Privacy Policy

Rosco is practice management software for architecture and design studios, available at roscoapp.com ("the Service"). This policy explains what personal information we collect, why we collect it, who we share it with and how you can access or correct it.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Each studio (an "organisation" in Rosco) uses the Service to run its own projects. Studios enter information about their clients, consultants, contractors, suppliers and other contacts, and upload drawings, documents and photos. The studio decides what goes into its workspace and is responsible for having the right to collect and use that information.

We store and process this information only to provide the Service to that studio. We don't use it for our own marketing and we don't sell it. If you are a client or contact of a studio and have a question about information it holds about you, please contact the studio first. We will help them respond where we can.

We use personal information to:

• provide, operate and secure the Service
• create and manage accounts, studios and team invitations
• send service emails, such as sign-up confirmations, one-time sign-in links, invitations and password resets
• give you the free Word templates you ask for, and protect our forms from automated misuse
• process subscription payments
• respond to support requests
• fix problems and improve the Service
• meet our legal obligations

We don't sell personal information and we don't use it for advertising. Email addresses given for a template download are not added to a mailing list and are not used for marketing.

We share information only with the providers that help us run Rosco, and only as much as each one needs:

• Supabase: database, sign-in and file storage, hosted in Sydney, Australia
• Vercel: website hosting, file storage and cookieless usage analytics
• Stripe: subscription payments
• Resend: delivery of service emails
• Cloudflare: the bot check on our template download form
• Sentry: error reports, so we can find and fix problems. Reports hold technical details such as the page, browser and error message; we remove names, email addresses and other personal details before they are sent
• Anthropic: AI features when your studio turns them on, and the in-app help assistant (see section 6)
• Xero: accounting, only when your studio connects its Xero account

We may also disclose information where the law requires it, or to protect the safety of people or the security of the Service.

AI features in Rosco (such as filling in schedule details, reading specifications and the project assistant) only work when a studio adds its own Anthropic API key in its organisation settings. When someone in the studio uses one of these features, the relevant project information is sent to Anthropic to produce the result. Under Anthropic's commercial terms, this information is not used to train their models.

The help assistant (the “How do I…?” button) uses Rosco's own Anthropic account. When you ask it a question, your question, the conversation so far and the page you're on are sent to Anthropic to produce the answer. No project information is sent. If you attach a schedule to turn into a template, the file is also sent to Anthropic so it can be read; Rosco doesn't keep the file itself, only a template you choose to use on a project. We keep the questions and answers, linked to your account, to apply a daily limit and to improve Rosco and its help guide.

Our main database is hosted in Sydney, Australia. Some of our providers (including Vercel, Stripe, Resend, Sentry, Anthropic and Cloudflare) are based in, or process data in, the United States and other countries. When we use them, personal information may be stored or processed overseas. We choose providers with strong security practices and contractual privacy commitments.

We protect information with measures including:

• encrypted connections (HTTPS) for all traffic
• database rules that limit each studio's data to its own members, with access set by role
• keys and secrets for connected services kept on our servers, never in your browser
• daily backups

No system is perfectly secure. If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

Studios can create share links so people outside Rosco can see, and in some cases edit, selected information such as drawings or a schedule. Anyone with a link can open what it shares unless the studio protects it with a password. Studios can set links to expire or remove them.

We keep information for as long as your studio's account is active. If an account is closed, we delete its data from our live systems within 30 days. Copies in backups are removed automatically as backups expire, usually within 7 days after that. We may keep limited records for longer where the law requires it, such as payment records.

Template download requests (your email address, the template and when you asked) are deleted 30 days after the request. If an account is never used (its email address is never confirmed, nobody signs in to it and it doesn't belong to a studio), we delete it about 14 days after the last sign-in or confirmation email was sent to it. This includes accounts created when someone asks for a template sign-in link and doesn't use it.

Studios are responsible for keeping their own business records for as long as they need to, and should download anything they need before closing an account.

You can view and update most of your information in Rosco yourself. You can also ask us for access to the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing hello@roscoapp.com. We will respond within 30 days. If the information belongs to a studio's workspace, we may need to involve that studio.

We use essential cookies to keep you signed in, to secure connections to services like Xero, and to remember when you have entered a share link's password. We also store a few display preferences in your browser. The template download form also loads Cloudflare's bot check, which runs in your browser. We don't use advertising or tracking cookies.

Rosco is a business tool and is not intended for anyone under 18. We don't knowingly collect personal information from children.

If you have a concern about how we have handled your personal information, please email us first and we will try to resolve it within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

We may update this policy from time to time. The date at the top shows when it last changed. If we make significant changes, we will let you know by email or with a notice in Rosco.

For privacy questions or requests, contact: