How we handle your data

1. Who is responsible for your data?

Yam Grol, trading as ShiftPriority, Dobmannstraße 12, 80993 München, Germany, is responsible for personal data used to operate our website, administer accounts, bill customers, handle enquiries and secure the service. Contact: [email protected]; telephone: +49 176 42956906. The product is available at app.shiftpriority.com.

For employee and other workspace data, the customer organisation is the controller and ShiftPriority is its processor under the Data Processing Agreement. Your employer determines the lawful basis, access permissions, retention and employee notices. Please direct employment-record requests to your employer; we assist the employer with them.

2. Data, purposes and legal bases

2.1 Accounts and service communications

When an authorised workspace owner expressly agrees to a proposed Terms/DPA amendment in the app, we separately record the version, representative's account identifier, workspace name, document fingerprints, review language and actual acceptance/effective times. This agreement evidence is retained while the workspace exists; any necessary statutory or dispute records are separately restricted before workspace deletion. Original signup evidence is preserved, without backdating acceptance.

We process names, email addresses, account identifiers, authentication credentials, language preferences and business details to create and administer accounts. Workspace creation records the accepted Terms/DPA version, time, account and signup method. Account administration for our individual business customers is based on Art. 6(1)(b) GDPR. Administration of business representatives' accounts, agreement evidence and essential service, security and legal notices are based on Art. 6(1)(f) GDPR: our interests in operating the service, communicating with customers and demonstrating agreements. Statutory record-keeping is based on Art. 6(1)(c) GDPR.

Essential emails, including verification, password recovery, invitations, billing and material legal notices, are separate from optional product-help emails. A marketing opt-out does not prevent necessary service or legal notices. We record notice versions, recipients, dispatch times, provider references and failures to document communication. Receiving a notice does not constitute consent or acceptance of a new contract.

2.2 Employee and operational records

Customers and their staff may provide employee names, contact details, dates of birth, employment details, roles, departments, notes, hourly rates, photos, schedules, availability, leave requests, working-time and break records, approval/correction history, cash-tip declarations, sales, tip calculations and payouts. Team announcements, chat messages and read state are also stored. Customer-connected POS systems supply sales, tips, order/item, inventory and employee-mapping information. Employees may see coworker names, photos and published schedules where their employer enables that access; pay and other restricted records follow workspace permissions.

We process these records on the customer's documented instructions, rather than choosing a separate lawful basis for employment processing. Leave records or free-text notes may reveal health or other special-category data. The customer must establish an applicable Art. 9 GDPR condition and national employment-law basis where required, minimise these entries, and provide staff with its own notice. Do not upload diagnoses, medical documents or unrelated sensitive information.

2.3 Time clock and location

Shared-tablet time clocks use registered device tokens and employee PIN hashes. Phone/NFC punches may record location coordinates, accuracy, distance from the venue, tag/device identifiers, and whether a punch was outside the permitted area, depending on the employer's settings. The browser requests location at the punch; ShiftPriority does not provide continuous background location tracking. A browser permission is a technical permission, not by itself the employer's lawful basis for processing employee location. The employer must assess necessity, employee information and any employee-representation requirements before enabling it.

2.4 Billing

Stripe processes checkout and subscription payments, collecting and storing billing addresses (including country) and business names, together with business tax identifiers when provided, for invoicing and tax administration. We store customer/subscription identifiers, plan, billing status and related billing administration records; we do not store full payment-card numbers. Contract administration uses Art. 6(1)(b), business-contact administration Art. 6(1)(f), and statutory accounting Art. 6(1)(c) GDPR. Stripe also processes some payment and fraud-prevention data as an independent controller: Stripe Privacy Policy.

2.5 Enquiries, support and waitlist

Contact forms collect your name, email, message, topic and language. In-app support stores messages, attachments where supported, and the account/workspace context you provide. We use this to respond, diagnose problems and manage the customer relationship: Art. 6(1)(b) GDPR for requests related to a contract with you and Art. 6(1)(f) for other business enquiries. Joining an optional waitlist is based on consent, Art. 6(1)(a); withdraw by emailing us. Supplying an enquiry does not subscribe you to marketing.

Updated contact/support email notifications link to the authenticated app/admin inbox without copying message text. Earlier notifications may contain message text and remain subject to the applicable provider/inbox retention and your rights. Direct email enquiries still pass through our email-routing and receiving-inbox providers described below.

2.6 Security and abuse prevention

Hosting, authentication and application services process connection information such as IP addresses, browser/request information, timestamps, authentication events and rate-limit records to deliver the service, detect abuse and investigate incidents. Cloudflare Turnstile may check signup requests. Legal basis: Art. 6(1)(f) GDPR, our interests in protecting accounts and availability. Device storage/access strictly necessary for a requested security or authentication function falls under § 25(2) no. 2 TDDDG. See Cloudflare's Privacy Policy.

2.7 Address, maps and weather

Address search/reverse lookup sends address/place queries or an explicitly requested device position to Photon (komoot). Embedded map tiles are requested from OpenStreetMap. These direct requests expose connection information, including IP address, and the queried location/map area to the provider. You may enter a business address manually without device-location permission. Selecting an external Google Maps link opens Google's service under its own privacy terms.

When venue weather is enabled, our backend sends venue coordinates rounded to two decimal places to MET Norway. It sends our service identification, not your IP address, account details or employee clock-in positions. Forecasts are cached and adapted to the workplace timezone and temperature unit. This supports requested address/weather features; it does not track employees. Legal basis for our own administration: Art. 6(1)(f) GDPR; employee location processing remains the employer's responsibility. See komoot privacy information, OpenStreetMap privacy information and MET Norway's API terms.

During rollout, older app versions may still request venue weather/place lookup directly from Open-Meteo until the app is reloaded/updated; these requests share venue/place queries and browser connection information, including IP address. We are retiring that integration. See Open-Meteo's terms/privacy information.

2.8 Optional AI Import and scheduling tools

When a customer uses AI Import, submitted text, images or PDFs, and relevant context such as existing employee names, language and timezone, are sent to Anthropic's commercial API to extract employee/schedule records. Parsed import results and import history can be saved in the workspace. Anthropic states that commercial API inputs and outputs are not used for model training by default and are normally deleted within 30 days. Inputs/outputs flagged for usage-policy violations may remain for up to two years, and related trust/safety classifications for up to seven years; legal exceptions or a separately agreed retention arrangement can also apply. This is not a promise of zero retention. See Anthropic's retention information.

The employer controls the use and lawful basis of AI Import. Anthropic's standard DPA does not cover special-category data. Before sending, remove health information (including sick-leave entries), other special-category data and unnecessary details. The import screen requires a deliberate send after this restriction is displayed; its confirmation is a customer instruction, not employee GDPR consent. We cannot automatically establish whether every uploaded image, PDF or text has been appropriately redacted. It should submit only necessary information and review the result before saving it. Scheduling and compliance tools generate suggestions for people to review. ShiftPriority does not itself make solely automated employment decisions with legal or similarly significant effects; the employer remains responsible for the decisions it makes.

2.9 Device storage and optional Remember me

The app uses browser storage for authentication sessions, requested tablet/device pairing, language/interface preferences, app-version state and privacy choices. Storage strictly necessary for your requested service or to remember your privacy decision falls under § 25(2) no. 2 TDDDG. Privacy decisions expire after 180 days. App and website analytics/diagnostics choices are stored separately for each browser/device; changing one does not automatically change the other.

New visitors' login sessions are kept in the current tab by default. Selecting “Remember me” allows the session to survive browser closure and stores up to five account email addresses and sign-in methods as shortcuts on that device. Shortcuts remain after logout until removed on the sign-in page or browser storage is cleared. Unchecking the option on the next sign-in removes that account's shortcut and keeps the new session in the tab. Older browsers may retain a previously persisted session until a new choice or logout. The app does not save passwords in browser storage.

With Remember me enabled, the first-party sp_session_hint cookie is shared between app.shiftpriority.com and shiftpriority.com so the website can display a Dashboard link. It contains only the access-token expiry time, no token or email, and expires by that time; browser logout clears it and session renewal updates it. The app still verifies actual authentication. The sign-in method may also be kept temporarily in this tab during a social-login redirect.

Optional Remember me storage and related processing rely on § 25(1) TDDDG and Art. 6(1)(a) GDPR consent. Withdraw by signing out, removing saved account shortcuts and leaving Remember me unchecked on the next sign-in, or clearing app browser storage and the sp_session_hint cookie. This choice is separate from analytics/diagnostics consent.

2.10 Retired Plausible integration

We are removing the Plausible statistics integration. Updated website/app versions do not load its tracker or send its custom events. Older loaded versions can still contact Plausible until reloaded/updated. At our 2 October 2026 account check, the trial had expired and new statistics collection was suspended. The former integration sent page paths, referral source, device/browser categories and coarse feature events, without employee, schedule, tip or payment records. Plausible states that it uses no analytics cookies or persistent device identifiers, does not retain raw IP addresses and removes its daily identifier salt. The former legal basis was Art. 6(1)(f) GDPR, our interest in understanding service use. Existing provider records remain subject to its deletion terms and your applicable rights. Plausible Data Policy.

2.11 Google Analytics 4, with consent

Only after you enable Website analytics do we load Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; measurement ID G-2DHZB6S27V). It processes page/interaction, browser/device, approximate location and pseudonymous client/session information to help us improve the service. Automatic Enhanced Measurement is disabled, including scrolls, outbound links, searches, form interactions, videos and downloads. We do not intentionally send form contents, names, emails, employee/organisation IDs or business records as analytics events. Page reports remove query strings and fragments; app routes also redact invite/verification/OAuth tokens. Automatic browser-history reporting remains disabled in the property settings.

After consent, _ga and _ga_<container-id> cookies may be set for up to 180 days without expiry renewal on later visits. Advertising storage, advertising user data, advertising personalisation and Google Signals are disabled in our tag configuration. We do not request the Google tag or send measurement pings before an affirmative analytics choice. Legal bases: § 25(1) TDDDG and Art. 6(1)(a) GDPR. Withdraw via Privacy choices or Settings → Privacy; accessible analytics cookies are removed and the loaded tag is stopped. Google Privacy Policy and Google data-processing terms.

App and website reports use the same Analytics property. Google Signals and user-provided data collection are not enabled. Detailed device/location collection is enabled. Account sharing permits aggregated/de-identified modelling and business insights, technical support and business recommendations; sharing for Google products/services is disabled. Property-level advertising personalisation is enabled, while our tags deny the advertising uses described above.

2.12 Optional diagnostics

With separate diagnostics consent, the app uses Sentry for scrubbed technical error reports: an allowed error class, app version and locations in our built JavaScript files. Arbitrary error messages, employee records, request details, user identities, breadcrumbs, attachments, performance traces and session replays are excluded. The provider still receives network connection information when a report is sent. Legal bases: Art. 6(1)(a) GDPR and § 25(1) TDDDG where device storage/access is used. Withdraw through Privacy choices or Settings → Privacy. Sentry Privacy Policy.

2.13 Emails, reviews, videos and notifications

Resend delivers necessary account, invitation and legal emails. It checks a small sample of emails for abuse on Resend-operated RunPod infrastructure, without model training; ordinary email API traffic is not sent to Anthropic. Do not send health records or sensitive attachments through these emails. Resend security information.

Optional onboarding/product-help emails require a separate choice and email confirmation. Eligibility uses existing workspace activity (employees, shifts, POS, tips/revenue) and subscription status, rather than additional clickstream tracking; we may send one inactivity email after seven days. Basis: Art. 6(1)(a) GDPR. Each optional email has an unsubscribe link.

A neutral in-app Trustpilot prompt uses those same existing records after at least seven days and stores its shown/snoozed/completed state. Basis: Art. 6(1)(f), our interest in fair feedback. We do not send customer identity or eligibility data to Trustpilot. Choosing the review link opens its site under its own privacy policy. YouTube demo videos contact Google/YouTube only when you activate the external player; that action requests the video and allows the provider to receive connection and playback data. Our analytics choice is separate from that request.

If you enable push notifications, we store the browser push endpoint, subscription keys, device/browser information, language and notification preferences. Your browser's push provider (for example Apple, Google or Mozilla) delivers encrypted notifications and processes connection/delivery information under its own terms. Turn off push in app settings or browser permissions. For workspace notifications we act on the customer's instructions.

3. Recipients and international transfers

Optional Google Calendar connection: an authorised manager can connect an account and select one calendar for read-only display to managers with schedule access in that workplace. Google grants technical read access to calendar events and the calendar list; ShiftPriority reads the list for selection and imports only the selected calendar's event IDs, titles, locations, start/end times or all-day dates, and source links. It does not import guest lists or event descriptions, write to Google, or use events to change shifts, availability or automated scheduling. Choose a business calendar: private events in the selected calendar are also visible to the workplace's authorised managers. The customer determines the lawful basis and permissions for this workspace processing; OAuth approval grants technical access and is not itself a legal basis for other people's personal data.

Connection identifiers, encrypted server-side access credentials, change-notification subscription data and the latest event snapshot are stored using our existing Supabase services. The snapshot covers approximately the preceding 30 days and next year, is replaced on successful refresh, and can remain out of date during a provider or network failure. Disconnecting, changing the selected calendar or deleting the workplace removes the active snapshot; disconnection deletes stored access credentials. Google keeps the original calendar under the connected account's own terms. Google's Calendar API terms allow Google to process information in the US and other countries where Google operates; selecting this connection does not provide EEA-only processing. Calendar data is used only for this requested display and its security/support, not advertising, sale or AI training. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Apple Calendar is not activated by this implementation.

Authorised service personnel and the following providers receive data necessary for their functions. A provider's role may depend on the processing; payment/POS providers can act as independent controllers, while suppliers delivering customer workspace processing act as subprocessors.

Public authorities and professional advisers may receive data where legally required or necessary for legal claims. We do not sell personal data. A Frankfurt database does not mean every supplier processes exclusively in Germany. For transfers outside the EEA, an applicable adequacy decision (Art. 45 GDPR) or appropriate safeguards, such as the applicable Standard Contractual Clauses and supplementary measures (Art. 46), are required. Contact [email protected] for the applicable transfer information and a copy of safeguards; third-party confidential details may be redacted.

4. How long data is kept

• Account/workspace records remain for the service relationship until deletion is requested or the customer instructs deletion. Cancelling a subscription alone does not delete a workspace. Employee departure alone does not erase historical employment records; the employer controls its retention duties. Deletion of one person's account does not necessarily delete their employer's records or other workspaces.
• Enquiries/support records are kept while needed to answer or resolve the matter, then only where necessary for the customer relationship, legal obligations or claims. Waitlist information is kept until withdrawal or the list's purpose ends.
• German statutory records are retained by category: generally eight years for accounting vouchers/invoices, ten years for books/accounts and six years for business correspondence (§ 147 AO, § 257 HGB), calculated from the statutory starting point and extended where legally required. These duties do not justify retaining every employee record.
• Agreement evidence is kept while necessary to demonstrate the relationship and resolve claims, subject to applicable statutory periods. Legal-notice recipient evidence is removed daily after three years following the dispatch year for privacy notices, and six years following that year for contract/subprocessor correspondence; cleanup may add up to one day. A justified legal hold or statutory preservation, if required, is separately documented in restricted private records. Workspace-linked optional-email consent, lifecycle and review-prompt state is removed with that workspace. Legal-notice recipient records are also removed on account deletion.
• Privacy choices remain valid for up to 180 days; our configured Analytics cookies expire within 180 days. Google Analytics user/event data is configured for two months, without resetting expiry on new activity, with Google's monthly deletion process. This setting does not delete standard aggregated reports after two months. Google retention information.
• Supabase Free-plan API/database logs have a one-day retention period. Resend's current Free plan retains email/log data for 30 days, and its backups for seven days; customer-data deletion follows within 90 days of account termination, subject to legal exceptions. Cloudflare Pages Functions debugging logs are live streams without persistent storage; Functions metrics remain for up to three months. These periods do not apply to every provider security, authentication, account or suppression record. Application rate-limit records are purged daily once the rate-limit window is older than 24 hours (normally within 48 hours).
• Sentry Developer-plan diagnostic events are retained for 30 days from ingestion. Earlier paid/trial categories can retain their ingestion-time 90-day period; organisation audit logs about our administrator actions are kept indefinitely. Production event backups have 30/90-day retention depending on data type. Plausible's expired-trial terms provide deletion of retained statistics after notice, without specifying a fixed day count. These periods are separate from browser privacy choices.
• Inactive shared weather-cache entries are purged daily after seven days, normally within eight days. They contain rounded location keys and public forecasts, without account or employee identifiers.
• Anthropic API retention is described in section 2.8. Terminal push-outbox records are purged after 30 days. The current Supabase Free plan does not provide customer-accessible managed backups or point-in-time recovery; this does not mean the provider holds no underlying backups. Backup copies may retain deleted data until their applicable expiry; access stays restricted and deletion must be reapplied if a backup is restored. No immediate deletion from all provider backups is promised.

5. Your choices and rights

Where their statutory conditions apply, you have rights of access, rectification, erasure, restriction and data portability (Art. 15–20 GDPR). You can withdraw consent at any time without affecting the lawfulness of earlier processing. You may object, on grounds relating to your situation, to processing based on Art. 6(1)(f); an objection to direct marketing is unconditional (Art. 21 GDPR).

Use Privacy choices on the website/app, or Settings → Privacy in the app, for optional analytics/diagnostics. Decisions are independent across the app, marketing site and different browsers/devices. Optional-email preferences are separate. Refusing optional processing does not prevent core service use.

Settings → Privacy offers a JSON export of records the signed-in account can access. It is not a complete statutory access response or a complete workspace migration by itself; contact us for additional records or export assistance. Deletion is a verified request, not an immediate automatic wipe. We normally respond to rights requests within one month; where the GDPR permits an extension, we explain it within that month. We may need proportionate identity/authority verification.

Contact [email protected] for data we control. For employee records, contact your employer. You may complain to a supervisory authority, including the Bavarian Data Protection Authority (BayLDA), or an authority in your habitual residence, workplace or place of an alleged infringement.

6. Required information and security

Account, authentication and necessary billing details are required to supply the service; without them we cannot create or administer the account or paid subscription. Other profile details and optional features are optional unless your employer requires them under its own lawful arrangements. Employee records can originate from your employer, coworkers, your own entries or a POS/import connected by the employer.

We use HTTPS/TLS, provider-managed encryption at rest, tenant-scoped database access, role checks and private storage for uploaded photos/logos. Authorised access and privileged service operations are limited to their purpose. Security controls reduce risk but do not guarantee absolute security. For customer data, further commitments are in the DPA.

7. Updates

We publish dated versions and explain material changes in a dedicated notice. Material privacy changes are actively communicated to affected account holders, normally by email; customers must also keep their employee notices current. New processing purposes are explained before the processing starts, and fresh consent is obtained where required. Our usual advance notice for planned material changes is at least 14 days; corrections describing existing processing and urgent legally required information may be communicated promptly. Typographical or purely editorial corrections do not normally require a broadcast email. A privacy notice is information, not a request to accept a contract.