Service Rota privacy notice

Version 1.4 · 3 October 2026

Who is responsible

Mediacorp Global Ltd, registered in Scotland (SC820224), operates Service Rota. Our correspondence address is c/o 145 Vincent St, Glasgow G2 5JF, United Kingdom. Contact rota@mediacorpglobal.com for privacy questions or requests.

We determine how customer account, support and service-security information is used. The venue operator determines why its staff information is entered and used for scheduling; we process that information to provide the service on the operator’s instructions. Staff should normally contact their venue operator first about a rota record. We can help identify the appropriate route without disclosing another customer’s information.

Information we process and why

• Account email, account identifiers and authentication information: to sign you in, protect your account and send requested confirmation or recovery messages.
• Your account identifier, the terms version and source fingerprint, and the time you explicitly agree: to record your service-terms agreement. This record does not include your password, IP address or browser details.
• Venue settings, staff names, departments, shifts, pay rates, absence markers, notes, forecasts and uploaded logos: to save your planning work, calculate estimates and produce the exports you request.
• Store purchase identifiers, subscription status and periods, account bindings and encrypted purchase evidence: to verify access, restore subscriptions and prevent unauthorised reuse.
• For a Windows or web subscription, Stripe customer, checkout and subscription identifiers, plan, payment status and billing periods: to confirm payment, provide access, manage renewal and handle billing queries.
• Support correspondence and technical request information, such as IP addresses, timestamps, device/browser information and error status: to answer requests, operate the service and investigate security or reliability issues.

Account details come from you and the authentication service. Rota information comes from the venue operator; purchase status comes from Apple, Google or Stripe. Only enter information needed for scheduling. A sickness marker can reveal health information: the operator must have an appropriate lawful basis and special-category condition where required. Do not put diagnoses, medical records, payment-card numbers or identity documents in rota notes.

Legal bases

For information we control, we rely on performing our contract with you, our legitimate interests in securing and maintaining the service and handling support, and legal obligations where applicable. If you act for a business, administration of that business relationship is also a legitimate interest. Optional marketing would require its own appropriate basis; this service does not use rota information for advertising.

Venue operators are responsible for their own staff notices and lawful grounds. Creating an account does not amount to an employee’s consent to their employer’s processing. We do not use the app to make employment decisions about staff; people remain responsible for scheduling and employment decisions.

Service providers and recipients

Cloudflare provides application hosting, security and database storage. Supabase provides authentication and handles confirmation and recovery requests through our configured email-delivery provider. Authorised support personnel and professional advisers may process information needed for their work. We may disclose information where legally required, or to protect legal rights and investigate misuse.

Apple and Google process store accounts, payments and purchases under their own terms and privacy notices. Stripe processes Windows and web payments through its hosted checkout and customer portal under its own privacy notice. Service Rota receives purchase identifiers and status, not your complete payment-card details.

Monterey Jacks Franchising UK Ltd (SC614524), the seller of Windows subscriptions purchased through Stripe, receives the associated payment and billing information to administer purchases and handle billing enquiries. Contact Service Rota support above for help with billing or privacy enquiries.

Provider information: Cloudflare privacy, Supabase privacy, Apple privacy and Google privacy.

International processing

Our providers operate internationally, so processing and authorised support may take place outside your country, including outside the UK and EEA. Applicable transfer rules require an adequacy decision or another valid safeguard, such as approved contractual clauses. Contact us for details of the countries and safeguards relevant to your service. We do not promise that every copy, log or support operation stays in the UK.

How long information is kept

Account and rota information remains while your account is open, including after a trial or subscription ends, so that ending payment does not silently erase your work. Request account deletion when you no longer need the service. Export anything you need before deletion.

Service-terms acceptance records are kept while the account exists and are removed when account deletion begins. Terms versions remain in our release history without your personal acceptance record.

The account-deletion process removes the account’s application records, rotas, venue, logos, manager access and retained purchase evidence, and requests deletion of its authentication identity. A minimal record of the deleted identity, account identifier and deletion progress is retained separately to reject old sessions and safely retry incomplete deletion. It contains no saved rota or password. There is currently no automatic expiry for that security record; retention requests can be reviewed by support.

For a Windows or web subscription, deletion first confirms cancellation with Stripe. We separately retain the account and Stripe customer identifiers, the cancelled subscription identifiers and terminal status, and deletion timestamps to investigate billing queries and prevent unsafe retries. This financial deletion record contains no email, rota, card information or receipt payload. It currently has no automatic expiry; support reviews requests concerning its continued retention. If cancellation cannot be confirmed, deletion pauses and the account data is preserved so the operation can be retried safely.

Support correspondence is kept while needed to resolve a request and any related dispute or legal obligation. Infrastructure logs and backups follow the relevant provider’s retention and recovery arrangements; removing active records does not promise immediate erasure from every backup. Store transaction records remain subject to Apple’s or Google’s retention obligations. Contact us for a case-specific explanation of retained records.

Security, cookies and exports

We use HTTPS, account-scoped access controls and separate manager access for restricted rota information. Sign-in and security cookies are necessary for these functions. Purchase evidence retained by Service Rota is encrypted. This does not mean that all staff records are end-to-end encrypted. The checked app has no advertising SDK or advertising-ID tracking.

Exports and shared rota images are controlled by the person who creates or shares them. Protect downloaded files and share them only with appropriate recipients; deleting an account cannot recall copies you have already shared.

Your rights and complaints

Depending on the applicable law and circumstances, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent where processing relies on consent. Some rights have exceptions. We may need to verify your identity; never email a password or verification code.

Contact us at the address above or see account deletion. You may complain to the UK Information Commissioner’s Office or your local data-protection authority. You do not have to contact us before doing so.

Changes and intended users

Service Rota is designed for adult business operators and managers, not children’s personal use. We will update this notice when processing changes and give an appropriate notice of material changes. The date and version above identify this notice.