Legal
Version 2026-10-04 · last updated 4 October 2026
Account information you give us when you sign up: your email address, mobile number and a password. Employee names, eligible roles, contracted hours and pay rates that a manager enters to build a rota — we do not ask managers for their employees' email addresses or phone numbers, and don't collect them. Where a manager enters it, we also hold an employee's date of birth — used to apply the correct working-time limits for staff under 18 and to flag pay that's below the National Minimum Wage rate for their age band — and we treat it with the same care as any other sensitive personal data. We also hold whether a signed 48-hour opt-out is on file for that employee, and any absence records (including sickness, maternity, paternity and other leave) a manager enters. Our hosting provider's standard request logs record which pages were requested and when, for diagnosing problems; we do not otherwise track which pages you visit or which actions you take in the app.
To run the product (building rotas, matching clock-ins, generating timesheets and payroll exports, and applying the correct working-time limits for staff marked under 18 or identified as regular night workers) and to respond if you contact us for support.
We use a small number of providers to run the service: Vercel (application hosting), Supabase, our database and hosting provider, Stripe (subscription payments — your card and billing details go to Stripe, and we do not store full card details ourselves), Resend (sending account emails — sign-up verification, password reset, receipts and similar) and Twilio (SMS verification of the mobile number you sign up with). Resend and Twilio are normally used only for your own account email address and phone number, never your employees' data; on rare occasions — such as a notice about a change affecting named staff, or an error report sent to us for debugging — an email sent through Resend may include an employee's name. We do not sell your data, and we do not share it with advertisers, because we don't run any advertising.
Your venue's data in Quickrota is deleted from live systems within 90 days of your account being cancelled, or of a trial pausing with no payment method added. Copies held in our database provider's automatic backups are removed when those backups age out on their normal retention cycle. This covers data Quickrota itself controls; it doesn't cover Stripe's own billing/tax records or Resend's/Twilio's own message logs, which those providers keep under their own policies. We'll email you around 14 days before your data is permanently deleted, with instructions for exporting it first, in case you want to come back. Email us at any time if you'd like your data deleted sooner.
You can ask to see, correct, export or delete the data we hold about your account or your team, at any time, by emailing support@quickrota.co.uk.
Quickrota sets three cookies of its own, all strictly necessary and none used for tracking: one to keep a manager signed in, one to keep a staff member signed in to the staff app, and one to remember whether you chose the light or dark theme. Your browser may also store a small amount of data locally (for example a paired on-site terminal's device token, and your theme choice) — that stays on your device and is never sent to us as a cookie.
We run no analytics, tracking or advertising cookies at all. If you go through checkout, Stripe — a separate site you're redirected to for payment — sets its own cookies there, outside our control.
On our public website we count page views and button clicks in aggregate — how many people visited a page or clicked "Start free trial" on a given day, and which printed letter or campaign a visit came from. Those counts are made without cookies and without any identifier that could single you out: no IP address, device fingerprint or browser identifier is stored. If you sign up, we keep the campaign code you arrived with against your account so we know which letters work.
Questions about this policy: support@quickrota.co.uk.