Privacy Policy

Shyftr is a workforce management platform operated from Scotland, United Kingdom. Contact: admin@shyftr.app

Personal Information

• Full name, email address
• Date of birth, gender
• Home address
• Phone number
• Emergency contact details
• National Insurance number (encrypted at rest)
• Tax code and payroll reference

Employment Information

• Shift schedules and attendance records
• Clock-in and clock-out times
• Holiday requests and entitlement
• Pay rates and payroll data
• Absence and sickness records

Technical Data

• GPS/location data (collected at clock-in, clock-out and welfare check-ins only — not tracked continuously)
• Device push notification tokens
• IP address and browser information
• Login timestamps

• Employment contract performance
• Legal obligations (payroll, HMRC compliance)
• Legitimate interests (security and safety of lone workers via geofencing)
• Consent (push notifications)

• Active employee data: duration of employment plus 6 years (HMRC payroll records requirement)
• Location data: 90 days
• Deleted account data: 30 days then permanently deleted

• Supabase (database hosting, EU/US data processing agreement in place)
• Resend (email delivery only)
• Your employer (all data visible to your company's administrators)
• HMRC (payroll data via your employer)

We do NOT sell your data to third parties.

• Right to access your data
• Right to correct inaccurate data
• Right to erasure (where legally permitted)
• Right to data portability
• Right to object to processing
• Right to restrict processing

Contact admin@shyftr.app to exercise any right.

NI numbers are encrypted using AES-256-GCM encryption and are only decrypted when generating payroll exports. They are never stored in plain text.

GPS coordinates are captured only at the moment of a clock-in, clock-out or welfare check-in event. Shyftr does not track your location continuously. Location data is used solely to verify attendance at your assigned site.

Shyftr uses essential session cookies only. We do not use tracking or advertising cookies.

We will notify users of significant changes by email. Last updated: June 2026.

You have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled.