Privacy Policy

Last updated: 1 August 2026

RotaGrid (“we”, “us”) provides shift-scheduling software. This policy explains what personal data we process, why, and the choices you have. We act as a data controller for account data and as a data processor for the schedule data you enter on behalf of your organization.

Data we process

• Account data: name, email address, and authentication identifiers (via Auth0).
• Organization and schedule data you create: workers, shift templates, shifts, assignments, contracts, absences and related notes. This may include limited employment information such as absence reasons.
• Billing data: processed by Stripe; we store subscription status and customer identifiers, not card numbers.
• Usage and technical data: request logs, IP address, and error diagnostics used to operate and secure the service.
• Optional integrations: Telegram user identifier if you link Telegram; email address if you join the waitlist.

How we use it

• To provide, maintain and secure the service.
• To authenticate you and manage your organization and roles.
• To process payments and manage subscriptions.
• To send transactional email (e.g. invitations, account notices).
• To diagnose problems and prevent abuse.

Legal bases (EEA/UK)

We rely on performance of a contract (to provide the service), legitimate interests (to secure and improve the service), consent (for marketing email, which you can withdraw at any time), and legal obligation (e.g. tax records).

Sub-processors

We share data with the following processors to run the service:

• Auth0 (Okta): Authentication and identity management.
• Stripe: Payment processing and billing.
• Resend: Transactional email delivery.
• MailerLite: Marketing/waitlist email.
• Telegram: Optional assistant chat interface.
• Amazon Web Services (S3): Encrypted database backups.
• Hetzner Online GmbH: Application hosting (Germany, EU).
• OpenRouter: LLM gateway: receives the assistant's prompts and routes them to the model provider below.
• OpenAI: LLM features (the default model for the assistant, compiling guidelines into solver constraints, and generating each guideline's detection check).
• Anthropic, DeepSeek, Google, Z.ai: LLM features, where a user selects one of their models instead of the default.

When you use the assistant, the schedule data needed to answer you (worker names, shifts, absences and related records) is sent to the LLM gateway and on to the provider of the model in use. You can see which model is selected, and change it, from the assistant itself. We instruct the gateway to route only to providers that do not train on the data we send them.

International transfers

The application and backups are hosted in the EU (Germany). Some sub-processors, including the LLM gateway and model providers, may process data outside the EEA under appropriate safeguards such as Standard Contractual Clauses.

Data retention

We retain account and schedule data for as long as your account is active. When you delete your account, associated personal data is deleted from the live database, and encrypted backups age out on a rolling basis (within 90 days). Billing records may be retained longer where required by law.

Your rights

Subject to applicable law you may access, correct, export or delete your personal data, and object to or restrict certain processing. You can delete your account from your profile page, or contact us to exercise any of these rights.

Cookies

We use first-party cookies only: one to keep you signed in, one to remember the language you chose, and, if you arrived through a partner or referral link, one that records which link that was so the partner can be credited. We do not use third-party advertising or cross-site tracking cookies.

Contact

Questions or requests: [email protected].