Privacy Policy

Rota · Version 1.0 · Effective 12 September 2026

1. Who we are

This Privacy Policy explains how the operator of Rota (“we”, “us”) handles personal information in connection with the Rota application and related websites (the “Service”).

Contact for privacy enquiries: insert email and postal address.

2. Scope

This policy covers personal information we process when:

• you create or use a Rota account;
• you are invited to a company workspace;
• you use features such as SOPs, inspections, assets, corrective actions, training, documents or chat; or
• you contact us for support.

If your organisation is the Customer, it may also control how personal information is entered into the Service. In that case we often act as a service provider processing information on the Customer’s instructions.

3. Information we collect

Account and profile

• Name, email address, user ID / user code, role, company association, active status
• Authentication data managed by our auth provider (for example session tokens); we do not store your password in our application database in plain form

Operational content you or your company enter

• Procedure (SOP) content, inspection answers, asset details, corrective actions, training records, documents and metadata, chat messages
• Names or identifiers of people recorded in those workflows (for example inspector name)
• Files you upload (for example logos or attachments), stored in secured object storage paths scoped by company where configured

Technical and usage

• Browser or device information needed to run the app, approximate logs for security and diagnostics
• Local device storage (for example session markers, UI preferences, cached company data for performance)
• Idle/session timing signals used to sign you out after inactivity

Demo mode

If you use a local demo workspace, sample data may remain only in your browser and not be sent to our servers.

4. How we use information

• Provide, operate, secure and support the Service
• Authenticate users and enforce role and company access controls
• Sync and store operational records for your company workspace
• Send transactional messages (for example invite or password emails) via email infrastructure
• Monitor reliability, prevent abuse and improve the product
• Meet legal obligations

We do not sell personal information.

5. Legal bases / compliance context

Depending on your location and our status under applicable law, we handle personal information because it is needed to perform a contract (providing the Service), with consent where required, or for legitimate interests such as securing the platform—balanced against your rights. Australian users may have rights under the Privacy Act 1988 (Cth) where it applies to us.

6. Multi-tenant isolation

Company workspaces are separated using account authentication and database access policies designed so users only access data for their company (and platform operators only as required to run the system). You must not attempt to access another organisation’s data.

7. Sharing and subprocessors

We use specialist providers to run the Service. Categories include:

• Application hosting (for example Netlify or similar static/app hosting)
• Database, authentication and file storage (for example Supabase / underlying cloud infrastructure)
• Email delivery for invites and account messages (provider as configured)

These providers process information on our instructions to deliver the Service. We may also disclose information if required by law, or to protect rights, safety and security.

8. Overseas storage

Infrastructure providers may process data in Australia or other countries depending on project configuration. If data is stored overseas, it may be accessible under those countries’ laws. Choose and document your hosting region deliberately for customer expectations.

9. Retention

• Account and operational data are retained while the company workspace is active and as needed to provide the Service.
• After account or company deletion, we aim to remove or de-identify personal information within a reasonable period, subject to backups and legal retention needs.
• Local browser caches should be cleared on logout from that device; residual device storage is under the user’s control.

10. Security

We implement technical and organisational measures appropriate to a multi-tenant business app, including encrypted transport (HTTPS), authentication, session controls, and server-side access rules. No method of transmission or storage is completely secure. Report suspected security issues promptly to our contact address.

11. Your choices and rights

Depending on applicable law, you may request access to, correction of, or deletion of personal information we hold about you, or raise a privacy complaint. Company admins can often update teammate profile fields inside the Service. Start by contacting your company admin or us at the address above.

You can request to sign out and may be signed out automatically after inactivity.

12. Children

The Service is directed at workplace users, not children. We do not knowingly collect personal information from children under 16.

13. Changes

We may update this Privacy Policy by posting a new version in the Service with a revised effective date. Significant changes may be highlighted in-product or require acknowledgement.

14. Related documents

Use of the Service is also governed by our Terms of Service.