Privacy policy

Version draft-4

Who is responsible for your data

[To be confirmed: who is responsible for the data. The legal name of the company that provides Rota AI and its registration number.]

You enter data about your staff. For that data you are the one who decides what is stored and why, and we store it for you.

What we store

About you, when you create an account:

• your email address, and whether you have confirmed it;
• your password, as a hash and never as the password itself;
• when you joined and when you last signed in;
• the version of the terms and of this policy that you agreed to, and when.

About your organisation:

• its name, its members and the role of each, and when its trial ends;
• its plan, how many rosters it has asked for each day, and a record that an email about its trial was sent;
• if it has been to the checkout: the ids Stripe gave its customer and its subscription, the state of the subscription and its dates. We do not see or store card numbers.

About your staff, entered by you:

• The set-up of each unit: the people in the team, by the short ids you give them, with their leave and their preferences, your shifts, the cover each shift needs and your rules.
• Names: the name you want shown for each person.
• Email addresses: the address of each person, if you enter one. It is used to email that person the link to a published roster, and for nothing else.
• Rosters: every roster that is built, which says who works which shift, and every roster you publish, kept as it was when you published it with the names shown then.
• Private links: one private link to each unit's published roster, and one for each person's own shifts. Anyone who has a link can open the roster it leads to without an account, until you replace the link.
• Emails to staff: for each email about a published roster, the address it went to and whether it was sent.

Do not enter health information or other sensitive details about your staff. The product does not need them.

We also keep a list of the messages Stripe sends us about subscriptions. It holds ids only: no name, no address, no amount and no card.

Where your data is kept

The database is kept by Hetzner Online GmbH, in its data centre in Helsinki, Finland, outside Australia. [To be confirmed: where the backups are kept.]

The other companies listed under "Sub-processors" below may also handle the data we send them outside Australia.

How long we keep it

• We keep your data for as long as your organisation exists in Rota AI. Nothing is deleted because a trial or a subscription ends: the organisation becomes read-only.
• When you take a person out of a unit, their private link and their email address are deleted. Rosters that were already published still show their name.
• When you delete a unit, its set-up, its rosters, its published rosters, its private links and the record of its emails are deleted.
• Backups are kept for 30 days. Data that you delete can stay in a backup for up to 30 days, and is then gone.
• The server's logs are kept for 30 days. A line of a log holds the time of a request, the address of the page and the internet address it came from.

Deleting your data

The owner of an organisation can delete it at any time, without asking us: on the organisation's page, choose "Delete organisation". This happens at once and cannot be undone.

• It deletes the organisation and everything listed above that belongs to it: its units, their set-up, staff names and email addresses, rosters, published rosters, private links and email records, and its plan and usage.
• It deletes the accounts of its members who belong to no other organisation, the owner's included. A member who also belongs to another organisation keeps their account. An account of our own staff is never deleted this way.
• If the organisation has a paid subscription, the subscription is cancelled first. If we cannot cancel it, nothing is deleted.

After an organisation is deleted we keep one small record: a random id we gave the organisation, the ids Stripe gave its customer and its subscription, and the time it was deleted. We also keep the list of Stripe's messages described above. Neither holds a name or an email address. We keep them so that a late message from Stripe about a deleted organisation is recognised and nobody else's account is changed by it.

Stripe keeps its own records of the payments it took. Emails that were already sent stay with the people who received them.

If you are a member of staff and want your name or your address removed, ask the person who manages your roster. [To be confirmed: a contact address for a request that we should handle ourselves.]

Sub-processors

These are the other companies that handle some of your data for us.

• Hetzner Online hosts the service: the servers it runs on and the database, in Helsinki, Finland. Everything listed above is stored there.
• Stripe takes payments. When an owner first goes to the checkout, we send Stripe the organisation's name and the owner's email address. Stripe collects the card and the billing details itself.
• Resend, the email provider, sends our emails: the ones about your account, the ones about your trial, and the ones that tell staff a roster is published. It handles each address and the words of each email, which for staff include their private link.
• Sentry, the error tracker, records faults in the service so that we can fix them. A record holds the kind of fault, the place in our own code where it happened with the lines of code around it, the kind of page or background task that met it, whether the page was asked for with GET or POST, the lines our service wrote to its own log just before, the database queries it ran, and details of our own server and software. A line of our own log can hold the random id we gave an organisation. Before a record is sent we take out the address of the page, the query, the headers and cookies that came with it, anything typed or uploaded, the account that met the fault, the words of the error message, and the values in the database queries.
• Anthropic, the language-model provider, is used only for changing a unit's rules by typing a sentence, on plans that include it, and only when you use that feature. It is sent the sentence you type and the set-up of the unit, which names staff by their short ids. Names and email addresses are not sent. Do not type personal details into the sentence.

Cookies

We use cookies only to keep you signed in, to protect forms, and to show a message once after an action. We do not use advertising cookies or cookies that follow you to other sites.

Changes and questions

The version of this document is at the top of the page. When we change this policy in a way that matters to you, we email the owner of each organisation at least 30 days before the new version applies. [To be confirmed: a contact address for questions.]