# Privacy Policy

Last updated: March 11, 2026

## 1. Introduction

ShiftPro ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our workforce management platform.

## 2. Data We Collect

We collect data necessary to provide the Service:

- **Account information:** Name, email address, company name, industry type.
- **Employee data:** Names, email addresses, phone numbers, positions, wage rates, availability preferences (provided by your employer).
- **Scheduling data:** Shift assignments, time-off requests, shift swap records, schedule history.
- **Time & attendance:** Clock-in/out timestamps, GPS coordinates (when time clock is used), break records.
- **Usage data:** Feature usage, page views, browser type, device information, IP address.
- **Payment data:** Billing details processed securely through our payment provider (Stripe). We do not store full credit card numbers.

## 3. How We Use Your Data

- To provide and maintain the Service, including scheduling, time tracking, and workforce analytics.
- To train and run our deterministic AI models (demand forecasting, schedule optimization) using aggregated, company-scoped data.
- To communicate with you about your account, billing, and service updates.
- To improve the Service through usage analytics (aggregated and anonymized).
- To comply with legal obligations and enforce our Terms of Service.

## 4. Data Storage & Security

Your data is stored in secure, encrypted databases hosted by Supabase (built on AWS infrastructure). We implement industry-standard security measures including:

- SSL/TLS encryption for all data in transit.
- Encryption at rest for stored data.
- Row Level Security (RLS) enforcing strict multi-tenant data isolation.
- Multi-factor authentication (TOTP) for administrative accounts.
- Regular automated backups.
- Audit logging for sensitive operations.

## 5. Data Sharing

We do not sell your personal data. We share data only with:

- **Your employer:** Company administrators can view employee data within their organization as needed for workforce management.
- **Service providers:** Trusted third parties that help us operate the Service (e.g., Supabase for hosting, Stripe for payments). These providers are bound by data processing agreements.
- **Legal requirements:** When required by law, regulation, or valid legal process.

## 6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. After account termination, data is retained for 30 days before permanent deletion, unless a longer retention period is required by law or requested for compliance purposes.

## 7. Your Rights

Depending on your jurisdiction, you may have the right to:

- Access and receive a copy of your personal data.
- Rectify inaccurate or incomplete data.
- Request deletion of your data ("right to be forgotten").
- Restrict or object to certain processing activities.
- Data portability — receive your data in a structured, machine-readable format.
- Withdraw consent at any time (where processing is consent-based).

For GDPR-specific rights, see our [GDPR page](https://shiftpro.io/gdpr).

## 8. Cookies

We use essential cookies for authentication and functional purposes. For full details, see our [Cookie Policy](https://shiftpro.io/cookies).

## 9. Children's Privacy

ShiftPro is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children.

## 10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or in-app notification. The "Last updated" date at the top reflects the most recent revision.

## 11. Contact Us

For privacy-related inquiries, contact us at [Contact@shiftpro.io](mailto:Contact@shiftpro.io) or visit our [Contact page](https://shiftpro.io/contact).