Privacy Policy

Effective date: 25 July 2026 Last updated: 30 July 2026

RotaChief ("RotaChief," "we," "us," or "our") provides staff scheduling software through rotachief.com (the "Service"). This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the rights you have regarding your information.

If you have questions about this Privacy Policy or how we handle your personal data, contact us at hello@rotachief.com.

---

1. Who this policy applies to

This policy covers two types of people:

• Business owners / managers ("Customers") — the person or business that signs up for a RotaChief account.
• Staff members — employees whose names, contact details, and schedules are entered into RotaChief by a Customer. Staff members do not sign up directly; their data is entered on their behalf by their employer (the Customer), who is responsible for having a lawful basis to do so (e.g., their employment relationship).

If you are a staff member and have questions about how your employer is using RotaChief, please contact your employer directly in the first instance, as they control that data. You can also contact us at hello@rotachief.com.

---

2. What data we collect

From Customers (business owners/managers)

• Name, email address, password (encrypted)
• Business name, business address, timezone, currency, plan/subscription tier
• Location details (addresses, operating hours, staffing targets)
• Payment-related information — note: RotaChief does not directly process or store your card/payment details. Billing is handled by a third-party payment processor (see Section 5).

From Customers, about their staff

• Staff full name, role, phone number, email address
• Notification preference (email/SMS/WhatsApp)
• PIN (for kiosk clock-in use) is stored as a one-way cryptographic hash and is never stored in plain text. It is used solely to verify identity during shared-device clock-ins.
• Scheduling data: shifts, days off, roster assignments, employment type

Automatically collected

• Login timestamps, IP address, device/browser type (for security and fraud prevention)
• Usage data (e.g., pages visited, features used) to help us improve the product
• Questions submitted to the in-app AI assistant, and the underlying staff/roster data used to answer them (see Section 6)
• Cookies and similar technologies used for authentication, remembering preferences, maintaining security, and improving the Service

We do not collect

• We do not currently collect biometric data, precise geolocation tracking, or payment card numbers directly.

---

3. How we use data

We use the data described above to:

• Provide, operate, and maintain the Service (roster creation, publishing, notifications)
• Authenticate accounts and secure the platform
• Send transactional notifications (e.g., schedule emails via Resend) to staff on behalf of the Customer
• Power the in-app AI assistant and Insights reporting, strictly scoped to a business's own data
• Communicate with Customers about their account, billing, or product updates
• Monitor, debug, and improve the Service
• Comply with legal obligations

We do not sell your personal data. We do not use your business or staff data to train AI models. Data sent to third-party AI providers is used solely to generate responses to your own requests, in accordance with their API services and applicable terms (see Section 6).

---

4. Data isolation between businesses

Each business's data is logically isolated in our database (via Row Level Security) so that one business cannot access another business's staff, roster, or account information. Only authorized users of a given business (based on their login) can view that business's data.

---

5. Third parties we share data with

We use the following service providers ("subprocessors") to operate RotaChief. Each only receives the data necessary to perform its function:

We do not permit these providers to use your data for their own purposes beyond providing their service to us. We carefully select our service providers and only share the minimum information necessary for them to perform the services they provide on our behalf.

If we add or change subprocessors in a way that materially affects how your data is handled, we will update this policy.

---

6. AI assistant and Insights features

RotaChief's AI assistant and Insights AI summaries use the Anthropic Claude API to answer natural-language questions about your own business's staff and roster data. When you use these features:

• Only data belonging to your own business is included in the request sent to generate a response.
• Responses are generated in real time and are not used by us or Anthropic to train models on your specific data beyond standard API terms.
• AI responses are generated from the information available in your account at the time of the request. While we aim to provide accurate responses, users should review AI-generated information before relying on it for operational decisions.
• You should avoid entering sensitive personal data (e.g., health information, government ID numbers) into free-text fields or AI assistant questions beyond what's necessary for scheduling.

---

7. Cookies

RotaChief uses cookies and similar technologies to:

• Keep you signed in to your account
• Remember your preferences and settings
• Maintain the security of the Service
• Understand how the Service is used so we can improve it

You can control cookies through your browser settings, although disabling certain cookies may affect how parts of the Service function.

---

8. Data retention

• We retain account and roster data for as long as your account is active.
• If your account is deleted, we will delete or anonymize your personal data within 90 days, unless we are required to retain certain information for legal, accounting, tax, fraud prevention, or dispute-resolution purposes.
• Staff data entered by a Customer is retained as long as that Customer's account is active, or until the Customer removes the staff member.

---

9. Legal basis for processing

Where applicable under laws such as the UK GDPR or EU GDPR, we process personal data on one or more of the following legal bases:

• To perform our contract with you (providing the Service)
• To comply with legal obligations
• For our legitimate business interests (such as improving and securing the Service)
• With your consent, where required by law

---

10. Your rights

Depending on your location, you may have rights to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Request a copy of your data in a portable format
• Withdraw consent, where processing is based on consent

To exercise any of these rights, contact us at hello@rotachief.com. If you are a staff member whose data was entered by an employer, we may need to direct your request to that employer, who controls the data, but we will assist where we can.

For EU/UK/EEA users: We act as a data processor with respect to staff data entered by a Customer, and the Customer (business) acts as the data controller. For Customer account data, RotaChief acts as the data controller.

---

11. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS), encrypted password storage, secure PIN hashing, and database-level access controls (Row Level Security). Where supported by our infrastructure providers, data is also encrypted at rest. While no system can guarantee absolute security, we take reasonable steps to protect your information and will notify affected users of any data breach where required by applicable law.

---

12. International data transfers

RotaChief is operated from Nigeria and uses service providers based in various countries (including the United States and the European Union). By using the Service, you acknowledge that your data may be processed outside your home country. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for such transfers.

---

13. Children's privacy

RotaChief is not directed at children, and we do not knowingly collect data from individuals under the age of 16 in the context of Customer or staff accounts.

---

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify Customers by email or through an in-app notice. The updated Privacy Policy will apply from the effective date shown at the top of this page.

---

15. Contact us

If you have questions about this Privacy Policy or how your data is handled, contact us at:

Email: hello@rotachief.com

Website: https://www.rotachief.com