Privacy Policy

When a business signs up, that business decides what employee information goes into ShiftAnchor and how it is used. The business is the data controller; ShiftAnchor is the data processor acting on its instructions.

If you are an employee and want your information corrected or removed, contact your employer first — they administer the account. We will help them action it.

Account details. Name, email address, and a hashed password. Passwords are stored using bcrypt and cannot be read by us or recovered — only reset.

Employment details entered by your employer. Job role, permission level, pay rate, payroll ID, and whether the account is active.

Scheduling and time records. Shifts, clock-in and clock-out times, timesheets and sign-offs, availability, time-off requests and any reason you type into them, shift-swap requests, and pay adjustments.

Time zone. Your device's time zone, read from your browser settings, so punches record the correct local time. This is a setting, not a location — it identifies a zone such as "America/Vancouver", not where you are.

Billing. For paying account owners, subscription status and plan. Card details are entered directly with Stripe and are never sent to or stored on our servers.

• No location or GPS. The app does not request location permission and cannot see where you are when you clock in.
• No advertising or tracking. There are no analytics scripts, no advertising SDKs, no third-party cookies, and no cross-site tracking.
• No contacts, photos, camera, or microphone.
• No selling of data. We do not sell or rent personal information to anyone, for any purpose.

Only to run the service: showing schedules, recording hours, producing timesheets and pay statements, sending account emails such as invitations and password resets, and billing account owners. We do not use employee data to train models or build profiles.

ShiftAnchor uses no AI. The in-app help assistant ("Marina") looks like a chatbot but is not one: it is a fixed list of questions and answers with a keyword matcher, running entirely in your browser. It sends nothing to any AI service, makes no network calls, and cannot see your schedule, hours or pay.

Nothing you type into it leaves your device, and no part of the product sends your data to a language model or uses it for training.

Inside your organisation, visibility depends on the role your employer assigns. Managers and owners can see schedules, hours and pay information for their staff; employees see their own.

Outside your organisation, we use a small number of providers:

• Vercel — hosting and content delivery.
• Neon — encrypted database hosting.
• Stripe — subscription billing and card processing.
• Google — email delivery. Invitations, verification, password-reset and billing-renewal messages are sent through a Google-hosted mailbox, so Google processes the recipient's address and the contents of those messages.

If your employer connects a payroll provider such as ADP or Workday, hours and pay data are exported to that provider at their direction.

We may also disclose information where legally required, or to protect the safety and rights of users.

Traffic is encrypted in transit with HTTPS and the database is encrypted at rest. Passwords are hashed with bcrypt. Sessions use signed, HTTP-only cookies. Password-reset links are single-use and expire. Access within an organisation is enforced by role on every request, not just hidden in the interface.

No system is perfectly secure, and we cannot guarantee absolute security.

Account and time records are retained while the organisation's account is active, since employers generally have legal obligations to keep payroll records for several years. When an account is closed, we delete or anonymise the data unless we are required to retain it.

Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to withdraw consent. Employees should raise these with their employer, who administers the account; account owners can contact us directly.

How to delete your account and data — what is erased, what is kept as a payroll record, and how long it takes.

ShiftAnchor is a workplace tool and is not directed at children. We do not knowingly collect information from anyone under 16 except where an employer enters details for a lawfully employed young worker.

If this policy changes materially we will update the date above and notify account owners by email.

Questions about this policy or a privacy request: call 778 858 3885.