On this page
In short
- For what a workspace records about its members, the workspace decides; we process it for them.
- We use a short list of providers, each for one job.
- We tell workspace owners before adding a new one.
This summary helps you find your way. The full text below is what applies.
01Who decides what
A workspace decides what it records about its members: activity, logbook, moderation, leave, hiring and mail. For that data the workspace is the controller, and we are its processor. We use it only to run Rosterr for that workspace, on its instructions.
For accounts, sign-in, billing, security and the website we are the controller. The Privacy Policy covers that.
02What we commit to as a processor
- Use workspace data only to provide Rosterr to that workspace.
- Make sure the people who can access it are bound to keep it confidential.
- Keep it secure, and tell the workspace without undue delay about a breach that affects it.
- Help the workspace answer requests from its members about their data.
- Use only the providers listed below, under written terms that protect the data.
- Delete or return the data when the workspace asks, or when it is deleted, except where the law requires us to keep it.
A workspace that needs a signed data processing agreement can ask for one at support@nebulatechnologies.ie.
03Subprocessors
| Provider | What for | Data | Where |
|---|---|---|---|
| Our data centre | A secure, solar-powered data centre that houses our servers, the database, backups and Rosterr Mail | Everything stored in Rosterr | Maidenhead, United Kingdom |
| Stripe | Subscriptions and payments | Billing contact, workspace ID, payment details | United Kingdom, with some processing in the United States |
| Intercom | Support chat | Roblox and Discord IDs, username, workspace name, plan and size, messages | United States |
| Discord | Sign-in, bot messages and DMs | Discord ID, the messages a workspace sends | United States |
| Roblox | Sign-in, group ranks and avatars | Roblox ID, rank changes a workspace makes | United States |
| Apple | iOS push notifications and in-app purchases | Push tokens, notification text, purchase confirmations | United States |
| Google (Firebase) | Android push notifications and in-app purchases | Push tokens, notification text, purchase confirmations | United States |
| Browser push services | Browser notifications | Push subscription, notification text (encrypted) | Depends on the browser |
| Cloudflare | Business workspaces' own domains | Domain names, web traffic to those domains | Global |
| Anthropic | Rosterr Assistant (Pro and Business), only when someone asks it a question; and, when it is one of the checkers, AI-writing checks on application answers | The question, and the workspace data the assistant looks up to answer it, limited to what the person asking can see; for checks, the answer text | United States |
| GPTZero, Sapling, Winston AI and Originality.ai | Checking job application answers for AI writing, only for workspaces that turn it on (Pro and Business) | The text of written answers of 150 characters or more, without the applicant's name or account | United States and Canada |
Our data centre
- What for
- A secure, solar-powered data centre that houses our servers, the database, backups and Rosterr Mail
- Data
- Everything stored in Rosterr
- Where
- Maidenhead, United Kingdom
Stripe
- What for
- Subscriptions and payments
- Data
- Billing contact, workspace ID, payment details
- Where
- United Kingdom, with some processing in the United States
Intercom
- What for
- Support chat
- Data
- Roblox and Discord IDs, username, workspace name, plan and size, messages
- Where
- United States
Discord
- What for
- Sign-in, bot messages and DMs
- Data
- Discord ID, the messages a workspace sends
- Where
- United States
Roblox
- What for
- Sign-in, group ranks and avatars
- Data
- Roblox ID, rank changes a workspace makes
- Where
- United States
Apple
- What for
- iOS push notifications and in-app purchases
- Data
- Push tokens, notification text, purchase confirmations
- Where
- United States
Google (Firebase)
- What for
- Android push notifications and in-app purchases
- Data
- Push tokens, notification text, purchase confirmations
- Where
- United States
Browser push services
- What for
- Browser notifications
- Data
- Push subscription, notification text (encrypted)
- Where
- Depends on the browser
Cloudflare
- What for
- Business workspaces' own domains
- Data
- Domain names, web traffic to those domains
- Where
- Global
Anthropic
- What for
- Rosterr Assistant (Pro and Business), only when someone asks it a question; and, when it is one of the checkers, AI-writing checks on application answers
- Data
- The question, and the workspace data the assistant looks up to answer it, limited to what the person asking can see; for checks, the answer text
- Where
- United States
GPTZero, Sapling, Winston AI and Originality.ai
- What for
- Checking job application answers for AI writing, only for workspaces that turn it on (Pro and Business)
- Data
- The text of written answers of 150 characters or more, without the applicant's name or account
- Where
- United States and Canada
Rosterr Mail runs on a mail server we operate ourselves, and attachments are scanned by our own virus scanner.
04Changes to this list
We will update this page and tell workspace owners at least 14 days before we add a new subprocessor. An owner who objects can contact us, and can cancel if we cannot resolve it. Rosterr Assistant (Anthropic) can also be turned off for a workspace in Settings > Features; while it is off, nothing from that workspace is sent to Anthropic. AI-writing checks on applications are off unless a workspace turns them on in Hiring settings; while they are off, no answers are sent to the detectors. When Claude is one of the checkers, those answers also go to Anthropic.