Privacy Policy

GearBox is a workforce and operations management application provided by VLJK Limited (“GearBox”, “we”, “us”), a company registered in New Zealand. GearBox is supplied to hospitality businesses (“your employer”) to manage staff rostering, time and attendance, training, communication and store operations. This policy explains what personal information we handle and how.

In most cases your employer is the controller of your personal information and decides how it is used. GearBox processes that information on their behalf to provide the service.

1. Information we collect

• Account & identity: your name, email address, phone number, job role, employing business and work location, and a securely hashed password. Where enabled, two-factor authentication details.
• Work data: clock in/out times, shifts and rosters, breaks, leave requests, training records and quiz results, messages you send within the app, and operational records you enter (such as stocktakes, orders, deliveries and checklists).
• Images and video: photos or video you capture or upload within the app, for example delivery dockets, receipts, checklist photos and training videos.
• Voice and audio:
  • Voice messages. If you record a voice message in chat, the recording is stored with the conversation like any other message, until it is deleted.
  • Voice ordering. If your employer has switched on voice ordering and you choose to use it, the app listens through your device’s microphone only while the voice order screen is open and listening. What you say is turned into text so your order can be filled in. The recording itself is never kept once it has been turned into text. The text of what was heard is kept with the order for 30 days, so a manager can check an order that looks wrong and so we can improve accuracy, and is then deleted. Because a microphone picks up whatever is nearby, it may occasionally catch the voices of other people, such as customers or workmates. Please pause voice ordering when you are talking to someone else.
  • Voice stock counts. If your employer has switched on voice counting for the kitchen prep count, or conversational voice for the weekly and month-end stocktakes, and you choose to use it, the app listens through the device’s microphone (your phone, or a shared kitchen tablet) only while voice counting is switched on, and shows a large “Listening” banner the whole time. What you say is turned into text so the stock counts can be filled in. Every count filled in by voice is marked on screen, with a one-tap undo. The recording itself is never kept once it has been turned into text. The text of what was heard is kept with that day’s count or stocktake for 30 days, recorded under the person logged in on the device, so a manager can check a count that looks wrong and so we can improve accuracy, and is then deleted. It may occasionally catch the voices of other people nearby. Please pause voice counting when you are talking to someone else.
  • Training videos. The spoken soundtrack of a training video your employer uploads may be turned into text to create the quiz for that course.
• Device & technical: device type, operating system, app version, a push-notification token if you enable notifications, and basic log data needed to operate and secure the service.

2. How we use information

• To provide and operate the app’s features for you and your employer.
• To authenticate you and keep accounts secure.
• To send operational notifications (such as roster changes or messages) where enabled.
• To read information out of things you give the app — for example reading a supplier invoice from a photo, or turning a spoken order or stock count into order lines or counts. Some of this is done by automated tools, including artificial intelligence (AI). See “AI features” in Section 3.
• To maintain, troubleshoot and improve the service.

We do not sell your personal information, and we do not use it for advertising. We do not use AI to make decisions about your employment, pay or rostering. Where an AI tool fills something in, you can always see what it filled in and change or undo it — for example, a voice order is always reviewed on screen and sent by a person, never by the app on its own, and every stock count filled in by voice is marked on screen, with a one-tap undo while you are counting.

3. Sharing & service providers

We share information only as needed to run the service:

• Your employer and the authorised managers within your business.
• Accounting, payroll or other partners your employer has chosen to connect (for example Xero or a payroll provider).
• Where required by law.
• The service providers listed below, who host and support GearBox. They handle information on our instructions, to provide their service to us, and not for their own purposes.

Service providers we use

Hosting and database	Railway
Website hosting	Vercel
Photo, video and file storage	Cloudflare
Email delivery	Resend
Push notifications	Google (Firebase Cloud Messaging) and, on iPhone, Apple
Address lookup	Google (Places)
AI — reading documents and text	Anthropic
AI — turning speech into text, and search within Help	OpenAI

We may change providers from time to time. We will keep this list current.

AI features

Some features send the specific item you are working on to an AI provider so it can be read or understood: a photo or PDF of a supplier invoice or docket; the spoken audio of a voice order or voice stock count; the soundtrack of a training video; a question you type into the in-app Help assistant; and the text of training material when a quiz is being created. We send only what that feature needs. We use these providers’ business (API) services, under terms which say that what we send is not used to train their AI models. They may keep a copy for a short period (up to 30 days) to detect misuse, after which it is deleted; the speech-to-text service we use does not keep voice recordings at all.

4. Where your information is held and processed (overseas)

GearBox is a New Zealand business, but like most online services we rely on providers whose computers are outside New Zealand. This means your information is held and processed overseas. Our main database and application are hosted in the United States. Our other providers listed in Section 3 also operate mainly from the United States and may process information in other countries where they have facilities.

These providers hold and process information on our behalf, to deliver their service to us. We remain responsible for your information wherever it is processed, and the New Zealand Privacy Act 2020 continues to apply to how we handle it. We choose providers that commit by contract to keep information confidential and secure, and to use it only to provide their service to us.

Privacy laws in other countries may differ from New Zealand’s, and in some circumstances overseas authorities can lawfully require a provider to give them access to information it holds.

If you have questions about where your information is held, contact us using the details in Section 10.

5. Data storage & security

Information is stored on secured cloud infrastructure. We protect it with encryption in transit, hashed passwords, role-based access controls, and two-factor authentication for administrator accounts. No system is perfectly secure, but we take reasonable steps to protect your information.

6. Data retention

We keep personal information for as long as your account is active and for as long as needed to provide the service to your employer, then delete or anonymise it in line with your employer’s instructions and our legal obligations. Some things are kept for a shorter, fixed time:

• Voice ordering and voice stock count recordings are not kept at all once turned into text.
• The text of what was heard during a voice order or voice stock count is deleted after 30 days.
• Technical request logs are kept for about 14 days.

7. Your rights

You may request access to, or correction of, your personal information. As your employer generally controls your data, please contact them first. You can also contact us using the details below and we will assist or direct your request appropriately. Depending on where you live, you may have additional rights under applicable privacy law, including the New Zealand Privacy Act 2020.

8. Children

GearBox is a workplace tool intended for employees and is not directed at children.

9. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date shown above.

10. Contact

Questions about this policy or your information:
VLJK Limited (GearBox)
Email: privacy@gearboxhospo.co.nz