Privacy notice

RotAI is run by [your company name] ([company number]), [your registered address]. This notice explains what we do with personal data. Questions or requests: [contact email]. We are registered with the Information Commissioner's Office ([ICO registration number]).

Two kinds of data, two roles

• Your team's data. When a venue uses RotAI, the venue (the employer) decides what goes in and is the controller. We are its processor: we only use that data to run RotAI for the venue, under our terms. Staff with questions about their data should ask their employer first; we'll help the venue answer.
• Managers' accounts and billing. For the people who sign up and pay, we are the controller.

What RotAI holds

• Manager accounts: name, email, a scrambled (hashed) password, and sign-in times.
• Staff: name, mobile number, email, date of birth or age band, contract and pay rate, roles and skills, availability, time off, emergency contact, right-to-work expiry date, and notes managers write.
• Sickness absence records. These are health data, which the law treats with extra care: only the venue's managers can see them.
• Rotas, shift swaps, cover offers, timesheets and clock-ins. If the venue turns them on, a clock-in may include the phone's location or a photo from the bar tablet; tablet photos are deleted after 30 days.
• Messages and photos sent in team chat, announcements, and requests (anonymous requests are stored without the sender's name). The venue's managers can make a sign-in link for any member of staff and so open the staff app as them, which means staff-to-staff chats aren't private from the venue.
• A copy of each text and email RotAI sends (with sign-in links and codes hidden), notifications, and an audit log of who changed what.
• Questions managers ask Ask RotAI and its answers, so they can look back at past chats.
• If connected by the venue: till takings (Square), bookings (ResDiary) and payroll matches (Xero).
• Billing: plan and payment status. Card details are held by Stripe, never by us.

Why, and the lawful basis

• To provide RotAI to the venue under its contract with us (making rotas, telling staff about shifts, finding cover, working out hours).
• For the venue's own obligations as an employer (working time, minimum wage and right-to-work checks, pay records). For sickness records the venue relies on its employment-law obligations.
• To keep RotAI secure and working (our legitimate interests): sign-in protection, error logs and audit logs.

Who else processes it

We use these suppliers, each under a data processing agreement:

• Hosting, database and backups: Vultr (The Constant Company, LLC), in its data centre in Atlanta, USA.
• Text messages: Twilio. Email: Resend. Push notifications go through the phone's browser maker (Google, Apple, Mozilla or Microsoft).
• AI features: Anthropic, which reads the text needed for the feature (for example a note, a rule or an uploaded rota) to return a result. It isn't used to train their models.
• Payments: Stripe.
• Connections the venue chooses: Square, ResDiary, Xero.

Some of these suppliers are in the USA; transfers are covered by the UK's adequacy regulations or the International Data Transfer Addendum.

How long we keep it

• While the venue's account is open, the venue decides: it can delete staff and data at any time.
• Clock-in photos: 30 days. Chat messages: as long as the venue sets (12 months unless it changes it).
• Copies of texts and emails sent: 90 days. Notifications: 6 months. Audit log: 2 years. Ask RotAI chats: 30 days after the last question.
• When a venue closes its account we delete its data within 90 days, except billing records we must keep for tax (6 years).

Your rights

You can ask for a copy of your data, to correct it, to delete it, to restrict or object to its use, and to move it. Staff should ask their employer; the venue's owner can download all its data from Settings. You can also complain to the ICO (ico.org.uk), though we'd like the chance to help first.

Cookies

RotAI only uses cookies it needs to work: keeping you signed in (separately for managers, staff and the bar tablet), remembering light or dark mode, and joining from the staff-room poster. There are no advertising or tracking cookies, so there's nothing to accept.

Security

Connections are encrypted (HTTPS). Passwords and PINs are stored scrambled; access keys for connected systems are encrypted. Sign-in attempts are limited, and every change to pay and hours is logged.