Privacy policy

Version 2026-09-21 · Effective 21 September 2026

Syba LLC (“SchoolRota”, “we”) provides duty rota and cover management software to schools. This policy explains how we process personal data when you visit our website, when your school uses the service, and when you contact us.

Who is responsible for your data

Schools and trusts subscribing to SchoolRota are the data controllers for the staff personal data held in their portal. They decide what is uploaded and why. SchoolRota acts as a data processor on their instructions, under our Data Processing Agreement.

We are the controller in our own right for a narrower set of data: visitors to our marketing website, prospective customers who enquire or sign up, billing contacts, and support correspondence.

What we process as a processor for schools

Staff names, work email addresses, job titles, and working patterns
Duty assignments, cover allocations, absences, and rota history
Timetable and commitment data imported from a school's MIS or entered manually
Account credentials, roles, and site-level access
Staff app device identifiers, hashed session tokens, and push tokens while the app is signed in
Audit logs of administrative actions, including who changed what and when
Where a school enables it, profile photos synced from its identity provider

The service is designed for operational staff data only. It is not intended for pupil records, safeguarding disclosures, medical detail, or other special category data, and our Acceptable Use Policy prohibits putting that data into free-text fields.

What we process as a controller

Enquiries and signup: name, school, email, country, plan chosen, and the record that terms were accepted (version, timestamp, and the acceptor's email).
Billing: billing contact details and subscription records. Card details are handled by Stripe and never reach our servers.
Support: correspondence, help requests raised in the product, and any attachments you send us.
Website: if you accept analytics cookies, aggregate usage of our public pages. See the cookie policy.
Security: server and access logs, including IP address, needed to detect abuse and investigate incidents.

Legal bases

Where we act as controller, we rely on:

Contract: to provide the service, administer subscriptions, and give support to our customers.
Legitimate interests: to secure and improve the service, prevent fraud and abuse, keep records of terms acceptance, and respond to enquiries. We balance these against your interests.
Consent: for optional analytics cookies and for marketing email, which you can withdraw at any time.
Legal obligation: to keep tax and accounting records and to respond to lawful requests.

Where we act as processor, the school determines the legal basis for processing staff data, typically public task or legitimate interests for staffing and duty management.

Where data is stored and transferred

All production customer data is currently hosted in the United Kingdom (London), with encryption in transit and at rest, whichever country your school is in. If we add hosting regions we will update our sub-processors page and notify account owners before customer data moves. Our team is based in the United Arab Emirates and may access data remotely to provide support and maintain the service. Those transfers are covered by written agreements incorporating standard contractual clauses or the UK International Data Transfer Addendum, plus role-based access controls and audit logging of support access. A full list of providers and their hosting locations is on our sub-processors page.

Who we share data with

We share personal data only with the sub-processors listed on our sub-processors page, each under a written agreement, and with professional advisers, regulators, or law enforcement where we are legally required to. We do not sell personal data, we do not share it with advertising networks, and we do not use customer data to train AI models.

AI features

SchoolRota offers optional AI assistance during setup and data import. Where a school uses these features, the text or spreadsheet an administrator chooses to submit is sent to our AI sub-processor (OpenAI) solely to return a draft for that administrator to review. This data is not used to train models, and rota history, absence records, and pupil data are never sent. Output is always presented as a draft requiring human approval, and each run is recorded in the school's audit log. Cover suggestions are produced by a deterministic rules engine, not by an AI model. AI features can be disabled for a tenant on request.

Staff companion app

When a school enables the staff app, we process a device identifier, hashed access and refresh tokens, an optional push token, and an encrypted on-device cache of that person's latest schedule. Lock-screen alerts are generic and do not include names or assignments. Face ID or other biometrics only unlock the locally stored refresh token; they are not sent to SchoolRota. Signing out, switching school, or requesting deletion from the app revokes that installation immediately. Requests to erase school-controlled rota records are routed to the school. See staff app account help.

How long we keep data

Live portal data: for as long as the school's subscription is active, plus an export window of 30 days after termination.
After termination: deleted from live systems within 60 days of the end of that window. Residual copies in encrypted backups are overwritten as those backups age out of our rolling backup cycle, and are not restored or used for any other purpose in the meantime.
Trials that do not convert: if a trial ends without a paid subscription, the portal becomes read-only. You can still sign in and export existing rotas. Editing pauses until you subscribe. If the account is later closed under the terms, its data is deleted on the same timetable as a terminated subscription.
Our administrative record: after deletion we keep a minimal record of the account itself, covering the school name, the subscription, and administrative actions such as suspension, closure, and the date we deleted the data, together with the staff member of ours who carried them out. We keep this to meet our legal and accounting obligations and to establish or defend legal claims. It does not include your rota, staff records, or portal content.
Audit logs: retained while the tenant exists, so schools can evidence who changed what.
Billing and tax records: kept for the period required by law.
Support correspondence: up to 3 years after the last contact.
Terms acceptance records: kept for the life of the account and for 6 years after, as evidence of the agreement.

A school can request earlier deletion at any time, subject to any legal obligation on us to retain.

Security

Tenant isolation, role-based access, multi-factor authentication, encryption in transit and at rest, audit logging, and automated backups. Syba LLC holds Cyber Essentials certification. Full detail is on our security page. We notify affected controllers of a personal data breach without undue delay and in any event within 72 hours of becoming aware, as set out in the DPA.

Your rights

Depending on where you are, you may have rights to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent.

If you are a member of school staff: contact your school, which is the controller. We will assist them in responding and will not action a request about their data without their instruction.
If you are a website visitor, enquirer, or billing contact: contact us directly at hello@schoolrota.com. We respond within one month.

You can complain to your local data protection authority. In the United Kingdom that is the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to resolve it with you first.

Schools in the United States

The practices above apply wherever your school is. UK schools can sign up online, verify their school email and activate a trial. Online signup is currently limited to the United Kingdom. Two points district counsel usually asks about: your data is currently hosted in the United Kingdom, which we will confirm in writing on request; and we do not “sell” or “share” personal information as those terms are used in the California Consumer Privacy Act. We act as a service provider to your school, processing staff data only on its instructions and not for our own commercial purposes. The service is not designed to hold pupil education records, so material regulated by FERPA should not be placed in it.

Children

The service is for school staff. It is not directed at children, we do not knowingly collect data from children through our website, and our Acceptable Use Policy prohibits storing pupil records in the product. If you believe a child's data has been submitted to us in error, contact us and we will help the school remove it.

Automated decision-making

We do not carry out automated decision-making that has a legal or similarly significant effect on individuals. Cover and rota suggestions are proposals for a human to review, approve, and publish.

Marketing

We send product and service emails to account owners because they are necessary to operate your subscription. Marketing email is sent only with consent or to existing business contacts, and every message has an unsubscribe link.

Changes to this policy

We update this policy when our processing changes, publish the new version here with a new version number, and notify account owners by email where the change is material.

Contact

The service is provided by Syba LLC, a company registered in the United Arab Emirates.

Syba LLC · hello@schoolrota.com
Security and breach reports: security@schoolrota.com