Privacy Policy

Rotaalo is currently in early beta. This policy describes what we actually collect and how it's actually handled today. It hasn't been through a formal legal or compliance review, and it will change as the product matures. If you're trialling Rotaalo, please don't store anything highly sensitive (e.g. health information, financial details) until that review has happened.

What we collect

Depending on how you use Rotaalo, this can include:

• Account details: your name, email address, and a hashed (never plain-text) password.
• If you're part of a business: your shifts, unavailability, hours logs, holiday requests, and shift-swap history.
• If you use the personal planner: your bookings/sessions, and any clients, session notes, or milestones you choose to add, including anything you type or transcribe into those notes.

Where it's stored

Data is stored in a managed PostgreSQL database hosted by Neon, in AWS's us-east-2 region. The application itself runs on Vercel. We don't use any third-party analytics or advertising trackers.

Who can see what

This is a deliberate boundary in how Rotaalo is built: if you're staff at a business on Rotaalo, your manager can see your shifts, hours, holiday, and requests, but not your personal planner (bookings, clients, or session notes). That stays yours, whether or not you also work shifts for someone else through Rotaalo.

Voice recording & transcription

If you use the record-and-transcribe feature when logging a client entry, the audio is processed in memory to generate a draft transcript and is not saved to disk or the database. Only the transcript, after you've reviewed and edited it, is stored as part of your entry. You are responsible for making sure anyone you record has agreed to it; Rotaalo shows a reminder before recording starts, but that reminder is not a substitute for your own legal obligations (including UK GDPR and consent law) around recording someone else, especially where notes might touch health information or a minor.

Cookies

We use a single cookie to keep you signed in. That's it: no advertising or cross-site tracking cookies.

Other services we use

Hosting and infrastructure: Vercel and Neon. We do not currently use a third-party email or transcription vendor; those features are early stand-ins (an in-app log and a mock transcript) rather than live integrations, so no data is sent to an external email or speech-to-text provider today.

Deleting your data

Email hello@rotaalo.example and we'll delete your account and everything tied to it.

Contact

Questions about this policy: hello@rotaalo.example.