• Privacy Policy
• Terms of Service
• Data Processing Agreement
• Sub-processors
• Cancellation and refunds

Privacy Policy

1. Who we are

RotaHero is provided by Amber Fox Labs Ltd, a company registered in England and Wales (company number 17378973) with its registered office at 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ ("we", "us").

• Data-protection requests and questions about this policy: privacy@rotahero.com.
• Help with the service: support@rotahero.com.
• Anything else: hello@rotahero.com.

2. The two hats we wear

RotaHero is a staff-scheduling tool used by businesses ("employers") to plan their teams' shifts. That means two different roles under data-protection law:

• We are the data controller for the information of the person who signs up and the managers they invite: their account, sign-in and security data, and feedback. We are also the controller for the technical and security data described in section 3 about anyone who uses RotaHero, staff included, because we decide how the service is kept secure and working.
• We are a data processor for the information employers enter about their staff. The employer is the controller of that data; our Data Processing Agreement governs how we handle it on their behalf.

If you work for a business that uses RotaHero, your employer decides what is entered about you, so please direct questions and rights requests to them first. We help them answer those requests, and section 7 describes what the product itself lets them do. For the technical and security data we control, you can contact us directly.

Your employer should give you its own privacy notice covering what it enters about you, why, and how long it is kept. RotaHero gives each employer a short staff notice, filled in from its account, to which the employer adds its own details (such as its contact and who sees what). The account owner confirms that staff have been given it before adding anyone, and staff can read it at any time in the staff portal. The notice is the employer's, and so is its content. This policy covers the data we control and how we handle your data for your employer.

3. What we collect

Account holders (owners and managers)

What you must give us. To create or use an account we need your email address, a password, and the details for two-step sign-in (an authenticator app and a recovery email address); without them we cannot set the account up or let you sign in. Everything else is optional or arises from using the service.

• Account: your email address, your role in the business's account (owner or manager), the locations you can manage and the permissions you were given, and when you accepted the Terms.
• Sign-in and security: a protected check of your password (never the password itself), your two-step sign-in set-up, including a recovery email address (which may be a personal address), the devices you are signed in on (with their IP address and browser), records of sign-ins and other security events, and the security alerts we email you. We use these only to keep your account and the service secure.
• Staff notice: when the account owner confirms that staff have been given the staff notice, we record who confirmed it, when, and which version of the notice.
• Support and feedback: messages you send us by email or through the in-app feedback form, with your email address, your account and a small technical snapshot (such as the page and screen size) to help us answer.
• Invitations: if an owner invites you as a manager, or we invite you to our closed beta, your email address, for a limited time (section 5).

Staff data (entered by the employer, which we process on its behalf)

Which of these an employer uses depends on the features it turns on:

• Identity and contact: name and an email address, for the staff portal and rota emails.
• Scheduling: shifts, availability, weekly hours, roles, tags, leave allowances, notes and the published rota.
• Absences: dates and a reason chosen from a fixed list (for example holiday or sickness), with no free text. Some reasons reveal health information, which the employer must treat as such.
• Hours worked: the hours the manager records each week, corrections, and whether the staff member agreed with them.
• Pay (optional): pay rates and their history, and a payroll ID. Permissions control which managers see pay. Staff see their recorded hours, not their pay rate.
• Working-time details: a date of birth for staff under 21 (for the young-worker rules and minimum-wage age bands), the school-leaving date, and the dates of a 48-hour opt-out. Permissions control which managers see the full date of birth.
• Certifications the employer chooses to keep, such as a licence and its expiry date.
• Leaving: the leaving date, and the employer's answer to whether the person ever worked or was paid (section 5).
• Staff portal activity: requests such as time off, shift claims and swaps, answers to shift offers, the manager's decisions, and when a staff member saw or acknowledged a published shift.

Technical data

• Error reports: if the app or our server hits an error, a report is sent to Sentry's EU (Germany) service so we can fix it. Reports exclude your IP address, but can incidentally contain fragments of whatever was on screen when the error happened.
• Server logs: our hosting provider, Cloudflare, logs each request to our servers, which can include your IP address and an approximate location derived from it. We use these logs only to run, secure and fix the service.
• Abuse protection: to protect accounts from password guessing and other abuse, we briefly count recent attempts (by IP address, account and email address).
• Staff portal: when a staff member last used the portal.

4. Why we process it (legal bases)

For the data we control, each purpose has its own lawful basis under UK GDPR:

• Providing the service to owners and managers: our contract is with the business that uses RotaHero. We process its owners' and managers' account data on the basis of our legitimate interest in providing the service that business has asked for (Art. 6(1)(f)), including sending the invitations an owner asks us to send. Where you are yourself our customer, for example as a sole trader, we process it to perform our contract with you (Art. 6(1)(b)).
• Support and feedback: the same basis as above, and our legitimate interest in answering anyone else who contacts us (Art. 6(1)(f)).
• Security and reliability (sign-in and security data, abuse protection, server logs, error reports) and change history (kept for resolving disputes): our legitimate interests in keeping accounts and the service secure (Art. 6(1)(f)), and the security of processing the law requires (Art. 32).
• Inviting people to our closed beta: our legitimate interest (Art. 6(1)(f)). We email invitations only to people who asked to hear about RotaHero, or to business contacts at their business address. Every invitation tells you who we are and lets you opt out.
• Data-protection requests and complaints: legal obligation (Art. 6(1)(c)).

Where we rely on legitimate interests, you have the right to object (section 7).

For staff data we process on an employer's behalf, the employer decides why the data is processed and is responsible for its own lawful basis, its own condition for any health data, and its own notice to its staff.

Automated decisions. We make no decision about anyone based solely on automated processing that has a legal or similarly significant effect on them. RotaHero's rule checks and suggested rotas are there for a manager to review; the manager decides.

5. How long we keep it

The law requires employers to keep some staff records for several years. RotaHero keeps those records (we call them statutory records) while the account exists, and copies them into the records archive described below. Keeping them after the account ends is the employer's duty: we hand them over in the export, then delete them.

The records archive

For each location with a pay period set, RotaHero keeps a second, sealed copy of each pay period's statutory records, so they survive as evidence:

• What and when. Once a pay period is settled and its correction window has passed, its statutory records, the staff list for that period and their change history are copied into a file sealed with a cryptographic checksum, so its integrity can be verified.
• Corrections. If a period changes after it was copied, the new version is kept alongside the earlier one. The archive does not lock or delete anything in the live service.
• Where. In Cloudflare's storage under its EU data jurisdiction, inside our account.
• How long. Each file is kept for 6 years from the later of when its records were made and the end of the pay period that follows, or for 7 years from the end of its own pay period if that is later. It is then deleted.
• Who can read it. Only the account owner and managers given access, and each download is recorded. The archived files hold no date of birth.
• Deletion. When an account is deleted, its archived files are deleted within about 30 days.

6. Who has access

We use a small number of service providers (sub-processors) for hosting and storage, sending email, error monitoring and our own business email. Our sub-processors page names each one, with its purpose, location and transfer safeguards, and we update it before a new one starts.

Our own team. Our team's access to your data is limited to what support and incident resolution require. A member of our team can sign in to your account through our support tool only to provide support you asked for, or to investigate a fault or security incident affecting your account. Each such sign-in is time-limited and recorded, and any change made during it is stored under our staff member's own name, so your change history shows who made it. Our staff's reads of your account's change history or feedback are recorded too. We keep these records for 12 months, and deleting your account erases them with the rest of its data.

We do not sell personal data, and we do not share it with advertisers or data brokers.

7. Your rights

Under UK GDPR you can access, correct, export, delete, restrict, or object to the processing of your personal data.

• Export: in Settings, download all of your data as JSON at any time: every location you have access to, with all of its records, and your own account details.
• Correction: everything is editable in-app. A correction to a period already in the records archive is saved as a new version alongside the old one (section 5).
• Deletion: the account owner can delete the whole account in Settings, which removes the account and all of its business data from the live service at once, and from backups and the records archive within about 30 days, including the logins of the managers it invited (section 5). An invited manager can also leave an account themselves in Settings, which deletes their login, or the owner can remove them; they can also ask us to delete it. Employers can also anonymise an individual staff member, which irreversibly removes their identity (their name, contact details and other identifying details) from the live service and its change history; their rota and pay history are kept without a name. Copies already in the records archive keep the name, as the employer's evidence. Permanently deleting a staff member is only for people added by mistake (section 5).
• For anything else, email privacy@rotahero.com; we respond within one month.

Your right to object. Where we process your data on the basis of our legitimate interests (section 4), you can object at any time by emailing privacy@rotahero.com. We will then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims.

Complaints. If you are unhappy with how we have handled your personal data, please tell us first: email privacy@rotahero.com with "Complaint" in the subject, or write to us at the address in section 12. We will acknowledge your complaint within 30 days, look into it, keep you updated, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commission (still known as the ICO) at ico.org.uk/make-a-complaint. We have not appointed a data protection officer; contact us at privacy@rotahero.com.

8. International transfers

Our database, its backups and the records archive are stored at rest in the European Union. Some processing happens outside the UK and the EU, including in the United States: our email provider stores the emails we send there, and our hosting provider handles requests and keeps short-lived logs on its global network. Data sent to the EU relies on the UK's adequacy regulations; other transfers are protected by the safeguards in each provider's data processing agreement (the UK International Data Transfer Addendum or, where the provider is certified, the UK Extension to the EU–US Data Privacy Framework). The sub-processors page names the safeguard for each provider, or you can ask us for a copy at privacy@rotahero.com.

9. Cookies and local storage

The app uses strictly necessary cookies only, to keep you signed in, so there is no cookie banner. Our website at rotahero.com sets no cookies, runs no scripts and loads nothing from other sites. Cloudflare hosts it and handles the technical details of each visit, such as your IP address, to deliver it.

The app keeps a copy of your rota data on your own device, so you can still view it, read-only, without a connection. That copy is wiped when you sign out, and before anyone else signs in on that device. If your sign-in simply times out, the screen locks and the copy stays until you sign in there again. The device also keeps a reference to the account whose data it held, and a few settings with no rota or staff data, such as the theme and language.

On a staff member's own phone or computer, the staff portal keeps them signed in.

10. Security

Every owner and manager signs in with two-step sign-in. Passwords and access tokens are stored only in a protected, one-way form; data is encrypted in transit and at rest; each account's data is kept apart from every other account's; and sign-in attempts are rate-limited. A fuller description is in the DPA, section 6.

11. Changes to this policy

If we make material changes we will notify account holders by email and in-app at least 30 days before they take effect, and update the effective date above.

12. Contact

privacy@rotahero.com · Amber Fox Labs Ltd, 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ