Privacy Policy

Work Rota is provided by the workplace that invited you (your employer) together with the operator of this app. Your employer decides who is on the rota and what settings are switched on; the app operator runs the software on their behalf. If you are a member of staff, contact your manager first — you can also reach the app operator at privacy@marised.co.uk.

• Account details — name, email address, password (stored hashed by our authentication provider) and your role in the workplace.
• Work data — shifts, availability, holiday allowances and requests, swap and time-off requests, notes attached to them, position and pay rate where your employer records one.
• Clock-in records — the time you clock in and out and, where your employer has enabled site checks, your approximate location or network address at that moment so the app can tell whether the clock-in was on site.
• Off-site check-in photos — an optional photo taken at clock-in. A photo is only stored when a clock-in is flagged as off site, so a manager can review it.
• Notifications and email — a record of rota emails and notifications sent to you, and whether they were delivered.
• Activity logs — changes to the rota, access permissions and holiday balances, including who made the change and when.

To build and publish rotas, record worked hours, manage holiday and absence, verify attendance, produce payroll and attendance reports, and keep the account secure. Under UK/EU data protection law this is based on your employer's legitimate interest in running the workplace and on their legal obligations around working time and pay. Location checks and check-in photos are used only to confirm attendance and are reviewed by managers in your workplace.

Clock-in location records and off-site check-in photos are kept for 90 days and then deleted. Rota, holiday, attendance and payroll records are kept for as long as your workplace account is active, or longer where your employer must keep them for tax or employment record-keeping. Account details are deleted when the workplace account is closed.

We do not sell personal data. Data is visible to authorised people in your workplace (owners, managers and staff given full access). We use service providers to run the app: Lovable Cloud (application hosting, database, authentication and file storage) and our email delivery service for rota and account emails. Where your employer connects a payroll system, timesheet data is sent to that system at their instruction.

Access is protected by password authentication and per-workplace access rules, so people only see data for their own workplace. Check-in photos are stored in private storage and are opened through short-lived links for authorised managers only. Data is encrypted in transit. No system can be guaranteed free of risk; if you believe an account has been compromised, contact us immediately.

The app stores a sign-in session in your browser so you stay logged in. We do not use advertising cookies or third-party tracking.

You can ask for a copy of your data, ask for corrections, ask for deletion, object to certain processing, or withdraw consent where consent was the basis. Email privacy@marised.co.uk or speak to your manager. If you are in the UK you can also complain to the Information Commissioner's Office (ico.org.uk).

If you find a security problem, email privacy@marised.co.uk with the details. Please do not publish the issue before we have had a chance to fix it.