Privacy policy

This policy explains how Rostavo ("we", "us") handles personal data when you use our software and websites. We are the data controller for your own account and billing details. For everything your agency stores about its staff, its clients and the people they care for, your agency is the controller and we are the processor, which means requests about that data go to the agency, and the agency has the tools to answer them.

What we collect

• Your account: name, email, phone, hashed password, agency details, and payment details handled by our payment provider.
• What your agency enters: staff records including documents, references and background-check status; client and family records; details of the people in their care, which may include children or vulnerable adults; bookings, availability, messages and invoices.
• Technical: server logs, browser and device information, and error diagnostics.

Why, and on what basis

To provide and secure the service (performance of a contract), to meet legal obligations such as keeping financial records, and for our legitimate interest in running and improving the product. Where we need consent. Certain optional communications. You can withdraw it at any time.

Who else touches it

We use as few third parties as we can get away with, and this list is the whole of it. A company is named here when we are genuinely sending it data, not when we have merely integrated with it.

• Oracle Cloud Infrastructure. Hosting. The server is in Oracle's Frankfurt region, in Germany, so your records stay inside the EU. See where your data lives.
• Resend. Email delivery.
• Stripe. Card payments, where an agency has switched them on.
• Sentry. Error reports, so we find crashes before you report them.
• Anthropic. Where AI-assisted shift suggestions are switched on, the shift's start time, length, town and notes go to Claude along with the first name and internal match scores of up to fifteen candidates, and it returns a ranking and a one-line reason for each. No address, no contact details, no documents and nothing about the people being cared for beyond what somebody has typed into the shift's own notes. It is never used for any other purpose, and the feature falls back to our own scoring when it is unavailable.
• Google Analytics, which pages of this public website get read, so we know which ones are worth keeping. Your IP address is truncated before it is stored.
• Microsoft Clarity. Anonymous recordings of how this public website is used, so we can see where a page confuses people.

Neither of the last two loads unless you agree to it. They are not requested, not downloaded and set no cookies until you say yes on the banner, and you can change your mind at any point. Session recording is never switched on once you are signed in, so nothing about your agency, your staff, the families you work with or the people they care for is ever sent to it. Where we do count page views inside the product, the address is reduced to the shape of the screen. /workers/:id rather than the record you were looking at. There is no advertising anywhere, and we do not sell personal data.

Our webfonts are served from our own servers rather than a font CDN, so loading a page here does not hand your IP address to a third party for that.

Cookies

Two are strictly necessary and cannot be switched off: one keeps you signed in, and one protects forms against cross-site request forgery. Neither is used for advertising, and the law does not require us to ask permission for cookies without which the thing you asked for cannot work. A third remembers the choice you make below, which is the only way to avoid asking you again on every page.

Everything else is opt-in. The measurement tools above set cookies to tell one visit from another, and nothing is loaded and no such cookie is set until you have agreed. Refusing is one click, in the same place and the same size as accepting. We ask again after six months, and never as a way of wearing you down.

To change your mind: open cookie settings. There is also a link in the footer of every page and at the bottom of the app. Turning something off deletes the cookies it set. Your browser's own controls and any tracker blocker work too, and the site behaves identically either way.

How long we keep it

While your agency's account is open. Invoices, payouts and the hours behind them are kept for six years as financial records, with everything identifying attached to them removed.

Nothing deletes itself. When you want an account gone, close it from Settings → Data protection, or ask us, and it is destroyed then and there, including the files on disk and the logins attached to it. We would rather a dormant account still had your data in it when you came back than quietly destroy records you may be required to produce. Backups age out on their own fourteen-day cycle rather than being edited, so a copy can survive in a backup for up to two weeks after that.

Your rights

Under UK and EU GDPR you can ask for a copy of your data, have it corrected, have it erased, object to or restrict how it is processed, and take it elsewhere. In practice:

• If you are a member of staff, a client, or a parent. Ask the agency you deal with. They are the controller. Rostavo gives them a one-click way to erase your record in full, and a way to download the whole account, from which they can give you your part of it.
• If you run the agency. Settings → Data protection inside the app. Download everything as a single file, erase one person's data, or close the account entirely. Erasure destroys documents, messages, notes and the login, and leaves only the anonymous financial rows the law requires us to keep.
• Either way. You can also email us and we will help, or complain to the ICO if you think we have got it wrong.

Children's data

Agencies record information about children in their care. Ages, allergies, medical notes, schools, pickup arrangements. That is controlled by the agency, is only ever visible inside that agency's account, and is destroyed in full when the family's record is erased. We process it solely to provide the service to the agency, and for nothing else.

Security

Data is encrypted in transit and access is restricted by role. Every record carries the agency that owns it, and that filter is applied by the framework to every single query rather than being remembered by whoever wrote the screen, so one agency cannot read another's. It has its own test suite, and a scheduled job looks for any login that has drifted between agencies. No system is perfectly secure, but nothing here is left to chance. The longer version, including what we have NOT done, is on the security page.

Contact

Questions or requests: hello@rostavo.com. A person reads these.