Privacy Policy

Serve By Example is committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Privacy Policy explains how we collect, use, and safeguard personal information.

1. What We Collect

• Account Info: Name, email address, and venue affiliation.
• Profile Data: Plan type, display name, and preferences.
• Training Data: Quiz and drill answers (which questions you got right or wrong, kept for 180 days), scores, and your replies in Live Guest conversations (typed, or spoken and written out as text), with what the practice guest said back. Your shift days, if you set them.
• Communication Data: Messages sent to us via email or forms.
• Automated Data: Usage patterns, device identifiers, IP addresses, and server logs.

2. How We Use Your Information

We use your information to:

• Operate the Service and manage your account.
• Provide AI-powered training evaluations and personalised feedback.
• Allow Venue Managers to track training compliance.
• Improve the platform and fix bugs.
• Comply with our legal obligations.

3. Data Storage and Sovereignty

We prioritise data security and utilise infrastructure primarily hosted in Australia (ap-southeast-2).

4. How We Share Your Information

We share information only with trusted service providers contractually obligated to protect your data:

• Supabase: Authentication and database storage.
• Cloudflare: Hosting, security and cookieless page visit counts (Cloudflare Web Analytics).
• Sentry: Error monitoring. When a page or request fails, we send Sentry the technical details of the fault (the error message, where in our code it happened and the page address without its query string) so we can fix it. No cookie is set, and no name, email or IP address is attached.
• OpenAI: Used for Live Guest conversations, AI coaching, drafting venue quiz questions and translation. Each Live Guest reply is sent so the practice guest can answer. If you use voice, your recording is sent to be written out as text and the guest's lines are sent to be read aloud; Serve By Example never stores the recording or the audio, only the text. A manager's AI Coach question is sent with that venue's staff names, roles and training scores, and the venue items a manager adds, typed or as a photo of the menu, are sent to draft questions about them (the photo is not kept). A job applicant's written answers are sent to be marked, and the results of their test are sent to write a short summary for the venue (see section 12) (OpenAI does not use data submitted via the API to train their foundational models).
• Google Analytics: We use Google Analytics (ID: G-EF9YRFXKBG) to understand platform usage patterns and improve user experience. See Google's Privacy Policy. You can opt out using the Google Analytics Opt-out Browser Extension.
• Legal Requirements: Disclosure as required by Australian law.

5. Data Retention

We retain account data while the account is active. If you delete your account, we delete or anonymise your personal data within 30 days, unless required for legal purposes. Aggregated, anonymised usage data may be retained indefinitely for analytics.

5.1 Data Retention Schedule

• Account & Profile Data: Retained while account is active; deleted within 30 days of account deletion (unless required by law).
• Training Progress & Quiz Responses: Retained for the duration of active subscription; deleted within 30 days upon account deletion.
• Live Guest Conversations: What you typed or said (as text, never as a recording) and what the practice guest said, kept with your result; deleted with your account. Managers see the score and result, not what you typed. They also see team totals for the week and the questions the team missed most, never who answered what: a question only shows once two or more people have missed it.
• Job Applicant Tests: Kept for 12 months from the invite, then deleted automatically, or sooner if the venue deletes them (see section 12).
• Billing Records & Stripe Webhook Events: Retained for 7 years to comply with Australian tax and financial regulation requirements.
• Manager Analytics & Staff Performance Data: Retained for the duration of venue subscription; deleted within 30 days of venue removal.
• Aggregated & Anonymised Data: Retained indefinitely for service improvement and analytics purposes.

6. Payment Processing

We use Stripe to process payments for subscriptions. When you subscribe, Stripe receives your payment information (credit card details are not stored by us). Stripe may issue webhook events (e.g., subscription creation, updates, and invoice notifications) which we store securely to track billing state. Stripe's privacy practices are governed by their Privacy Policy.

7. Manager Analytics

Venue managers can access real-time team analytics and staff training progress through the Manager Console. We track staff_progress, scenario_mastery, and staff membership data to provide managers with compliance reporting and performance insights. Only the managers of a specific venue can see that venue's staff data; data is segregated by row-level security (RLS) policies in our database.

8. Venue Codes & Staff Invitations

Venues can generate unique venue codes to invite staff members. When a staff member joins via a venue code, they are added to the organisation_members table and receive sponsored access to training modules. Only the venue that created the code can see its associated staff; staff members can see their own profile and progress, and managers at their venue can see aggregated team performance.

9. Your Rights Under Australian Law

Under the APPs, you have the right to:

• Access/Correction: Request a copy of or correction to the personal data we hold about you.
• Deletion: Request that we delete your personal data.
• Complaints: Contact us at info@servebyexample.co. If unsatisfied, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

10. Security and Changes

We implement industry-standard measures, including encryption and strict access controls. We may update this policy periodically; continued use of the Service constitutes acceptance of the updated policy.

11. Signing In With Google

You can create an account and sign in with your Google account instead of a password. If you do:

• What we receive from Google: Your name, your email address and your Google profile picture. We do not receive your Google password, and we do not ask for access to your Gmail, Drive, Calendar, contacts or any other Google data.
• How we use it: Your email address identifies your account and is where we send service emails. Your name is shown in the app and to the manager of a venue you join. We do not use your profile picture.
• How we store and share it: It is stored with the rest of your account information, as described in sections 3 and 4. We do not sell it, use it for advertising, or use it to train AI models.
• Removing it: You can ask us to delete your account and this information at any time by emailing us. You can also remove our access from your Google account under Security, Your connections to third-party apps and services.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

12. Job Applicant Tests

A venue on a Serve By Example plan can invite a job applicant to take a test before an interview. The applicant does not need an account. This section is for those applicants.

• Who collects it: The venue that invited you, using Serve By Example to run the test. The venue decides what to do with your results.
• What is collected: Your name and email address (entered by the venue), your answers, and how each answer was produced: how long it took, whether text was pasted in and how much, how long you were away from the page, and typing time. We also record when you agreed to the notice at the start of the test.
• Who sees it: The managers at the venue that invited you. They see your answers, your scores and the information above. Nobody else at Serve By Example uses it, except to keep the service running and to answer a request from you or the venue.
• AI marking: Your written answers are marked by AI (OpenAI), and a short summary of your results is written for the venue. The marker is told to judge what you would do, not your spelling, grammar or English. The scores and summary are there to help a person decide; they do not make the decision. The AI is never shown the timing or paste information. Your answers are not used to train AI.
• Email: The invite is sent from our address through our email provider, Brevo, with replies going to the venue.
• How long it is kept: 12 months from the invite, then deleted automatically. The venue can delete it sooner at any time.
• Your rights: To see, correct or delete your test, reply to the invite email to ask the venue, or contact us at info@servebyexample.co.

Contact Us

For privacy related inquiries, please contact:

Serve By Example
Email: info@servebyexample.co