Privacy Policy

This policy explains, in plain English, what personal data RotaHQ collects, why we collect it, and the rights you have under UK GDPR.

Business data (from restaurant managers):

• Business name and contact details
• Email address and password (stored hashed — we can never read it)
• Billing information (handled via Stripe)
• Subscription plan and payment history

Employee data (entered by the restaurant):

• Employee names and roles
• Phone numbers (for WhatsApp notifications)
• Clock in/out times and attendance records
• Wage rates and payslip data
• Leave requests and approval history

Usage data (automatically collected):

• IP address and browser type
• Pages visited and features used
• Error logs for debugging

We use data to:

• Provide and operate the RotaHQ service
• Process subscription payments
• Send WhatsApp notifications to staff (only with the restaurant's instruction)
• Improve the platform
• Respond to support requests
• Comply with legal obligations

Legal basis (UK GDPR):

• Contract — to provide the service you paid for.
• Legitimate interest — to improve the platform and keep it secure.
• Legal obligation — to comply with UK law (for example tax record keeping).

We only share data with the services needed to run RotaHQ:

• Twilio (WhatsApp/SMS delivery) — privacy: twilio.com/privacy
• MongoDB Atlas (database hosting) — privacy: mongodb.com/privacy-policy
• Stripe (payment processing) — privacy: stripe.com/privacy
• Emergent (hosting infrastructure)

We never sell data to third parties. We never share employee data with anyone outside the restaurant's own management team.

• Data is stored in the UK and EU.
• All transfers comply with UK GDPR.
• Data is encrypted in transit and at rest.

• Active account: data is kept while you are subscribed.
• Cancelled account: data is kept for 30 days, then permanently deleted on request.
• Payment records: kept for 7 years (UK legal requirement).
• Usage logs: kept for 90 days.

You have the right to:

• Access your data (request a copy)
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict how we use your data
• Data portability (export in a common format)
• Object to processing

To exercise any right, email htetminaung.dev@gmail.com. We will respond within 30 days.

Restaurants using RotaHQ are the data controller for their employees' personal data. RotaHQ acts as the data processor on their behalf (see our Data Processing Agreement).

Restaurant managers are responsible for:

• Informing their staff that RotaHQ is used
• Having a lawful basis to process staff data
• Complying with employee data rights

We use only essential cookies required to keep you logged in. We do not use advertising or tracking cookies. See our Cookie Policy for details.

For privacy questions: htetminaung.dev@gmail.com

To make a complaint to the regulator: