Privacy
What we hold, and why.
Last updated 22 October 2026.
Who we are
DayRota is a product of Nebula Enterprises Limited, registered in England and Wales under company number 14722922, whose registered office is The Generator Business Centre, 95 Miles Road, Mitcham, England, CR4 3FH. We are the data controller for the accounts and enquiries described below. Write to [email protected] about anything on this page.
What we store
If you send us an enquiry
The form on this site stores the name, email address, the "what do you do" line and the message you type, plus the time it arrived and a one-way hash of the network address it came from. The hash is used to rate-limit the form against spam; we do not keep the address itself.
If you create a space
Your name, email address and a password that is stored only as a hash. Your space's name, timezone, working hours and the people, cards and notes you put in it. If you add somebody without giving them a login, we hold their name and hours and nothing else about them.
What we do not do
No analytics, no advertising scripts, no third-party trackers and no profiling on this site. The marketing pages load nothing from another domain.
Cookies and local storage
This site sets no cookies. The app sets one session cookie when you sign in — it is how you stay signed in, and it is removed when you sign out. The app also installs a service worker that keeps a copy of pages you have already opened, in your own browser, so the board is readable with no connection; you can clear it from your browser settings at any time.
Why we are allowed to hold it
- Your enquiry — our legitimate interest in answering a business question you asked us.
- Your account — we need it to provide the service you signed up for.
- Security and rate limits — our legitimate interest in keeping the service up and abuse out.
Who else sees it
Our hosting provider stores the database and the files. Our network provider carries the traffic between you and us. Our email provider delivers mail we send you. Those are processors: they act on our instructions and do not use your data for their own purposes. We do not sell data and we do not share it for advertising.
How long we keep it
- Enquiries — until you ask us to delete them, or two years after the last reply, whichever comes first.
- Accounts — while the space exists. Deleting a space deletes its people, cards and history.
- Security logs — kept briefly, then discarded.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to [email protected] and we will confirm what we did. If you are not satisfied with our answer you can complain to the Information Commissioner's Office at ico.org.uk.
Where it is held
On servers we run in the United Kingdom. Where a processor handles data outside the UK, the transfer is covered by the standard contractual clauses that come with that service.
Changes
If this page changes in a way that affects you, we will say so on the board when you next sign in, and the date at the top will move.