Privacy Policy

The Owners' Co operates The Rota App. The Owners' Co is a trading name of The Owners Co Platform Ltd, a company registered in Scotland (company number SC897707), which is the data controller for the personal data described in this policy and is registered with the Information Commissioner's Office. Our contact details are in section 11 below.

We collect the following categories of personal data:

• Account information: your name and email address when you register. Signing in works by a code sent to your email, so we never hold a password for you.
• Building information: your building address and flat number, which you provide when setting up or joining a rota. Addresses are looked up via an address lookup service (see section 5).
• Rota activity:records of turns taken, tasks marked as done, and your flat's chosen route (self-service or provider).
• Information provided by a neighbour: the person setting up a rota may tell us which flats are in the building and, for a flat without an email address, a name so that we can send a posted reminder card instead. If that describes you and you would rather we did not hold your name, contact us and we will remove it.
• Waitlist and early-access emails: the email address you give us when you ask to hear about the service.
• Communications: messages you send us via email or through the app, and delivery records for the emails we send you (for example whether a reminder arrived).
• Usage data: browser type, pages visited and actions taken within the app, collected via analytics and error monitoring (see section 10).

We use your data to:

• create and manage your account;
• operate the rota and send turn reminders, by email or posted card;
• obtain provider quotes where your building has opted in;
• respond to your support enquiries;
• let you know about the service if you joined the waitlist;
• improve the service through aggregated analytics and fix errors;
• meet our legal obligations.

We process your data under the UK GDPR. The legal bases we rely on are:

• Contract: processing your account and rota data is necessary to provide the service you have signed up for.
• Legitimate interests:analytics, error monitoring and service improvement, and holding the details a neighbour provides so a building's rota can include every flat, where these do not override your rights.
• Legal obligation: where we are required to retain or share data by law.
• Consent: for waitlist and marketing emails you have asked for. You can withdraw consent at any time.

We do not sell your personal data. We share it only with the services we use to run the app, and only so they can act on our instructions:

• Supabase:our database and sign-in provider. Your data is stored in Supabase's London (UK) region.
• Vercel: hosts the app.
• Resend: delivers our emails (sign-in codes, reminders, invites) and reports delivery events back to us.
• Ideal Postcodes:the address lookup used when you enter your building's postcode at signup.
• PostHog (EU cloud): product analytics, used only to understand how the service is used and improve it (see section 10).
• Sentry: error monitoring, so we can find and fix faults.

We also share the minimum necessary information with local cleaning or maintenance providers where your building has opted into the provider service, and with authorities where required by law or to protect our legal rights.

Other members of your building can see your flat number and whether your turn is completed, but not your name, email address, or chosen route (self-service vs. provider).

Your account and rota data lives in the UK (Supabase, London region), and our analytics are hosted in the EU, which UK law treats as providing adequate protection. Some of our providers (for example Vercel, Resend and Sentry) are US companies and may process limited data outside the UK. Where that happens we rely on the safeguards in our agreements with them, such as the UK International Data Transfer Addendum, or on UK adequacy regulations.

Where a building uses The Owners' Co platform, a neighbour (the building's “champion”) keeps a register of who owns each flat: names, and where known an email address, phone number or postal address. Some of the people on that register will not have an account with us, and some will not have been asked before their details were entered.

We process this data under our and the building's legitimate interest in the shared management of the building: Scottish tenement law expects owners to reach decisions together, which is impossible without knowing who the owners are. We have documented the balancing test for this (a legitimate interests assessment) and reviewed how little data the register needs to work.

• You will always be told: every invitation email or letter says why you are on the register, who added you, and links to this notice.
• You can object and be removed: every invitation carries a working remove-my-details path. Removal clears your personal details from the register; your flat itself remains listed, because the building's decisions must still count every flat.
• Decision records don't name you:the permanent record of a building's decision refers to flats (“2F1”), never to owners' names or contact details.
• No scraping: we never collect register data automatically from public registers; champions follow guided, manual steps and enter what they find themselves.

We keep your account data for as long as your account is active. If you close your account, or ask us to, we will delete or anonymise your personal data within 90 days, unless we are required to retain it for legal reasons (for example, for tax or fraud-prevention purposes). Waitlist emails are kept until we launch in your area or you unsubscribe, whichever comes first.

Aggregated, anonymised analytics data may be kept indefinitely because it cannot identify you.

Under the UK GDPR you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• request deletion of your data (“the right to be forgotten”);
• restrict or object to certain processing;
• data portability: receive your data in a machine-readable format;
• withdraw consent where processing is based on consent.

To exercise any of these rights, email us at hello@theownersco.co.uk. We will respond within one month. If you are unhappy with our response you have the right to complain to the Information Commissioner's Office (ICO).

We use only strictly necessary cookies: they keep you signed in and make the sign-in flow work. We set no advertising or tracking cookies, which is why the app has no cookie banner.

Our analytics (PostHog, EU cloud) run without storing anything on your device: no analytics cookies and no persistent identifiers in your browser. We use what they collect only to understand how the service is used and to improve it, and we do not enable session recording. Error monitoring (Sentry) works the same way. If you would rather be left out of analytics entirely, contact us and we will arrange it.

For any privacy-related questions or to exercise your rights, contact us at: hello@theownersco.co.uk, or by post at our registered office: The Owners Co Platform Ltd, Office 595, 18 Young Street, Unit LGE, Edinburgh EH2 4JB, Scotland.