Privacy Policy

Rosterr is run by Mr L F Radford, a sole trader trading as Nebula Technologies, of Suite 751, 80A Ruskin Avenue, Welling, Kent, DA16 3QQ, United Kingdom. For your account, sign-in, billing, security and the website, we decide how your data is used: we are the "controller" under UK data protection law (the UK GDPR and the Data Protection Act 2018).

For what a workspace records about its members (activity, logbook, moderation cases, leave, applications, mail), the workspace decides what to record and why. For that data we act for the workspace, as its "processor". Questions about it are best asked of the workspace first. The subprocessors page explains this split.

Privacy contact: support@nebulatechnologies.ie. We are registered with the Information Commissioner's Office under number ZC223535.

• Roblox account

  Examples

  User ID, username, display name, avatar, group ranks

  Where it comes from

  Roblox, when you sign in and from the group's API key

• Discord account

  Examples

  User ID and username. Never your password

  Where it comes from

  Discord, when you sign in or link it

• Sign-in and security

  Examples

  Signed-in devices (device, IP address, last used), passkey public keys, QR sign-in codes

  Where it comes from

  Your devices

• Workspace records

  Examples

  In-game activity time, sessions, logbook entries, moderation cases and evidence, leave, documents and acknowledgements, goals, notes

  Where it comes from

  You, your workspace's staff, and the game's loader

• Hiring

  Examples

  Applications, answers, ratings and notes, and a talent profile if you make one

  Where it comes from

  You and the hiring team

• Mail

  Examples

  Your address, emails you send and receive, attachments

  Where it comes from

  You, other members, and outside senders

• Profile details

  Examples

  Birthday, time zone, an email address for notifications

  Where it comes from

  You, or a workspace admin

• Billing

  Examples

  Stripe customer and subscription IDs, plan, status. Not your card number

  Where it comes from

  Stripe

• App purchases

  Examples

  Purchase confirmations

  Where it comes from

  Apple or Google

• Notifications

  Examples

  Push tokens for the apps and browsers

  Where it comes from

  Your devices

• Support

  Examples

  What you write to us, and the details listed below

  Where it comes from

  You, through Intercom

• Logs

  Examples

  IP address, browser, pages and API calls, times

  Where it comes from

  Your devices, automatically

When you open support chat, Intercom is told your Roblox user ID and username, your Discord user ID if linked, and your workspace's ID, name, plan and size. Never your email address. The iOS app's chat also sends Intercom device and usage data.

• Running Rosterr: sign-in, showing your workspace, notifications, mail, the bot and the API

  Legal basis

  Contract: we need it to provide the Service

• Billing and tax records

  Legal basis

  Contract, and legal obligation

• Security: abuse prevention, rate limits, audit logs

  Legal basis

  Legitimate interests: keeping accounts and workspaces safe

• Support

  Legal basis

  Contract, and legitimate interests

• Rosterr Assistant: answering a member's question about their workspace, using only what they can see

  Legal basis

  Contract: it's part of the Pro and Business plans, used only when someone asks it something

• Benchmarks: showing a workspace how its staff activity compares with similar workspaces, from totals across at least 10 workspaces, never one workspace's numbers or anyone's name

  Legal basis

  Legitimate interests: helping workspaces see how they're doing

• Email notifications and product news

  Legal basis

  Consent: off until you switch them on, and you can switch them off at any time

We do not sell personal data, use it to profile anyone for advertising, or make decisions about you by automated means that have legal or similarly serious effects. Decisions about rank, warnings or hiring are made by people in your workspace.

Advertising. The rosterr.cc home page and the pages of Free workspaces show ads from Google AdSense. We ask Google for non-personalised ads only, chosen from the page and your rough location rather than a profile of you, and we don't give Google anything from a workspace: it sees the page's address, as it does for any site with ads. Google still uses cookies or similar to count and cap how often ads are shown and to stop fraud, as its own controller under Google's privacy policy. Where the law needs your agreement for those cookies, Google's consent message asks for it first. Pro and Business workspaces, and the iOS and Android apps, show no ads.

• Your workspace. Members see what their roles allow. Admins can see more, such as moderation cases and audit logs.
• The public, only where you or the workspace choose: a public team page, a public careers page, public job listings, or a talent profile you make public.
• Our service providers, listed on the subprocessors page, each only for what it does for us.
• Nebula staff, when needed to support you, investigate a report or keep the Service secure. Their access is logged.
• Authorities, when the law requires it, or to protect someone's safety.

Some providers, such as Intercom (in the United States), Stripe and Discord, store data outside the UK. Where they do, we rely on the UK–US data bridge for providers certified under it, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

• Account and workspace data: while your account exists.
• Mail: until someone deletes it. The trash is emptied after 30 days.
• Signed-in devices: until you sign out or remove the device.
• Logs: only as long as we need them to keep the Service secure and working, then deleted.
• Billing records: as long as UK tax law requires, which is at least 5 years after the 31 January deadline for the tax return they belong to.
• Backups: kept on a rolling basis and overwritten as new ones are made, so deleted data drops out of them over time.

Delete your account from Settings > Privacy and data. If you own a workspace that still has other members, you must transfer ownership first, so a workspace is never removed by accident.

Deleted: your sign-ins, devices and push tokens, passkeys, notifications, preferences, activity history, rank history, role memberships, session sign-ups, leave notices, and training-log entries about you.

Kept, but no longer linked to you: some records other people depend on. Posts, documents, notes, moderation records, policy acknowledgements and logbook entries you wrote about others stay with the workspace, shown as written by "Deleted User".

Before you delete, you can download a copy of your data from Settings > Privacy and data > Download my data.

You can ask us to give you a copy of your data, correct it, delete it, limit how we use it, or send it to you in a portable format. You can object to uses based on legitimate interests, and withdraw consent at any time.

Write to support@nebulatechnologies.ie. We reply within one month. For data a workspace controls, we may pass your request to that workspace.

You can also complain to the Information Commissioner's Office at ico.org.uk. We would like the chance to help first.

Many people on Roblox are young. We collect only what Rosterr needs, nothing is emailed to you unless you switch it on yourself, and we do not profile anyone for advertising.

If you are a parent or guardian and think your child's data should not be here, contact us and we will help.

Connections are encrypted. Session cookies are encrypted and cannot be read by scripts. Mailbox passwords are random and encrypted. Mail attachments are checked for malware. No system is perfectly secure; we will tell you and the ICO if a breach puts you at risk, as the law requires.

We will update the date at the top when this policy changes, and tell you in the app if a change matters.

support@nebulatechnologies.ie, or through our contact page.