Privacy policy
Last updated 21 October 2026
Rotawise helps businesses plan staff rotas. That means it holds information about people at work: names, shifts, pay rates and time off. This policy explains what we hold, why, who can see it and the rights you have under UK data protection law.
Who we are
Rotawise is run by Flutterly Ltd, registered in England and Wales. You can reach us about anything in this policy at anoop@flutterly.co.uk.
Our role: controller or processor
Who is responsible for your data depends on how you use Rotawise.
- Your employer is the controller of rota data. When a business uses Rotawise for its team, it decides what goes in: who works which shift, pay rates, leave and so on. We process that data on the business's behalf, as a processor, under our data processing terms. If you work for a business that uses Rotawise and want to see, correct or delete your data, start with your employer. We will help them answer you.
- We are the controller of account and website data. This covers the people who sign up to Rotawise, how they log in, messages sent to us and the running of the service itself.
What we collect
| Data | Examples |
|---|---|
| Account details | Name, email address and a password, stored only as a one-way hash we cannot read. When you sign up we email you a link to confirm the address is yours. |
| Work details | Role, job title, hourly rate, employment type, weekly hours, holiday allowance, usual position and the kinds of shift someone works. |
| Rota data | Shifts, break times, locations, notes on shifts, availability and shift swap requests with any message. |
| Leave | Holiday, sick and other leave: the dates, hours, the type of leave and any reason given. Sick leave is health information, so please keep reasons brief and avoid medical detail. |
| Activity records | An audit log of changes made in each organisation, such as who published a rota or changed someone's role. |
| Technical data | IP address, browser type and request logs, kept by our hosting provider to run and protect the service. A private calendar link is created for each person so their shifts can appear in their own calendar app. |
| Billing | For teams that pay: the owner's name, email and billing address, and the number of people billed. Card details are handled by Stripe. |
| Messages to us | Anything you send when you email us. |
We don't ask for bank details, national insurance numbers or home addresses, and Rotawise isn't designed to hold them.
Why we use it, and our lawful basis
- To provide Rotawise to the businesses that sign up and the people they invite: contract (Article 6(1)(b) UK GDPR) with the account holder, and on the business's instructions for their staff's data.
- To keep it secure and working, including logs, fraud prevention and fixing faults: our legitimate interests in running a safe, reliable service (Article 6(1)(f)).
- To reply to you and send service messages, such as important changes to these terms: legitimate interests, or contract where you're a customer.
- To meet legal duties, such as keeping business records: legal obligation (Article 6(1)(c)).
Where leave records include health information, the employer relies on its own condition for processing it, usually employment law obligations (Article 9(2)(b)). We only process it on their behalf.
We don't sell personal data, use it for advertising, or use it to train AI models.
Who can see it
Inside an organisation, what people can see depends on their role. Staff see the published rota, their own details and their own requests. Pay rates, labour costs and employment terms are limited to managers, admins and owners. Managers also see draft rotas and the requests they need to approve.
We use a small number of trusted suppliers to run Rotawise:
| Supplier | What they do | Where |
|---|---|---|
| Vercel Inc. | Hosts the website and app, and keeps request logs | London, UK (company based in the United States) |
| Stripe | Takes card payments and keeps billing records. We never see or store full card numbers. | United States and Ireland |
| Resend, Inc. | Sends account emails, such as links to confirm an email address | United States |
| Neon, Inc. | Stores the database | London, UK (company based in the United States) |
We may also share data if the law requires it, or with a buyer if Flutterly Ltd or Rotawise is ever sold, in which case this policy would continue to apply.
International transfers
Rotawise's database and app servers are in London, so your data is stored in the UK. Our suppliers are US companies, and some data is processed in the United States: payments are handled by Stripe, account emails pass through Resend, and request logs, monitoring and support may be handled there. Any such transfer is protected by the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework, as set out in each supplier's data processing agreement.
How long we keep it
- Organisation data is kept while the organisation uses Rotawise.
- When an owner deletes an organisation, its rota, team, leave and audit records are deleted straight away. Copies in our database provider's backups are overwritten within 30 days.
- If someone leaves a team, the business can deactivate them. Their past shifts stay in the business's records until the business deletes them or the organisation.
- Unused invitations expire after 14 days.
- Hosting request logs are kept for a short period, normally no more than 30 days.
- Emails to us are kept for as long as needed to deal with them, and up to two years.
Cookies
Rotawise uses one cookie, rw_session, which keeps you logged in for up to 30 days. It's strictly necessary, so it doesn't need consent. We don't use analytics, advertising or tracking cookies.
Keeping it safe
Data is encrypted in transit with HTTPS and at rest by our database provider. Passwords are hashed with bcrypt. Every request is checked against the organisation and role of the person making it, so one business can never see another's data.
Your rights
Under UK GDPR you have the right to:
- ask for a copy of your personal data
- have inaccurate data corrected
- have your data deleted
- restrict or object to how we use it
- receive your data in a portable format
Email anoop@flutterly.co.uk and we'll reply within one month. If your data is held by your employer's Rotawise account, we'll pass your request to them, since they decide what happens to it.
If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Children
Rotawise is a tool for businesses and their staff. It isn't meant for children and we don't knowingly collect their data.
Changes to this policy
If we change this policy we'll update the date at the top. If a change matters, we'll tell organisation owners by email before it takes effect.