Privacy Policy

Who we are

Rota is provided by Mohammad Arif, trading as Rihsafira, of 180 Harts Lane, Barking, IG11 8NB, United Kingdom. For any privacy questions, contact support@rihsafira.store. We are the data controller for the information described below.

What we collect

• Account information: your name, email address, and password (never stored in plain text).
• Business data: business name, employee names, job titles and hourly rates entered by administrators.
• Rota data: shifts, availability, and holiday requests you or your administrator create.
• Billing information: handled directly by Stripe; we never see or store full card details.
• Usage and log data necessary to operate and secure the service (e.g. sign-in times, error logs).

Why we process it, and our legal basis

We use your data solely to provide the rota-scheduling and labour-budget service you sign up for: authenticating you, running your business's rota, sending the transactional emails described below, and processing subscription payments. Our legal bases under UK GDPR are: contract (processing needed to provide the service you've signed up for), legitimate interests (keeping the service secure and working correctly), and legal obligation (where we must keep records, e.g. for tax purposes on your subscription).

Emails we send

We send transactional emails only: account confirmation, password resets, staff invitations, holiday-request notifications, and rota-publish notices (with the schedule attached as a PDF). Anyone can opt out of rota-publish emails individually from the Settings page. We never send marketing email, and never sell or share your data for marketing purposes.

Data retention and deletion

We keep your data for as long as your account is active, plus a reasonable period afterwards for legal and accounting purposes. You can request a copy of your account data, or request deletion of your business's data, at any time by contacting support@rihsafira.store. We will respond within one month, as required by UK GDPR.

Third parties we use

We use the following data processors, each bound by its own privacy and security terms:

• Supabase — database, authentication and file storage.
• Stripe — subscription payments; Stripe handles and stores all card details, we never see them.
• Resend — delivery of the transactional emails described above.
• Vercel — hosts the application.

Some of these providers may process data outside the UK/EEA, under their own standard contractual safeguards. We never sell your data, and never share it with anyone for advertising.

Your rights

Under UK GDPR you have the right to access, correct, or delete your personal data; to restrict or object to certain processing; and to receive your data in a portable format. To exercise any of these, contact support@rihsafira.store. If you're unhappy with how we've handled your data, you can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Contact

Questions about this policy: support@rihsafira.store.