administrators of our server can read, normally for at most 30 days, and longer only while an unfinished deployment awaits recovery.

We never restore a deleted account or organization from a backup. If we have to restore a backup for another reason, we delete again everything that was deleted after that backup was made. For this we keep a list of completed deletions that contains only the kind of record, its random identifier and the dates, without personal details. When you ask for a deletion by email, we keep your request, our replies and our receipt for 12 months after the deletion as a record that we handled it, and then delete them.

We keep an early-access request and our decision for 12 months after the last change to it, then delete it, together with our records of the emails we sent you about it. You can ask us to delete it earlier. If you create an account from it, your account data is kept as described above, and deleting your account also deletes your request.

We keep other messages you send us and our replies for 12 months after the last reply, unless you ask us to delete them earlier. Deletion requests are kept as described above.

Cloudflare keeps the website statistics; we can view them for the past six months.

8. Your rights

You can ask to access, correct or delete your personal data by email to privacy@openroster.app. We reply within 21 days. Unless you still own an active organization, you can deactivate your own account in the app, which stops it from signing in but does not delete your data. You can also delete your account in the app, and an organization's owner can delete an archived organization there; this takes effect at once. If you cannot sign in, follow section 8 of our terms; we complete the deletion within 21 days of your request, not counting the time we wait for your confirmation. Self-service export is not available yet.

If your data was entered by an organization, such as your employer, please contact that organization first; we help it answer your request.

9. Cookies

We use only essential cookies: to keep you signed in, to protect forms against cross-site requests, to remember your language and to keep a contract signer's signing session. Cloudflare may also set strictly necessary security cookies. We do not use advertising or analytics cookies, and our website statistics use no cookies, so we do not ask for cookie consent.

10. Age

The service is for people aged 18 or older.

11. Changes and contact

We may update this policy. The version date at the top shows the current text, and we tell account holders about material changes before they take effect. If you keep using the service after a change takes effect, you accept the updated policy.

Privacy questions and requests: privacy@openroster.app.