Privacy Policy

Shiftly is the data controller responsible for your personal information. For the purposes of the UK GDPR and EU GDPR, the data controller is:

If you have any questions about how we handle your data, please contact us at the address above before raising a complaint with a supervisory authority.

Account information. When you register or sign in via Clerk, we receive your name, email address, and profile image (if provided through OAuth). We do not store your password — authentication is handled by Clerk.

Business & workforce data. If you create or join a business on Shiftly, we store business details (name, address, roles, schedule configuration) and the data you enter through the platform: shifts, time-off requests, shift-swap requests, and announcements.

Payment information. Subscription billing is processed by Stripe. We receive confirmation of a successful payment and your Stripe customer ID, but we never store raw card numbers or sensitive payment details on our servers.

Usage data. We collect standard server logs (IP address, browser type, pages visited, timestamps) to operate and improve the service.

Communications. If you contact us by email or through our contact form, we store the content of those messages to respond to you.

We share your data only as necessary to deliver the service:

• Clerk — Authentication and user management.
• Stripe — Subscription billing and payment processing.
• Resend — Transactional email delivery.
• Vercel — Hosting and serverless infrastructure.

Each of these sub-processors acts as a data processor on our behalf and is contractually bound to process your data only on our instructions and in compliance with applicable data protection law.

Within a Shiftly business, managers and owners can see the names, email addresses, and roles of other members of that same business. Employees can see their own shift data and the published schedule for their business.

We may disclose your information if required to do so by law or in response to a valid request by a public authority.

Some of our sub-processors — Clerk, Stripe, Resend, and Vercel — are based in the United States. Transferring your personal data to these providers means your data may be processed outside the UK and the European Economic Area (EEA).

Where we transfer data outside the UK or EEA, we ensure appropriate safeguards are in place in accordance with UK GDPR and EU GDPR. These safeguards include:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.
• The UK International Data Transfer Agreement (IDTA) for transfers from the UK, where applicable.
• Transfers to providers covered by an adequacy decision, where one exists.

You can request a copy of the relevant safeguards by contacting us at support@info.shiftly.sh.

We retain your personal data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or accounting purposes (e.g. billing records, which we retain for 7 years in line with UK tax law).

Anonymised or aggregated data that cannot identify you may be retained indefinitely for analytical purposes.

If you are located in the European Economic Area or the United Kingdom, you have the following rights under GDPR:

• Right of access — Obtain a copy of the personal data we hold about you.
• Right to rectification — Request correction of inaccurate or incomplete data.
• Right to erasure — Request deletion of your personal data where there is no compelling reason for us to continue processing it.
• Right to restriction — Ask us to restrict processing of your data in certain circumstances.
• Right to data portability — Receive your data in a structured, machine-readable format and transfer it to another controller.
• Right to object — Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent — Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at support@info.shiftly.sh. We will respond within 30 days (extendable to 90 days for complex requests, with notice to you).

Right to complain. You have the right to lodge a complaint with your national data protection supervisory authority at any time. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. In the EU, you may contact the supervisory authority in your country of residence. We would appreciate the chance to address your concerns before you contact a regulator, so please reach out to us first.

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional rights regarding your personal information.

Categories of personal information we collect:

• Identifiers — name, email address, IP address.
• Commercial information — subscription plan, billing history.
• Internet or other electronic network activity — pages visited, timestamps, browser type.
• Professional or employment-related information — business name, roles, shift schedules.

We do not sell or share your personal information. Shiftly does not sell, rent, or share your personal information with third parties for cross-context behavioural advertising as defined under the CCPA/CPRA.

Your rights as a California resident:

• Right to know — Request disclosure of the categories and specific pieces of personal information we have collected about you, and how we use and share it.
• Right to delete — Request deletion of personal information we have collected, subject to certain exceptions.
• Right to correct — Request correction of inaccurate personal information.
• Right to opt-out of sale/sharing — We do not sell or share personal information, so this right does not apply, but you may still contact us to confirm.
• Right to limit use of sensitive personal information — We do not use sensitive personal information for purposes beyond those necessary to provide the service.
• Right to non-discrimination — We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise any of these rights, contact us at support@info.shiftly.sh. We will respond within 45 days as required by law. We may ask you to verify your identity before processing your request.

Shiftly uses only strictly necessary cookies to keep you signed in (managed by Clerk) and to maintain session state. Strictly necessary cookies are exempt from consent requirements under UK PECR and EU ePrivacy rules because they are essential for the service to function.

We do not use advertising, tracking, or analytics cookies. If this changes in the future, we will update this policy and implement an appropriate consent mechanism before placing any non-essential cookies.

You can disable cookies in your browser settings, but doing so will prevent you from signing in to Shiftly.