Privacy policy

Rotevia is staff rota, scheduling and hours-tracking software. The service is operated by [registered company name not yet configured, set NEXT_PUBLIC_COMPANY_LEGAL_NAME], registered in England and Wales with company number [company registration number not yet configured, set NEXT_PUBLIC_COMPANY_NUMBER], at [registered address not yet configured, set NEXT_PUBLIC_COMPANY_ADDRESS]. Our registration with the Information Commissioner’s Office is [ICO registration number not yet configured, set NEXT_PUBLIC_ICO_NUMBER].

Privacy questions and data-rights requests go to hello@rotevia.co.uk.

Rotevia holds two different kinds of personal data, and our role differs for each.

• Your account. For the person who signs up and for anyone they invite as a manager, we are the controller. We decide what account data to hold and why.
• Your employees. For the staff records a business puts into Rotevia (names, roles, pay rates, shifts, hours, absences), the business is the controller and Rotevia is a processor acting on its instructions.

This matters for requests: an employee asking to see or delete their record should ask their employer, who controls it. We will help the employer respond, but we will not act on an employee’s record without the employer’s instruction.

Everything in this section reaches us because somebody typed or uploaded it.

• Account information: your name, email address, an optional phone number, and a password. Passwords are stored only as a salted scrypt hash and cannot be read back, by us or anyone else.
• Business information: the business name, address, phone number, locations, opening hours, roles, staffing requirements and rota settings.
• Employee records: name, role, employment type, contracted hours, start and end dates, hourly pay rate, contact details you choose to add, an optional photo, and any notes you write.
• Scheduling data: shifts, repeating patterns, recorded actual hours, absences, availability, cover and swap requests, cancellation requests and published rota versions.
• Expense claims: the amount, category, date, note, and any receipt files uploaded to support a claim. Receipts are held in private storage and are only ever served through an authenticated request scoped to your business.
• Messages you send us: anything in a support or contact message, including what you choose to put in it.

Please do not put special-category data (health details, trade-union membership, religious observance) into free-text notes. Recording an absence as “sick” is a category label and is expected; recording a diagnosis is not, and Rotevia is not designed to hold it.

• Authentication data: a session token stored in an http-only cookie, the sessions it belongs to, and their expiry. If you sign in with Google we receive your Google account’s name and email address; we never receive your Google password.
• Request and diagnostic logs: our hosting provider records the IP address, timestamp, path and user agent of requests, and our servers log errors. These exist to keep the service running and secure, and are retained for a short period by the host.
• IP addresses: used transiently to rate-limit sign-in and sign-up so accounts cannot be attacked by repeated guessing. They are held in memory for minutes, not written to the database against your account, and are not used to profile you.
• A change history: edits to shifts, pay rates, working patterns and approvals are recorded with the name of the person who made them. This is an audit trail an employer needs, and it is deliberately not editable.
• Analytics: only if you agree. See the section below.

Rotevia sets a small number of strictly necessary cookies: one that keeps you signed in, one that remembers which business you are working in, a short-lived one used to secure Google sign-in, and one recording your cookie choice. These are required to deliver the service you asked for, so they do not need consent.

Any analytics is optional and does not run until you allow it. Where it is enabled we use a cookieless, privacy-preserving provider that counts page views and a small set of product events: an employee was added, a rota was published. It never receives names, email addresses, pay rates, employee identifiers or the contents of any record, and it does not build a cross-site profile of you.

Full detail, and the controls to change your mind, are on the cookie policy page.

Paid plans are billed through Stripe. Card numbers are entered on Stripe’s own hosted checkout and never touch Rotevia’s servers, so we could not see your card details if we wanted to. What we store is a Stripe customer and subscription reference, the plan, its status and renewal date, and the card brand and last four digits so you can recognise which card is on file.

• Contract: account, business, rota and hours data is processed to provide the service you signed up for.
• Legitimate interests: security logging, rate limiting, fraud prevention and the audit trail. We rely on this because a scheduling service without them would be unsafe to run, and the privacy cost is small and expected.
• Legal obligation: keeping billing and tax records for the period the law requires.
• Consent: optional analytics, and nothing else. You can withdraw it at any time without losing access to anything.

For employee records the employer chooses its own lawful basis, usually the employment contract or its legitimate interest in running a rota, and we process them on its instructions.

We do not sell data, we do not share it with advertisers, and we do not use employee records to train anything. The service is delivered with the help of the sub-processors below, each of which only receives what it needs to do its job.

We will also disclose data where we are legally required to, and to a buyer if the business is ever sold, in which case this policy travels with it and you would be told before anything changed.

Rotevia is operated from the UK and its database is hosted in the region chosen when the project was created. Some of the services above process data outside the UK and EEA, principally in the United States. Where they do, transfers rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, together with the technical measures those providers publish.

• Account and business data: for as long as the account is open.
• Rota, hours and pay history: for as long as the account is open, because payroll and working-time reporting depend on being able to look back. Employers have their own record-keeping duties and should keep their own copies.
• Sessions: thirty days, then deleted automatically. Changing your password ends every other session at once.
• Billing records: as long as tax law requires, which in the UK is currently six years.
• Request logs: for the short retention period set by our hosting provider.
• Consent record: twelve months, after which we ask again.

Deleting an employee removes their shifts, recorded hours and pay history permanently and cannot be undone. Marking them inactive keeps the history instead, which is usually what an employer needs.

• Passwords are stored as salted scrypt hashes and are never recoverable in plain text.
• Sessions use signed, http-only, same-site cookies, sent only over HTTPS in production.
• Every read and write is scoped to the business you are signed in to, enforced on the server. Changing an identifier in a request does not reach another business’s data.
• Managers and employees see different things; the employee portal cannot reach manager screens.
• All traffic is served over HTTPS with HSTS, and the site sets a content security policy.
• Receipt files are stored privately and streamed through an authenticated route rather than exposed as public URLs.
• Sign-in, sign-up and password changes are rate limited.

No system is perfect. If we ever suffer a breach that is likely to put your rights at risk, we will report it to the ICO within 72 hours and tell affected customers.

Under UK GDPR and the Data Protection Act 2018 you can ask us to:

• give you a copy of the personal data we hold about you (a subject access request);
• correct anything that is wrong;
• delete your data, where we do not need to keep it;
• restrict or object to how we use it;
• send it to you, or to another provider, in a portable format;
• withdraw consent to analytics, at any time, with no consequence.

Write to hello@rotevia.co.uk and we will respond within one month. We may ask you to confirm your identity first, because we are not going to hand somebody else your staff records because they asked nicely.

If you are an employee whose record sits in an employer’s Rotevia account, send your request to your employer. They control the record; we will support them in answering it.

If you think we have got this wrong you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first so we can put it right.

You can delete individual employees and their history from inside the app. To close an account entirely and have its data erased, email hello@rotevia.co.uk from the address the account uses. We will confirm, then delete, keeping only what billing and tax law requires us to retain.

Rotevia is a tool for businesses and is not directed at children. We do not knowingly collect data from anyone under 16 as a user of the service. An employer may legitimately hold a record for a young worker; that record is the employer’s to manage, under its own duties.

When this policy changes in substance we update the date at the top of the page, and we tell account holders by email if the change materially affects them. Continuing to use Rotevia after a change means the updated policy applies.

Privacy questions: hello@rotevia.co.uk. Anything else: the contact page.