Privacy Policy

1. Scope of this Privacy Policy

This Privacy Policy applies when you visit Shiftaro.com, use Shiftaro’s web or mobile applications, communicate with our sales or support teams, receive communications from us, or use other Shiftaro products and services that link to this policy.

It does not apply to third-party websites, payroll systems, integrations, or services that maintain their own privacy policies.

2. Important definitions

Customer means a business, organization, or other entity that subscribes to or administers a Shiftaro account.

Authorized User means an owner, administrator, manager, employee, contractor, or other individual permitted to use a Customer account.

Customer Data means personal information, workforce information, files, communications, and other content submitted to or generated through a Customer account.

Personal Information means information that identifies, relates to, describes, or could reasonably be associated with an individual or household.

3. Shiftaro’s privacy roles

Shiftaro as a controller or business

Shiftaro generally determines how information is processed when we collect it for our own purposes, including website analytics, sales and marketing inquiries, account registration, billing and subscription administration, customer support, service security, fraud and abuse prevention, product improvement, and communications about Shiftaro.

Shiftaro as a processor or service provider

When a Customer uses Shiftaro to manage its workforce, the Customer generally determines why and how Customer Data is processed. Shiftaro processes that information on the Customer’s behalf according to the Customer’s instructions, our agreements, and applicable law.

Customer Data may include employee profiles, schedules, availability, time-off records, time punches, compensation information, geolocation, communications, tasks, reports, and uploaded content.

4. Personal information we collect

The information we collect depends on how you interact with Shiftaro and which features a Customer enables.

Account and contact information

We may collect names, email addresses, telephone numbers, mailing addresses if provided, usernames, authentication credentials, profile images, preferred languages, time zones, job titles, organization names, and account preferences.

Organization and employment information

Customers may provide company and location information, departments and teams, job titles and positions, access levels and permissions, manager relationships, employment status, employee identifiers, assigned locations or teams, work qualifications, hire or separation information, and other workforce profile data.

Scheduling and availability information

Shiftaro may process scheduled shifts, assigned jobs or positions, shift locations, recurring availability, preferred shifts, unavailable periods, open-shift and coverage requests, shift swaps and offers, schedule notes, staffing requirements, and schedule-change history.

Time-off information

Customers may use Shiftaro to process time-off requests, requested dates, request reasons or notes, approvals and denials, time-off balances, accrual information, balance adjustments, and supporting documentation uploaded by a user.

Customers should avoid requesting unnecessary medical or highly sensitive details through general-purpose notes fields.

Timekeeping and attendance information

When enabled, Shiftaro may process clock-in and clock-out times, break start and end times, worked hours, missed punches, punch corrections, attendance exceptions, late arrivals, early departures, timesheet approvals, geofence exceptions, timekeeping audit records, and payroll export history.

Compensation, labor-cost, and payroll-related information

Customers may store or process hourly pay rates, salary information if supported, overtime rates and thresholds, shift differentials or premiums, estimated labor costs, scheduled labor costs, worked labor costs, approved timesheets, payroll export files, payroll identifiers, and information transmitted to customer-selected payroll systems.

Shiftaro is not itself a payroll processor, bank, tax adviser, or tax-filing service unless expressly stated in a separate agreement.

Compensation and payroll-related information is intended to be visible only to Authorized Users with appropriate access permissions configured by the Customer.

Geolocation information

If a Customer enables location-based features, Shiftaro may process approximate or precise device location information to verify clock-in or clock-out location, apply geofence rules, identify location exceptions, and support attendance or operational records.

Location collection may depend on device permissions and Customer configuration. Disabling location permissions may prevent certain features from functioning. Shiftaro does not intend to collect continuous background location unless a specific feature requires it and appropriate notice and permissions are provided.

Communications and collaboration information

Shiftaro may process chat messages, direct messages, team-channel communications, announcements, comments, task discussions, acknowledgements, read receipts, support messages, and attachments.

Authorized Users and Customer administrators may be able to access communications depending on account permissions, workplace policies, and applicable law.

Tasks, updates, and operational records

Customers may process assigned tasks, completion status, due dates, checklists, comments, photos or supporting evidence, shift notes, daily updates, handoff records, and acknowledgement history.

Uploaded content

Users may upload profile photos, company logos, documents, images, task attachments, time-off documentation, scheduling materials, and other files selected by the Customer or user.

Customers and users are responsible for ensuring they have the right to upload and process that content.

Billing and transaction information

For subscriptions and payments, we may collect billing contact information, subscription plan, transaction history, invoice information, payment status, and limited payment-related information.

Payment-card details are generally processed directly by our payment provider, Stripe, rather than stored by Shiftaro.

Support, sales, and recorded communications

When you contact us, request a demonstration, or receive support, we may collect your contact details, the content of your request, technical information, support history, and feedback.

Calls, demonstrations, or support sessions may be recorded where permitted by law. When recording is used, we will provide appropriate notice.

Information collected automatically

When you visit our website or use the Services, we may automatically collect IP address, browser and device type, operating system, device identifiers, language and time-zone settings, referring page, pages viewed, actions performed, session dates and times, application logs, crash and performance data, and security-related events.

Information from integrations

If a Customer connects Shiftaro to another service, we may receive or transmit information through that integration, including payroll data, calendar information, employee identifiers, scheduling data, timekeeping data, account information, and integration status.

5. How we collect information

We collect information directly from you, from a Customer or account administrator, through your use of Shiftaro, from devices and browsers, through cookies and similar technologies, from customer-selected integrations, from payment and service providers, and from public or commercial sources used for legitimate business development where permitted.

6. How we use personal information

We may use personal information to:

• Create and administer accounts.
• Provide scheduling, availability, timekeeping, communication, task, approval, reporting, labor-cost, and payroll-export features.
• Authenticate users and enforce access permissions.
• Process subscriptions and billing.
• Send service notifications and provide support.
• Operate, analyze, and improve our website and applications.
• Develop new features.
• Secure the Services and detect fraud, misuse, or unauthorized access.
• Maintain audit records.
• Communicate about products, updates, resources, and offers.
• Comply with legal obligations and enforce our agreements.
• Protect the rights, safety, and property of Shiftaro, our Customers, users, and others.

7. Legal bases for processing

Where applicable, we process personal information based on performance of a contract, compliance with legal obligations, legitimate interests such as operating, securing, and improving the Services, consent where required, protection of legal rights, or processing directed by a Customer acting as the controller.

8. Cookies and similar technologies

Shiftaro may use cookies, pixels, local storage, and similar technologies for secure login and session management, saving preferences, website functionality, analytics, performance measurement, fraud prevention, marketing attribution, and advertising where used.

We currently use Google Analytics and may add other analytics or marketing tools in the future.

Some privacy laws may classify certain advertising or cross-context analytics disclosures as a “sale” or “sharing” of personal information even when no money is exchanged. Where required, Shiftaro will provide cookie controls, opt-out mechanisms, or other privacy choices.

A separate Cookie Policy may provide additional details.

9. Marketing communications

We may send marketing emails about Shiftaro products, resources, and updates. You may unsubscribe from promotional emails using the link included in the message.

Even after unsubscribing, you may still receive non-promotional communications such as account notices, password-reset emails, security alerts, invoices, service notifications, and support messages.

Transactional email may be delivered through service providers such as SendGrid.

10. How we disclose personal information

Customers and Authorized Users

Information may be visible to the Customer and other Authorized Users as needed to provide scheduling, timekeeping, communication, reporting, and workforce-management functions. Visibility depends on access level, permissions, location, team, feature settings, and Customer configuration.

Service providers

We may use providers that support cloud hosting and infrastructure, email delivery, business email, analytics, payment processing, customer support, security, monitoring, storage, file delivery, communications, and other business operations.

These providers are authorized to process information only for the services they provide to us, subject to applicable agreements and law.

Customer-selected integrations

When a Customer enables an integration, we may disclose information to or receive information from that provider as directed by the Customer.

Professional advisers

We may disclose information to attorneys, accountants, auditors, insurers, and other advisers where reasonably necessary.

Legal and safety disclosures

We may disclose information if we reasonably believe disclosure is necessary to comply with law or legal process, respond to lawful government requests, investigate fraud or security incidents, enforce our agreements, protect legal rights, or protect the safety of users or others.

Business transfers

Information may be disclosed as part of a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality protections.

11. Sale and sharing of personal information

Shiftaro does not sell personal information for money.

However, certain analytics or advertising technologies may be considered “sale” or “sharing” under some U.S. state privacy laws. If Shiftaro engages in activities covered by those definitions, we will provide legally required notices and opt-out choices.

We do not knowingly sell or share personal information of individuals under 16.

12. Data retention

We retain personal information for as long as reasonably necessary to provide the Services, maintain Customer accounts, fulfill the purposes described in this Privacy Policy, comply with legal, tax, accounting, payroll, or recordkeeping requirements, resolve disputes, enforce agreements, investigate misuse, and preserve security and audit records.

Customer Data may remain associated with a Customer account after an employee is deactivated because the Customer may need to preserve schedules, time punches, approved timesheets, payroll records, compensation history, approvals, audit logs, communications, or other operational records.

Customers control many retention decisions for Customer Data. Some information may remain temporarily in backups or disaster-recovery systems after deletion.

13. Data security

Shiftaro uses administrative, technical, and organizational safeguards designed to protect personal information.

These may include encryption in transit, secure authentication, role-based access controls, scoped permissions, audit logging, access restrictions, system monitoring, backups, security updates, and incident-response procedures.

No service can guarantee absolute security. Users and Customers are also responsible for protecting credentials, configuring permissions properly, and notifying Shiftaro of suspected unauthorized access.

14. International data transfers

Shiftaro is based in the United States and uses service providers that may process information in the United States and other countries.

Where required, Shiftaro will use appropriate contractual or legal safeguards for international transfers.

By using the Services from outside the United States, you understand that information may be processed in jurisdictions whose privacy laws differ from those in your location.

15. Your rights and choices

Depending on your location and applicable law, you may have the right to request access, request correction, request deletion, receive a portable copy, restrict certain processing, object to certain processing, withdraw consent, opt out of targeted advertising, sale, or sharing, appeal a denied request, and lodge a complaint with a privacy authority.

To submit a request relating to information Shiftaro controls directly, email privacy@shiftaro.com.

We may need to verify your identity before fulfilling a request.

We will not discriminate against you for exercising a legally protected privacy right.

16. Additional notice for California residents

This section supplements the rest of the Privacy Policy for California residents where the California Consumer Privacy Act applies.

During the preceding 12 months, Shiftaro may have collected identifiers, customer-record information, commercial information, internet or network activity, geolocation information, professional or employment information, financial and compensation information, visual or audio information, uploaded content, account credentials, inferences derived from usage, and sensitive personal information where provided through enabled features.

We collect and use these categories for the business purposes described in this Privacy Policy.

California residents may have rights to know, access, correct, delete, and opt out of certain sale or sharing, and may not be discriminated against for exercising those rights.

Requests may be sent to privacy@shiftaro.com.

17. Children and minors

Shiftaro is offered to businesses and organizations, not directly to children as a consumer service.

Some Customers may employ individuals who are minors. Those Customers are responsible for complying with applicable employment, consent, and privacy requirements before adding a minor’s information to Shiftaro.

Shiftaro does not knowingly collect personal information directly from children under 13 for consumer marketing purposes.

18. Artificial intelligence and automated features

Shiftaro may introduce artificial-intelligence or automated decision-support features in the future.

These features may assist with schedule recommendations, coverage suggestions, summaries, risk identification, approval context, or operational insights.

Unless expressly stated otherwise, such features are intended to assist human decision-making rather than make final employment decisions without human involvement.

If AI features materially change how personal information is processed, this Privacy Policy and related notices will be updated.

19. Third-party links and services

The Services may link to third-party websites or services.

Shiftaro is not responsible for the privacy practices of those third parties. Review their privacy policies before providing personal information.

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect product changes, new features, legal requirements, service-provider changes, or business practices.

We will update the “Last updated” date when changes are posted. Where required, we will provide additional notice of material changes.