Privacy policy
1. Who we are
Rota (justrota.com and app.justrota.com) is order, supplier and shipment management software developed and operated by EMIRST LLC, 8 The Green, Suite 13659, Dover, DE 19901, USA. Contact: info@justrota.com.
In this policy, “merchant” means the seller using Rota (the workspace owner and their team), and “end customer” means a person who buys from the merchant’s store.
2. Our roles
- Account data (merchant users, team members, supplier users and billing): EMIRST LLC is the controller of this data.
- Order and end-customer data (orders imported from Shopify or entered by the merchant): the merchant is the controller; Rota acts as a processor that processes this data only on the merchant’s behalf and instructions.
3. What data we process
| Data | Source | Purpose |
|---|---|---|
| Name, email address, Google account ID; for suppliers who sign in with email, a password (only a hashed form is stored) | Sign in with Google or email sign-up | Creating accounts, signing in, authorizing access |
| The version and date on which you accepted the terms of use and privacy policy | Consent checkbox on the sign-in or sign-up screen | Proving that the terms were accepted; deleted together with the account |
| Workspace name; email addresses and roles of team members and supplier users | Entered by the merchant | Managing team and supplier access, sending invitations and new-order notification emails to suppliers |
| Store name and domain, brand color, logo, support email, flow and tracking page settings | Entered by the merchant | Building the dashboard and the tracking page shown to end customers |
| Order number, tracking number and carrier, order and shipping dates, status, line items (product name, SKU, quantity, product image link) | Shopify connection or merchant input | Managing orders and shipments, writing tracking numbers to Shopify, building the tracking page |
| End customer’s first and last name | The name on the shipping or billing address of the Shopify order (Shopify-connected stores only) | Greeting on the tracking page if the merchant turns this on; not shown otherwise |
| Notes: note visible to the end customer, internal team note, note to supplier | Entered by the merchant | Showing each note only to the relevant people: internal notes to the team only, supplier notes to the team and the relevant supplier, customer notes on the tracking page |
| Activity history (email of the person who acted, action and time) | Actions taken in the dashboard | Showing the team who changed what and when |
| Time the tracking page was first opened | Tracking page | Counting your plan’s monthly tracking quota |
| A one-way hash derived from the IP address on the lookup page; the IP address itself is not stored | End customer’s browser | Limiting attempts to prevent abuse; kept for at most 1 hour |
| Plan, subscription status, Stripe customer and subscription IDs, or Shopify subscription and charge IDs | Stripe or Shopify | Payments and plan management. Card details never reach Rota; they are processed only by Stripe or Shopify |
| For a store that installs Rota from the Shopify admin, an automatically created account: the store domain (myshopify.com) and store name | Shopify | Using Rota inside the Shopify admin without a separate sign-in |
4. Shopify connection
When a merchant connects a store to Shopify, Rota requests these permissions: reading orders, reading and writing merchant-managed fulfillment orders (to write tracking numbers to Shopify), reading and writing products, inventory and locations (for product management from the dashboard), uploading files (for product images) and the in-store tracking page.
- Shipping addresses are not stored in Rota. When a supplier views an order’s address, it is read from Shopify at that moment and not saved.
- When an end customer searches by “order number + email” on the lookup page, the email address is compared with the Shopify order at that moment and not stored.
- End customers’ phone numbers and email addresses are not stored in Rota.
- Shopify access tokens are stored server-side, encrypted with AES-256-GCM, and never sent to the browser.
- Shopify’s mandatory privacy webhooks are handled: on a customer data erasure request the related orders are deleted, and for a store that uninstalled the app, that store’s imported data is deleted when Shopify sends the shop data erasure request.
5. End-customer tracking page
A private, hard-to-guess link is created for each order. Anyone with the link can see that order’s tracking page, so the link should only be shared with the relevant end customer. The tracking page shows store details, order and tracking numbers, the shipment process, the note visible to the end customer and, depending on the merchant’s settings, line items and the customer’s name. Internal and supplier notes are never shown. Tracking and lookup pages are closed to search engines. The dates shown are a plan calculated from the movements the merchant confirmed and the flow settings. If the merchant turns on real carrier data, the stages after shipping and the carrier events are retrieved from the carrier via Track123.
6. Service providers and data location
- Supabase: database and user sign-in. Data is hosted in the European Union (Frankfurt, Germany).
- Cloudflare: hosting and delivery of the website and the app, and email forwarding for info@justrota.com.
- Stripe: payments and subscriptions.
- Shopify: payments and subscriptions for stores that install Rota from the Shopify admin (Shopify Billing); charges appear on the store’s Shopify invoice.
- Resend: sending invitation, sign-in, password reset, new-order notification emails to suppliers, and opt-in daily summary emails to workspace owners/admins (order numbers and store names).
- Track123: only if the merchant turns on real carrier data on the Premium plan or higher, tracking numbers are sent to retrieve carrier events. The end customer’s name, address or contact details are not sent.
- OpenAI: only when the merchant uses “Write with AI” in the product editor or “AI command” in the product list, the merchant’s command and the selected products’ title, description, brand, type, tags, SEO texts and variant names are sent to generate suggestions. No customer, order or contact data is sent; suggestions are not written to Shopify until the merchant approves them. Rota does not store this text, only a daily usage count.
- Google: “Sign in with Google” authentication.
- Shopify: only if the merchant chooses to connect a store, for reading and writing order, product and fulfillment information.
Some of these providers may process data in the USA or on global infrastructure. Transfers outside the EU/EEA rely on appropriate safeguards offered by the providers, such as Standard Contractual Clauses. We do not sell data or share it for advertising.
7. Cookies
This website does not use cookies or analytics. The app (app.justrota.com) uses only essential cookies: session cookies that keep you signed in and a language cookie that remembers your chosen language. Tracking pages do not use cookies.
8. Retention and deletion
- When you delete a store in the dashboard, that store’s orders, tracking links and activity history are permanently deleted.
- You can request full deletion of your account or workspace by writing to info@justrota.com from the email address registered to your account. After the request is verified, the data is deleted within 30 days.
- Subscription and invoice records may be kept at Stripe for the legally required period due to tax and accounting obligations.
- IP hashes from lookup attempts are kept for at most 1 hour.
- Records of accounts under investigation for suspected abuse, fraud or unlawful activity may be kept, regardless of any deletion request, until the investigation and any legal proceedings are concluded.
9. Security
Connections are encrypted with HTTPS. Database access is restricted by workspace and role using row-level authorization; suppliers see only the orders assigned to them. Shopify tokens are stored encrypted.
10. Abuse and reporting to authorities
Content shown on tracking pages and in the dashboard, including end-customer data, is entered or imported by merchants; the relevant merchant is responsible for its accuracy and lawful processing. EMIRST LLC is not responsible for data processing carried out by merchants, team members or suppliers who misuse Rota, or for its consequences (see the Terms of use, sections 4–7).
Where we suspect abuse, fraud or unlawful activity, we may review and retain the related account and activity records. We may share these records with competent authorities in response to lawful requests, or with relevant service providers (e.g. Shopify, Stripe) to the extent necessary to protect our rights, our users and third parties. This processing is based on legitimate interest and legal obligation.
11. Your rights under the GDPR (EU/EEA and United Kingdom)
Our legal bases for processing account data are: performance of a contract (providing the service, payments), legitimate interest (security, abuse prevention, activity history) and legal obligation (invoice records). You have the rights of access, rectification, erasure, restriction of processing, data portability and objection. You can send requests to info@justrota.com; you also have the right to lodge a complaint with the data protection authority in your country.
End customers should first direct requests about their order data to the merchant they bought from; Rota assists the merchant in fulfilling these requests.
12. KVKK (Türkiye) notice
Your account data is processed electronically by automated means for the purposes above, based on the legal grounds in Article 5 of Personal Data Protection Law No. 6698: establishment and performance of a contract, legal obligation and legitimate interest. Your data may be transferred to the service providers listed in section 6, for the purpose of providing the service, including abroad (EU and USA). Under Article 11 of the KVKK you have the right to learn whether your data is processed, request information, rectification and erasure, know the third parties it is transferred to, object, and claim compensation for damages. You can send requests to info@justrota.com; they are answered within 30 days at the latest.
13. Children
Rota is a service for businesses and is not intended for use by anyone under 18.
14. Changes
When we update this policy we show the new date on this page; we notify account owners of significant changes by email or in the dashboard.
This English version is provided for convenience. In case of a conflict, the Turkish version prevails.