Privacy Policy

We collect the following types of information:

• Account information. When you sign up, we collect your email address and, optionally, your full name.
• Google sign-in data. If you choose “Continue with Google”, Google tells us the email address on that Google Account, whether it is verified, your name and your profile picture. We ask Google for nothing beyond that — no access to your Gmail, Drive, Calendar, Contacts or any other Google service — and we use what we receive only to create and sign you in to your EventRota account. Signing in with Google does not give Google access to your EventRota events, rotas or volunteers.
• Event and rota data. Information you provide when creating events, positions, shifts, and volunteer assignments — including volunteer names, email addresses, and phone numbers you add to your organisation.
• Availability and attendance data. Shift availability preferences and check-in records submitted by volunteers.
• Usage data. Basic technical data such as browser type and access timestamps, used to keep the service running reliably, plus privacy-friendly analytics about which pages are visited — described in section 3. We do not run advertising trackers and we do not sell or share your data for advertising.

We use the information we collect to:

• Provide, operate, and improve the EventRota service.
• Send transactional emails (magic-link sign-in, invitation emails, rota confirmations, and event updates) on behalf of the organisations using EventRota.
• Allow administrators and coordinators to manage volunteer rotas for their events.
• Respond to support requests and investigate issues.

We do not sell your personal data. We do not use your data for advertising.

We share data only with the third-party services required to operate EventRota:

• Supabase — the database and authentication infrastructure EventRota runs on. Your account, events, rotas and volunteer records are stored here.
• Resend — delivery of the transactional emails EventRota sends on your behalf, such as invitations, reminders and rota confirmations. Recipient addresses and message contents pass through Resend in order to be delivered.
• Stripe — payment processing for paid plans. Stripe collects your payment details directly; we never receive or store your card number. We hold only the identifiers Stripe gives us for your customer and subscription, and a record of what was purchased.
• Plausible Analytics — website analytics. Plausible is cookieless and collects no personal data: it records page views and referrers in aggregate, does not track individuals across sites, and does not build a profile of you.
• Google— sign-in, if you choose to use it. Google handles the sign-in itself and tells us the account details listed in section 1; your Google password is never seen by us. We do not sell this data, use it for advertising, or share it with anyone beyond the services listed here. You can disconnect EventRota at any time from your Google Account’s third-party connections page, and set an EventRota password from forgot password first if you still want a way in.
• Google Tag Manager — a tag manager used to load the analytics above. It does not itself collect analytics data or set advertising cookies, but it is a Google service, so loading it means your browser contacts Google servers and Google receives your IP address as part of that request.

We do not sell your data, and we do not share it with advertising networks or data brokers.

Data shared with volunteer members of an organisation (names, email addresses, shift assignments) is visible only to administrators and coordinators of that organisation, and to the individual volunteer for their own records.

We retain your account and event data for as long as your account is active. If you delete your account, your personal data will be removed within 30 days, except where we are required to retain it for legal or compliance purposes. Event and rota data may be retained in anonymised form for service-improvement purposes.

EventRota uses cookies to maintain your authentication session and to remember which organisation you are working in. Browser local storage is used to save interface preferences, such as notices you have dismissed.

We do not use advertising cookies, and we do not use cookies to track you across other websites. Our analytics provider, Plausible, is cookieless by design. Google Tag Manager, which loads it, does not set advertising cookies of its own.

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Object to or restrict processing of your data.
• Receive a copy of your data in a portable format.

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

We use industry-standard security practices including encrypted connections (TLS), hashed passwords, and role-based access controls. Despite these measures, no system is completely secure. Please contact us immediately if you believe your account has been compromised.

EventRota is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above. For significant changes, we will notify users by email or via an in-app notice.

EventRota is operated by Sports Stats Limited, a company registered in England and Wales.

If you have any questions about this Privacy Policy, wish to exercise your rights, or want to raise a data protection concern, contact us at: info@sports-stats.org.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.