Privacy policy

This policy explains how we collect, use, share and protect personal information through the Roll House app, our loyalty program (Roll House Rewards), this website and our store.

“Roll House Austral”, “we”, “us” and “our” mean Forging Legacies Pty Ltd (ABN 90 689 974 052), which operates Roll House Austral at Shop G6, 60 Warrawal Ave, Austral NSW 2179. We aim to handle personal information in line with the Australian Privacy Principles.

What we collect

Your account

• Your mobile number, which you use to sign in with a one-time code sent by text message.
• Your first and last name.
• Your birthday, if you choose to add it.
• Your email address, if we later let you add one and you choose to.

Your loyalty activity

• Each visit where your member code is scanned: the store, the date and time, and the number of eligible banh mi recorded.
• Your stamps, and the rewards you earn, use or let expire.
• Offers you view or activate, and the promotions you take part in.

Your choices and messages

• Whether you have turned marketing by push notification, email or text message on or off, and when.
• Anything you send us when you contact us.

The app and your device

• Actions in the app, such as opening it, viewing your rewards or offers, showing your member code and opening a notification.
• The app version you use and, if you allow notifications, a notification token for your device.

We don’t collect your location, and the app doesn’t take payments. When you pay at the counter, your card is handled by our payment terminal, not by the app.

This website

This website doesn’t use advertising or analytics cookies, and you don’t need an account to use it. Our hosting provider processes technical information, such as your IP address, to deliver the website and protect it from attacks.

How we use it

• To create and run your account and sign you in.
• To record your stamps, issue and redeem your rewards, and show your history.
• To send service messages, such as sign-in codes, reward and expiry reminders, and important notices about your account. These aren’t marketing.
• To send you offers and news, but only through the channels you turn on.
• To recognise your birthday, if you add it and we offer a birthday reward.
• To understand how members use Roll House, for example how often you visit, so we can improve the program and decide which offers to send and when. This analysis is for our own use.
• To prevent misuse and fraud, keep business records and meet our legal obligations.
• To answer your questions and requests.

We don’t sell your personal information.

Marketing

You don’t have to agree to marketing to join Roll House Rewards. Marketing is off until you turn it on, and you can turn each channel (push notifications, email and text messages) on or off at any time in the app under Account, then Communication preferences. Every marketing email or text message also includes a way to unsubscribe.

We’ll still send service messages, such as sign-in codes and reward reminders, while you have an account.

Who we share it with

We use trusted service providers to run the app and our communications. They handle your information only to provide their services to us:

• Supabase, for sign-in and account security.
• DataFlows, an Australian provider that sends our text messages, including sign-in codes.
• Replit, which hosts our app’s servers and database.
• Expo, Apple and Google, which deliver push notifications to your device.
• Resend, which sends our emails.
• Cloudflare, which hosts this website and handles our email forwarding.

We may also share information with our professional advisers, or where the law requires it.

Our staff see only what they need at the counter, such as your first name or initial, your stamps and your available rewards.

Information sent overseas

Some of our service providers store or process information outside Australia, including in the United States and other countries where they or their suppliers operate. We choose providers with strong security and privacy practices.

How we protect it

We use encrypted connections, limit staff access to what each role needs, protect management accounts with strong sign-in controls, and keep records of sensitive actions. Your member QR code contains no personal details, changes every few minutes and can only be used once.

No system is completely secure. If we become aware of a data breach that is likely to cause you serious harm, we’ll let you know.

How long we keep it

We keep your information while your account is open. If you delete your account, we delete or permanently de-identify your personal information. We keep only what we must for legal, tax or fraud-prevention reasons, and only for as long as needed. De-identified records of past visits and rewards, which no longer identify you, may be kept for business reporting.

See how to delete your account.

Seeing and correcting your information

You can view and update your name in the app. Once saved, your birthday can’t be changed in the app; email us if it needs correcting. To ask for a copy of the information we hold about you, or to correct it, email us. We’ll confirm your identity, usually by sending a code to your mobile, and respond within 30 days.

Questions and complaints

If you have a question or a complaint about how we’ve handled your personal information, email hello@rollhouseaustralia.com.au. We’ll respond within 30 days.

If you’re not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes to this policy

We may update this policy from time to time. We’ll post the new version here with a new date, and let you know in the app about any significant change.

Contact us