Privacy

Staffi is a rota and shift-cover tool for UK venues, operated by BeAppi Ltd. If you want anything on this page explained or acted on, email hello@staffi.co.uk.

This matters more than it sounds. If you sign up to Staffi as a manager or owner, we are the controller of your own account data — your email address and password.

But the staff records you enter belong to your business. For those we are a processoracting on your instructions: you decide what goes in, how long it stays, and who sees it. Your employees' data protection requests go to you as their employer, and we help you answer them.

Your account. Email address and a hashed password. That is all — we do not ask for your name, address, or card details (billing, when it launches, will be handled by a payment provider who never passes us card numbers).

The people on your rota, as entered by you: name, email address, phone number, hourly pay rate and its history, contracted and maximum hours, contract type, date of birth, and whether they are an apprentice. Date of birth is there for one reason — National Minimum Wage bands are age-dependent, and Staffi warns you before someone crosses one.

Your venue.Name, trading hours, timezone, currency, labour target, pay period, and approximate location. The location is a coordinate for the town, used only to fetch a weather forecast — we do not track anyone's device or whereabouts.

Your trade. Hourly sales totals, exported from your till and imported by CSV. This is business data, not personal data, and it is what the forecast is built from.

An audit trail. Shifts, absences, and every change to a published shift with a timestamp and who initiated it. This exists because the Employment Rights Act 2025 duties are made of exactly this record, and it cannot be reconstructed after the fact. Change records are append-only — nobody, including us, can quietly edit them.

• No advertising, and no selling or sharing data with brokers.
• No third-party analytics or tracking scripts, and no cross-app or cross-site tracking.
• No automated decision that acts on a person without a manager. The rota suggests; a human publishes.
• No access to a worker's location, camera, contacts, or photos.

Supabase — database and authentication. Vercel — hosting. Both are processors under contract and hold data on our behalf.

Open-Meteo — the weather forecast. It receives a venue coordinate and nothing else: no names, no account, no device identifier.

WhatsApp — only if you choose to share a rota that way. That opens your own WhatsApp with a message drafted; we do not send it and we do not hold your contacts.

Some of these providers operate infrastructure outside the UK. Where data leaves the UK it is covered by the safeguards those providers offer, including the UK International Data Transfer Addendum.

Account and venue data stay while your account is open. Shift and change records are kept for six years, because employment records need to survive long enough to answer a tribunal or an HMRC query. Sales history is kept while it is useful to the forecast. Ask us to delete an account and we remove it, and its staff records, within 30 days — except the append-only change trail, which we retain for the six-year period above and can explain on request.

Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to how it is used, or ask us to restrict it. Email hello@staffi.co.uk and we will respond within one month. If you are on someone's rota rather than an account holder, start with your employer — they decide what happens to that record, and we will help them action it.

You can also complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first.

Every request is authenticated, and the database enforces row-level security so one business cannot read another's data. Pay rates are visible to managers and to the worker they belong to, never to the rest of the team. Traffic is encrypted in transit.

If we change this policy in a way that materially affects you, we will tell account holders by email rather than quietly updating the date at the top.