Privacy Policy

Information You Provide Directly

• Account information: Name, email address, and password (managed via our authentication provider, Clerk).
• Company information: Business name, invite codes, and subscription details.
• Employee data: Names, email addresses, job positions, hourly rates, and shift schedules entered by company administrators.
• Communications: Messages sent through our in-app team chat and direct messaging features.
• Support requests: Information you provide when contacting us for help.

Information Collected Automatically

• Usage data: Pages visited, features used, actions taken, and time spent on the Service.
• Device information: Browser type, operating system, IP address, and device identifiers.
• Log data: Server logs including request timestamps, error reports, and performance data.

Information from Third Parties

• Authentication: Profile information from your Clerk account (name, email, profile photo).
• Payments: Billing details processed by Stripe. We do not store full card numbers — Stripe handles all payment data.
• Clock-in photos: Photos taken during the clock-in/out process are stored in Cloudflare R2 and linked to clock records.

We use the information we collect to:

• Provide, operate, and maintain the Service
• Create and manage your account and company workspace
• Process subscription payments and send billing receipts
• Send shift notifications, schedule updates, and administrative messages
• Respond to your support requests and inquiries
• Monitor and improve Service performance, reliability, and security
• Enforce our Terms of Service and prevent abuse
• Comply with legal obligations

We do not use your data for advertising purposes or sell your personal information to third parties.

We share your information only in the following circumstances:

• Within your company workspace:Employees and managers within the same company can see each other's names, roles, availability, and shift information as necessary to operate the scheduling features.
• Service providers: We use trusted third-party services to operate the platform, including Clerk (authentication), Stripe (payments), Cloudflare R2 (file storage), and Railway (hosting). These providers process data only on our behalf under strict data protection agreements.
• Legal requirements: We may disclose information if required by law, court order, or government authority, or to protect the rights, property, or safety of ShiftsLine, our users, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your data is transferred and becomes subject to a different privacy policy.

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

• Active accounts: All data is retained while your account and subscription are active.
• After cancellation: We retain your data for 30 days after cancellation to allow reactivation or data export. After 30 days, all company and employee data is permanently deleted.
• Clock-in photos: Photos are retained for 90 days and then automatically deleted from storage.
• Legal hold: We may retain data longer if required by applicable law or for the resolution of disputes.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal obligations and legitimate business needs).
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to certain processing of your data.
• Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

California residents (CCPA): You have additional rights under the California Consumer Privacy Act, including the right to know what categories of personal information we collect and the right to opt out of sale (we do not sell personal information).

EEA/UK residents (GDPR): You have the right to lodge a complaint with your local supervisory authority if you believe we have not complied with applicable data protection laws.

We use cookies and similar tracking technologies to operate the Service. These include:

• Essential cookies: Required for authentication and basic Service functionality (e.g., keeping you logged in). Cannot be disabled.
• Performance cookies: Help us understand how users interact with the Service so we can improve it. These may include anonymized analytics data.

You can control cookies through your browser settings. Disabling essential cookies may prevent the Service from functioning correctly.

We implement industry-standard security measures to protect your information:

• All data is transmitted over HTTPS/TLS encryption
• Passwords are never stored — authentication is handled by Clerk
• Database access is restricted to authorized services only
• File uploads are stored in Cloudflare R2 with access controlled via signed URLs
• We regularly review and update our security practices

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security. If you believe your account has been compromised, contact us immediately at [email protected].

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16 without parental consent, we will take steps to delete that information promptly.

If you believe we have inadvertently collected information from a minor, please contact us at [email protected].

ShiftsLine is based in the United States. If you are accessing the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

By using the Service, you consent to the transfer of your information to countries that may have different data protection laws than your country of residence. Where required, we implement appropriate safeguards (such as Standard Contractual Clauses) for cross-border data transfers.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a prominent notice in the Service at least 14 days before changes take effect.

The "Last Updated" date at the top of this page reflects when the policy was last revised. Your continued use of the Service after the effective date of changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, please contact us: