Privacy Policy — Sitio
Developer: RKAY Solutions Pty Ltd
Contact: info@rkay.com.au
Effective Date: 05 Nov 2026
Last Updated: 06 Nov 2026
Summary
Sitio is a workplace booking service for desks, rooms, parking and visitors. It is provided by RKAY Solutions Pty Ltd ("RKAY", "we"). Your employer sets it up and creates your account. To run it, Sitio keeps your account details, your bookings, and a record of activity and faults. RKAY holds this on your employer's behalf, on Microsoft Azure in Australia. We do not sell your information. Sitio has no advertising and no analytics library, and does not track you across other companies' apps or websites.
App Store Privacy Label: Data Linked to You, used for App Functionality only. Not used to track you.
1. Data We Collect
Using the categories in Apple's App Privacy Details:
• Contact Info (name, email, phone, address) — Yes. Your name and work email address. A phone number, if your company's administrators add one. A visitor's name and email address, when staff book for a visitor.
• Health & Fitness — No.
• Financial Info — No.
• Precise or Coarse Location — No.
• Sensitive Info — Yes. Whether you need an accessible space, if your company's administrators record it.
• Contacts — No. Sitio does not read your phone's contacts.
• User Content (photos, text, documents) — Yes. A photo, if you add one. Your bookings, team and role. A note or extra fields, if your company's administrators add them.
• Browsing or Search History — No.
• Identifiers (User ID, Device ID) — Yes. An account identifier, a staff number, an HR ID if your company adds one, and a device identifier the app creates.
• Usage Data or Analytics — Yes. The activity log, described in section 3. Sitio has no analytics library.
• Crash Data or Diagnostics — Yes. Error reports, described in section 3.
• Advertising Data — No.
No advertising frameworks or analytics libraries are included in this app.
2. What Stays on Your Device
The following stays on your phone and is never sent to us:
• Your PIN — kept on your phone only as a hash.
• Your Face ID, Touch ID or fingerprint — your phone checks these itself. Sitio never receives them.
• Your photo library — your phone's own picker hands over only the one photo you choose. Sitio does not look through your library.
3. What We Keep and How We Get It
Your account. An account identifier, your name, work email address, team, role, and your default building and level. Your employer or its sign-in provider gives us these, and Sitio gives you a staff number. Your company's administrators can also record your phone number, an HR ID, a usual seat, whether you need an accessible space, whether you can park or book for others, a note, and any extra fields your company adds to its people records.
Your bookings. What was booked, where, when and for whom, and your check-ins. You make these in the app or on the website, or a colleague or administrator makes them for you.
Network check-in, if your company turns it on. When your work laptop connects to your company's network at a desk or on a floor, Sitio records the network point and the time, and uses it to check you in to your booking. The Sitio app does not collect this; it comes from your company's network.
Your photo, if you have one. This is optional. It is either a photo you upload yourself, or your Microsoft 365 photo when your company signs in through Microsoft Entra ID.
Visitors. When a member of staff books for a visitor, the visitor's name and email address as that person entered them.
Your phone's sign-in record. A device identifier the app creates, the name of your device, whether it runs iOS or Android, and when it signed in and was last used. The app sends these when you sign in, and Sitio uses them to keep that phone signed in.
Activity log. Each page you open and each request the app or website makes: your email address, what was opened, the result and the time. Sitio records these as you use it. Your company's administrators can search this log.
Error reports. When the app hits a failure, it sends us the screen, the error message, the part of the address that failed, the status code, the app's version, and your device's system and kind (for example "ios 26.4 · phone"). Reports never contain a password, a PIN or an access token.
4. Sitio Is Provided Through Your Employer
Sitio is sold to companies for their own staff. You have a Sitio account because your employer created one for you. You cannot sign up for one yourself, in the app or anywhere else.
Your employer decides what Sitio is used for and how long its records are kept. RKAY holds and processes this information on your employer's behalf. This policy covers the Sitio apps for iPhone and Android, and the Sitio website.
5. System Permissions
The app asks your phone for the following. Neither is needed to book.
• Face ID, Touch ID or fingerprint — Unlock the app, as well as your PIN. Optional.
• Photos, through your phone's own picker — Choose one photo for your Profile. Optional.
Sitio does not use your location, camera, contacts or microphone, and it does not send push notifications.
You can revoke a permission at any time in your phone's Settings. Sitio keeps working: your PIN still opens it, and a photo is optional.
6. How We Use It
Only to provide Sitio to you and your company: to show the floor map, make and manage bookings, send booking messages, let your company's administrators run their workplace, keep the service secure, and find and fix faults.
We do not sell your information. We do not use it for advertising, and we do not track you across other companies' apps or websites.
7. Who Else Sees It
• People at your company. Depending on your company's settings, colleagues can see who has booked what, and administrators can see people, bookings and the activity log.
• Your company's sign-in provider (Microsoft Entra ID or Okta), when your company uses one.
• Outlook, when your company connects calendars.
• Azure Communication Services, Microsoft's email service, to send booking messages.
• Microsoft Azure, which hosts Sitio.
We share information only for these purposes, or when the law requires it. Any third party we share your information with provides the same or equal protection of your information as this policy sets out. We use providers that hold appropriate security certifications.
8. Where It Is Kept and How It Is Protected
Sitio's information is held on Microsoft Azure in the Australia East region. We do not send your information overseas, except where your company's sign-in provider processes it under its own terms.
Your information is encrypted when it travels between your device and Sitio, and Azure encrypts the database and its backups when they are stored. Our hosting provider's security logs record IP addresses to protect the service.
Each company's records are kept separate from every other company's, and what a person can see depends on their role. Passwords are stored only as salted hashes, and sign-in links and tokens only as hashes. The secrets a company uses to connect its own systems are stored encrypted.
9. How Long We Keep It
Your company sets how long its records are kept. A purge runs every night and removes what is past those periods.
• Bookings, notifications, calendar records, network check-in records, visitor details, the activity log and archived photos: 6 months as a standard. Your company can set any period from 30 days to 10 years.
• The audit log, which records changes made in Sitio: 12 months as a standard. It has its own setting, with the same range.
• Your account. When your account is deactivated it can no longer sign in, and it is kept so that past records still make sense. Once it has been deactivated for longer than the audit log's period, it is anonymised: your name, email, phone number, photo and other details are removed. A staff number stays with the empty record, so it is never given to someone else.
• Database backups: kept for 14 days and then removed, so something the purge has removed can stay in a backup until then.
You can remove a photo you uploaded at any time from your Profile. It then leaves the app and is kept as an archived record until the period above ends.
10. Your Rights, Revoking Consent and Data Deletion
Your employer manages your account, so please ask your company's Sitio administrator first. They can correct your details and deactivate your account. You can also write to info@rkay.com.au to ask what we hold about you or to ask for a correction. If we need to, we will work with your employer to answer you.
To stop using Sitio and revoke your consent:
• Sign out of the app at any time, which ends that phone's session.
• Revoke a permission in your phone's Settings, as section 5 describes.
• Remove your photo from your Profile, as section 9 describes.
• Uninstall the app. This takes the app off your phone. It does not close your account.
• Ask your company's administrator to deactivate your account. It can then no longer sign in.
Your employer controls your account. On request, your administrator can deactivate it. Your personal details are then anonymised, and the records described above are removed, when the periods your company set end.
11. Complaints
Write to info@rkay.com.au and we will reply within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
12. Children's Privacy
Sitio is a workplace service for employees. It is not directed at children, and we do not knowingly collect information from children. If you believe a child has used Sitio in a way that raises a privacy concern, contact us at info@rkay.com.au.
13. Changes to This Policy
We may update this policy to reflect changes in Sitio or applicable law. The "Last Updated" date above will reflect any revisions. Significant changes will be communicated in the app's store release notes and to the companies that use Sitio.
14. Contact
RKAY Solutions Pty Ltd
Email: info@rkay.com.au
For privacy enquiries or questions about this policy, email us and we will respond.
Sitio is developed by RKAY Solutions Pty Ltd. It is not affiliated with or endorsed by Apple Inc., Google LLC or Microsoft Corporation.