Privacy Policy
Last updated: 29 July 2026
This Privacy Policy explains how Advanced Payment Ecosystems, trading as Truli (company number 14493115, registered office at Unit 14 Sundon Business Park, Dencora Way, Luton, England, LU3 3HP) ("Truli", "we", "us") collects and uses personal data through RotaIQ (the "Service").
Who's the data controller? If you're a business (owner/manager) using RotaIQ to schedule your own staff, you are the data controller for your staff's personal data — you decide what data to enter and why. Truli acts as your data processor, running the software on your behalf under a contract (these Terms). If you're an employee using RotaIQ because your employer invited you, your employer is the data controller for your records — direct questions about your data as an employee to them first, though we're happy to help too.
1. What we collect
| Category | Examples |
|---|---|
| Account/business data | Owner name, business name, email, phone number, business type, chosen locations |
| Staff records | Name, department/role, date of birth, contact details, emergency contact, pay rate or salary, NIC category, pension opt-in status, start date |
| Scheduling data | Rotas, shifts, published schedules, shift swap/offer requests, shift acknowledgements |
| Attendance data | Clock-in/out times, and — only where clock-in geofencing is enabled — the device's location at the moment of clocking in or out (not tracked continuously) |
| Leave data | Leave requests, approvals/declines, leave type and dates, availability preferences |
| Device data | A device token for push notifications, if you enable them on the mobile app |
| Usage/technical data | Login timestamps, an activity log of actions taken in your account, basic error/delivery logs for emails we send on your behalf |
2. Why we process it
- To provide the Service — building rotas, tracking attendance and leave, sending the notification emails you or your employer has enabled (invites, published-rota notices, shift offers, leave decisions, and alert emails).
- To keep accounts secure — authentication, detecting suspicious access.
- To support you — responding to support requests.
- Legal basis — for account owners, processing is necessary to perform our contract with you (these Terms). For staff/employee data entered by an account owner, we process it as a processor on the controller's instructions; the controller's own legal basis (typically necessary for their employment contract with you, or their legitimate interests in running their business) applies.
3. What we don't do with your data
We don't sell personal data. We don't use staff scheduling or pay-related data for advertising. Figures RotaIQ calculates or displays around pay, tax, National Insurance, or pension are, as explained in our Terms of Use, estimates for planning purposes only — RotaIQ is not a payroll or tax filing system, and we don't submit anything to HMRC or any tax authority on your behalf.
4. Who we share it with
We use a small number of trusted service providers (sub-processors) to run RotaIQ:
- Supabase — our database and authentication provider, where your account and staff data is stored.
- Resend — sends transactional emails on your behalf (invites, notifications).
- Firebase Cloud Messaging (Google) — delivers push notifications to the mobile app, if enabled.
- Netlify — hosts the application and the functions that send emails and run scheduled checks.
We don't share your data with any other third party except where required by law, or with your consent.
5. How long we keep it
We keep account and staff data for as long as your account is active. If you delete your account, access is suspended immediately, but data isn't erased instantly — this gives you (or your employer, if you're an employee) a window to have it restored if a deletion was a mistake. You can request permanent erasure at any time by contacting us. Some operational logs (such as the internal activity log) are automatically deleted on a rolling basis after a shorter, fixed period.
6. Your rights
Under UK GDPR, you have the right to access, correct, or request erasure of your personal data, to object to or restrict certain processing, and to data portability. If you're an employee, some of these requests are best directed to your employer (the data controller) first, but you can also contact us directly and we'll help route it appropriately. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you believe your data has been mishandled.
7. Cookies and local storage
RotaIQ uses your browser's local storage to remember things like your chosen light/dark theme and session — not third-party advertising or tracking cookies.
8. Children
RotaIQ is a business tool for employers and their staff, and isn't directed at children. Staff records may include employees who are 16 or 17, entered by their employer as part of normal employment scheduling.
9. Changes to this policy
We may update this policy from time to time; we'll post the new version here with an updated date, and let you know if a change is material.
10. Contact us
Questions about this policy, or to make a data request, contact support@truli.co.uk.
← Back to RotaIQ