Privacy Policy

Last updated 24 August 2026 · Version 1.0

RotaFlux is workforce management software for hospitality businesses. It handles rotas, clock-ins, worked hours and team communication. This policy explains what personal data passes through RotaFlux, why, and what rights people have over it.

Who is responsible for your data

RotaFlux is sold to employers. That split matters legally:

Your employer is the data controller. They decide which staff are on the system, what shifts are recorded, and how long records are kept. If you are an employee using RotaFlux, your employer is the first place to take any question about your data.
Rayan Tahir Khan, trading as RotaFlux, is the data processor. We host and operate the software on the employer's behalf, and only process personal data on their instructions.

Where we act as a controller in our own right — for example over the account details of the person who signs up, and our own service logs — this policy applies to us directly.

Our details: Rayan Tahir Khan, an individual developer trading as RotaFlux, based in the United Kingdom. Contact: privacy@rotaflux.co.uk.

What we collect

Category	What it is	Where it comes from
Account	Name, email address, password (stored only as a salted hash), role and permissions within a shop.	Entered by you or by your manager when your account is created.
Employment	Home shop, contracted minimum and maximum weekly hours, trained stations, employment start and end dates.	Entered by your manager.
Clock-in PIN	A short PIN for the shop time clock. Stored only as a hash — we cannot read it back.	Set by you or your manager.
Time and attendance	Clock-in and clock-out times, breaks, which shift the punch belongs to, whether it came from the kiosk or a manager, manager notes and corrections, and the resulting worked hours.	Generated when you use the time clock, or entered by a manager.
Clock-in photo	A small photo taken at the moment of clocking in or out, only where your employer has switched this feature on for the shop. It is used solely to confirm that the right person made the punch. Breaks never capture a photo.	The shop's time clock device.
Kiosk devices	Device name, a hashed pairing token, when it was paired and last seen.	Recorded when a manager pairs a tablet as a shop time clock.
Mobile app and notifications	A push notification token, the platform (iOS or Android) and the device name, so we can send clock-in alerts to the right handset. For browser notifications, a push endpoint and browser identifier.	Created by Apple or Google when you allow notifications, and sent to us by the app.
Technical	Server logs including IP address, request time and error traces, kept for security and debugging.	Generated automatically when you use the service.

We do not collect location data, contacts, advertising identifiers or browsing activity, and we do not track you across other apps or websites.

Why we process it, and on what legal basis

To run the service — showing rotas, recording hours, sending notifications. Necessary for the performance of your employer's contract with us, and of your contract with your employer.
To keep accurate working time records — clock-in data underpins pay and working time compliance. A legal obligation on your employer.
To keep the service secure — logs, hashed PINs and device pairing exist to prevent someone clocking in as somebody else. Our legitimate interest, and your employer's, in a trustworthy record.
Clock-in photos — where enabled, these verify identity at the time clock. Your employer is responsible for telling staff this is switched on and for justifying it; we provide it as an option, switched off by default.

The mobile app

The RotaFlux mobile app shows your shop's clock-in feed and your rota. Specifically:

It signs in with the same email and password as the web app. The session token is held in the device's secure keychain, not in ordinary app storage.
It asks permission to send notifications after you sign in, never on first launch. Declining leaves the rest of the app fully working.
Signing out removes the push token from our servers, so a shared handset stops receiving another person's notifications.
It contains no analytics SDK, no advertising SDK and no third-party trackers.

Who we share it with

We do not sell personal data and we do not share it for advertising. We use a small number of service providers who process data on our behalf:

Provider	What for	Where
Railway	Application hosting and the main database	EU West (Amsterdam, Netherlands)
Railway object storage	Storage of clock-in photos, where that feature is enabled	EU West (Amsterdam, Netherlands)
Expo	Delivery of push notifications to the mobile app	United States
Apple and Google	The push notification networks that reach your device	Global
OpenRouter	Powers the in-app assistant. Text you type into the assistant, and the rota and staffing data needed to answer it, are sent to this provider.	United States

We will also disclose data where we are legally required to.

Where your data is held

Our database, application servers and stored photos are all in EU West (Amsterdam, Netherlands). Transfers from the UK to the European Economic Area are covered by the UK’s adequacy regulations. Push delivery and the in-app assistant reach providers in the United States; those transfers rely on the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses.

How long we keep it

Clock-in and rota records — kept for 3 years after the end of the relevant tax year. Working time records must be kept for 2 years and payroll records for 3, so 3 years covers both.
Clock-in photos — kept while the punch they belong to is kept, and deleted on request at any time. A photo only needs to outlive any dispute about that punch, so we will delete one as soon as you or your employer asks.
Account records — kept while your employer's account is active, and deleted 30 days after it closes.
Push tokens — deleted as soon as you sign out or uninstall.
Server logs — kept only as long as they are useful for security and debugging, and never used for any other purpose.

Your rights

Under UK data protection law you have the right to access your data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, and to receive your data in a portable form.

Because your employer controls your employment records, the fastest route is to ask your manager — they can correct a mis-recorded shift or clock-in immediately from within RotaFlux. If you would rather come to us, or your employer does not respond, contact us at privacy@rotaflux.co.uk and we will pass the request to the relevant employer and assist them in answering it.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Deleting your account

RotaFlux accounts are created by employers, not by individuals signing themselves up, and an account is tied to employment records your employer is legally required to keep. To have your account closed, ask your manager or contact us at privacy@rotaflux.co.uk. We will action deletion requests within 30 days, subject to the retention obligations above.

Security

All traffic is encrypted in transit with HTTPS.
Passwords and clock-in PINs are stored only as hashes and cannot be recovered by us or by your manager.
Each business's data is isolated from every other business on the platform.
Access to shop data is limited by role, and sensitive changes are written to an audit log.
Mobile session tokens are stored in the device's operating system keychain.

Children

RotaFlux is a workplace tool and is not directed at children. Where an employer lawfully employs someone under 18, their records are handled exactly as any other employee's, under the employer's responsibility.

Changes to this policy

We will update this page when our practices change and revise the date at the top. Material changes will be notified to account administrators by email.

Contact

Questions about this policy or about how your data is handled: privacy@rotaflux.co.uk, by email.