Privacy Policy

WorkShift LLC ("WorkShift," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application, web platform, and related services (collectively, the "Service").

By using WorkShift, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use the Service.

• Full name, email address, and phone number
• Business name, address, and contact information
• Employee roster information including names, roles, and contact details
• Payment and billing information (processed securely through third-party payment processors — we do not store full credit card numbers)
• Profile photos uploaded by users
• Messages sent through the in-app chat feature
• Time-off requests, shift swap requests, and other communications submitted through the Service
• Any other information you voluntarily provide

• Device information including device type, operating system, and unique device identifiers
• IP address and general geographic location
• App usage data including features accessed, screens viewed, and actions taken
• Log data including access times, error reports, and performance data
• Push notification tokens for delivering notifications to your device

With your explicit permission, we collect:

• Precise GPS location at the time of clock-in and clock-out
• Background location data when enabled, used exclusively for geofence-based features including safety monitoring, smart clock-in suggestions, estimated arrival times, and safe departure confirmation
• Location coordinates are stored only as part of attendance records and are not shared with third parties for advertising or marketing

We use the information we collect to:

• Provide, operate, and maintain the Service
• Create and manage your account
• Process payments and manage subscriptions
• Send shift reminders, schedule notifications, and operational alerts via push notifications
• Enable geofence-based attendance verification and employee safety features
• Generate attendance reports and payroll data for business administrators
• Respond to your support requests and communications
• Detect, prevent, and address technical issues and security incidents
• Comply with legal obligations
• Improve and develop new features for the Service

We do not use your personal information for targeted advertising. We do not sell your personal information to third parties.

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following limited circumstances:Railway (hosting), Supabase (database), Expo / Apple Push Notification Service (notifications), and payment processors. All are contractually obligated to protect your information.If you are an employee, your attendance records, schedule, and location-based clock-in/out data are visible to your employer's administrators. This is an inherent and disclosed feature of the Service.We may disclose your information if required by law, court order, or to protect the rights, property, or safety of WorkShift, our users, or the public.In the event of a merger or acquisition, your information may be transferred. We will notify you before your data becomes subject to a different privacy policy.

We implement industry-standard security measures including:

• Encryption of data in transit using TLS/SSL
• Secure authentication with JSON Web Tokens (JWT)
• Row Level Security (RLS) on all database tables
• bcrypt password hashing
• Access controls limiting employee access to user data

No method of transmission over the internet is 100% secure. In the event of a data breach, we will notify affected users within 72 hours of becoming aware.

• Access — Request a copy of the personal information we hold about you.
• Correction — Request correction of inaccurate or incomplete information.
• Deletion — Request deletion of your personal information, subject to legal exceptions.
• Portability — Request your data in a structured, machine-readable format.
• Notifications — Disable push notifications at any time through your device settings.
• Location — Revoke location permissions at any time through your device settings.
• Account Deletion — Contact support@workshiftapps.com. Data will be removed within 30 days.

To exercise any of these rights, contact privacy@workshiftapps.com. We will respond within 30 days.

WorkShift is not directed at individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe we have collected information from a minor, contact us at privacy@workshiftapps.com and we will delete it immediately.

If you are a California resident, you have additional rights under the CCPA:

• The right to know what personal information we collect, use, disclose, and sell
• The right to delete personal information we have collected
• The right to opt out of the sale of personal information — WorkShift does not sell personal information
• The right to non-discrimination for exercising your privacy rights

To exercise your California privacy rights, contact privacy@workshiftapps.com.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following applies and prevails over any conflicting term in this policy. The data controller is WorkShift LLC (Puerto Rico, United States). You can reach our privacy team at privacy@workshiftapps.com.

• Performance of a contract — creating and operating your account, delivering scheduling, attendance and payment features, and providing support.
• Consent — analytics and marketing cookies, and optional background-location features. You may withdraw consent at any time without affecting prior lawful processing.
• Legitimate interests — securing the Service, preventing fraud and abuse, and improving our features, balanced against your rights.
• Legal obligation — retaining billing records and responding to lawful requests from authorities.

You have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to processing; data portability; and withdraw consent at any time. We do not carry out automated decision-making that produces legal or similarly significant effects about you. To exercise any right, email privacy@workshiftapps.com; we respond within one month (extendable by two months for complex requests, Art. 12 GDPR).You may lodge a complaint with your local supervisory authority — for example, the Agencia Española de Protección de Datos (AEPD) in Spain, or the Information Commissioner's Office (ICO) in the United Kingdom.Your data is stored and processed in the United States. Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards — primarily the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum — together with supplementary technical measures such as encryption in transit and at rest. A copy of the relevant safeguards is available on request.

WorkShift serves users in Puerto Rico and Latin America. If you are located outside the United States, your information may be transferred to, stored, and processed in the United States under the safeguards described above.

For users in countries with specific data protection laws, including Brazil (LGPD) and Mexico (LFPDPPP), we are committed to complying with applicable local requirements. Contact privacy@workshiftapps.com for jurisdiction-specific inquiries.

WorkShift uses push notifications to deliver shift reminders, schedule updates, task assignments, request approvals, and safety alerts. You may disable push notifications at any time through your device settings. Disabling notifications will not affect your ability to use core features but may cause you to miss important operational alerts.

Our website uses three categories of cookies. (1) Necessary cookies keep the site working (session, security, your saved preferences) and are always active. (2) Analytics cookies (Google Analytics) help us understand aggregate usage. (3) Marketing cookies (Meta Pixel, TikTok Pixel) let us measure and optimize advertising campaigns. Analytics and marketing cookies load ONLY after you opt in through our cookie banner. Nothing non-essential is set until you accept. You can accept, reject, or customize your choice — and change it at any time — using the cookie settings button (🍪) shown at the bottom-left of every page. We store your choice for 12 months and will ask again after that or if this policy changes materially.

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

We may update this Privacy Policy at any time. We will notify you of material changes by updating the "Last Updated" date and, for significant changes, by email or in-app notification at least 15 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

WorkShift LLC · Puerto Rico, United States
Email: privacy@workshiftapps.com
Support: support@workshiftapps.com
Website: workshiftapps.com

For urgent privacy concerns, include "PRIVACY URGENT" in the subject line.