Privacy Policy

Who we are

Rosterna — operated by a Saudi-registered establishment (Commercial Registration 7053617655) — is the data controller for account and organization data. For any privacy question, reach us at hello@rosterna.com.

Data we collect

• Account data: your name, work email, and phone number.
• Organization data: company details, departments, shifts, and settings.
• Staff data you enter: employee names, roles, and contact details.
• Usage and log data needed to run and secure the service.

How we use it

We use personal data to provide scheduling and notifications, process billing, offer support, secure the service, and meet legal obligations. Our lawful bases include performance of our contract with you, our legitimate interests in running the service, legal obligations, and consent where required.

Service providers (sub-processors)

We rely on trusted providers to operate Rosterna — including our cloud hosting provider, our payment provider (Moyasar), and our email provider (Resend). Each processes data on our behalf under contract and only as needed to deliver the service.

Data residency

Rosterna is hosted on cloud infrastructure inside the Kingdom of Saudi Arabia (Riyadh), and customer data is processed inside Saudi Arabia. Where personal data is processed, we apply appropriate safeguards consistent with the PDPL.

Retention

We keep personal data for as long as your account is active and for a limited period afterwards, then delete or anonymize it, unless a longer period is required by law.

Your rights

Under the PDPL you may request access to, correction of, or deletion of your personal data, and object to certain processing. To exercise these rights, email hello@rosterna.com with the subject “DSAR”.

Security

We protect data with encryption in transit and at rest, strict per-organization isolation at the database layer, and access controls. No system is perfectly secure, but we work to reduce risk and respond to incidents promptly.

If a breach affects your personal data, we notify affected customers without undue delay — and no later than 72 hours after becoming aware — in line with our Data Processing Agreement and the PDPL.

Changes & contact

We will post any updates to this policy here. Questions? Email hello@rosterna.com.