Privacy Policy

RotaTeam is scheduling software for small businesses. This policy explains what we do with personal data — both the accounts of the managers who use RotaTeam, and the staff records they put into it.

Who we are

RotaTeam is operated by [YOUR FULL LEGAL NAME], a sole trader based in the United Kingdom, trading as RotaTeam at rotateam.org.uk. For anything about this policy or your data, email privacy@rotateam.org.uk. A postal address is available on request and will be published here: [POSTAL ADDRESS].

The two kinds of people in RotaTeam, and why it matters

There is an important distinction that decides who is responsible for what.

Managers who sign up are our customers. We decide what to do with their account data, which makes us the controller of it.

Their staff never sign up and never agree to anything with us. Their employer puts their details into RotaTeam and decides what happens to them. For that data the employer is the controller and we are only the processor — we hold it and act on their instructions, and we do not use it for our own purposes. If you are an employee and want your records changed or removed, ask your employer; they can do it in RotaTeam, and we will help them if needed.

What we collect

From managers, to run their account: name, email address, business name, and an encrypted form of their password. We never store the password itself.

From managers, about their staff: name, job role, hourly pay, contracted and target weekly hours, availability, skills, holiday and shift requests, and any notes the manager adds about which people should not be scheduled together. Where a business records attendance, that includes clock-in and clock-out times and punctuality records.

Pay, punctuality and any note about keeping people apart are sensitive in practice even where the law does not class them as special category data. They are visible to whoever the business gives access to RotaTeam.

Automatically: the technical information any website receives — IP address, browser type, and the pages requested — used to keep the service running and to stop abuse.

Cookies and tracking

RotaTeam uses no analytics, no advertising and no tracking of any kind. There is no Google Analytics, no advertising pixel and no third-party script watching what you do.

The only cookies we set are the ones that keep you signed in. They are strictly necessary for the service to work, which is why you are not asked to consent to them. Clearing them signs you out; nothing else happens.

Artificial intelligence

RotaTeam uses a large language model to turn what a manager types into a schedule. When a rota is generated or edited, or when the setup assistant is used, the business's staffing details — roles, hours, availability, pay, the setup conversation and any feedback the manager has submitted about earlier rotas — are sent to that provider to produce and improve the plan. Staff names are included so the resulting rota is usable.

Depending on how the service is configured we use OpenAI or Google (Gemini), through their business APIs, where data sent through the API is not used to train their models. Both process data outside the UK; see “Where data is held” below.

No decision affecting anyone's employment is made automatically. RotaTeam proposes a rota; a manager reviews it and chooses whether to publish it. Nothing is sent to a provider unless a manager asks for a rota or opens the assistant.

Why we are allowed to hold it

For manager accounts, we rely on contract — we cannot provide the service without them — and legitimate interests for keeping the service secure and working.

For staff records, the employer decides the lawful basis. It is usually their legitimate interest in running a rota, or performance of the employment contract. We act on their instructions.

Where data is held

Accounts and business data are stored in a Postgres database hosted by Supabase in [SUPABASE REGION — shown in your Supabase project settings]. The application runs on Vercel. AI processing is carried out by OpenAI or Google as described above, which involves transfers outside the UK; these rely on the UK International Data Transfer Addendum and the providers' standard contractual clauses.

Who else sees it

We do not sell personal data and we do not share it for advertising. It is shared only with the suppliers who make the service work, and with anyone we are legally required to disclose it to. Those suppliers are:

• Supabase — database, authentication and hosting.
• Vercel — application hosting.
• OpenAI and/or Google — generating and editing rotas.

If we ever add another supplier who handles personal data, this list changes before they do.

How long we keep it

Business data is kept for as long as the account is open. A manager can delete individual staff records at any time, and can delete their whole workspace or their entire account from Settings — both remove the data from our live database immediately, not on a schedule.

Encrypted backups are kept for up to 30 days for disaster recovery, so deleted data can persist in a backup for that period before it rolls off. We do not restore backups to recover deleted customer data.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to restrict it. Write to privacy@rotateam.org.uk and we will respond within one month. If you are an employee of a business using RotaTeam, please ask your employer first, as they control your records.

If you think we have handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.

Security

Data is encrypted in transit and at rest. Access is separated at the database level, so one business cannot read another's data even if the application has a bug — that separation is enforced by the database itself and covered by an automated test suite that runs before every release. Passwords are hashed and are never visible to us.

A small number of RotaTeam staff can see account-level information — business names, sign-up dates, how many staff and shifts a workspace holds — in order to run the service. They cannot read the contents of a workspace: not a single employee name, wage or shift. Access is restricted to designated RotaTeam administrators and enforced by the database.

No system is perfectly secure, and we will tell affected customers and the ICO without undue delay if a breach puts anyone at risk.

Changes

If we change this policy in a way that matters, we will email account holders rather than quietly updating the date at the top.