Privacy Policy

1. Introduction

Welcome to Shiftelio (“we”, “our”, or “us”). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our workforce management platform at www.shiftelio.com(the “Service”).

2. Information We Collect

We collect the following categories of information:

• Account Information: Name, email address, phone number, and password when you register.
• Business Information: Company name, address, GST number, and employee details entered into the platform.
• Location Data: GPS coordinates collected for employee attendance verification. On the Android app, location is collected continuously in the background during an active work shift, including when the app is closed or not in use, using a foreground service. This data is visible to the employing business and is used solely for shift-attendance purposes. Location tracking stops automatically when the shift ends or the employee clocks out.
• Photo Data: A selfie photo captured at each clock-in and clock-out event for identity verification. Photos are uploaded to Shiftelio's cloud storage and are accessible to the employing business.
• Usage Data: Information about how you access and use our Service, including IP address, browser type, and pages visited.
• Payment Information: Billing details processed securely via our payment provider (Razorpay). We do not store full card numbers on our servers.

3. How We Use Your Information

• To provide, operate, and maintain our Service.
• To process employee attendance and generate payroll reports.
• To verify employee identity at clock-in and clock-out via selfie photos.
• To send WhatsApp and push notifications related to scheduling and alerts.
• To process payments and send billing-related communications.
• To improve and personalize your experience.
• To communicate with you about updates, security alerts, and support.

4. Sharing Your Information

We do not sell, trade, or rent your personal information to third parties. We share data only with the service providers that run parts of our platform, all bound by their own data-processing terms:

• Supabase - database, file storage and sign-in.
• Vercel - hosting of the website and app.
• Razorpay - payments.
• Meta (WhatsApp Business) - WhatsApp messages we send you.
• Google Analytics and Google Ads - counting visits to our public website and measuring our ads.
• Google (Gemini) - reads the receipt photos and bill files you choose to scan, on a paid service that does not use them to train its models.
• Microsoft Clarity - session recordings and heatmaps. Clarity records both our public website and the screens of the signed-in app, which can include what is shown on those screens, such as staff names and pay figures. Recordings are used only to find and fix problems in the product. Pages that show patient or home-care details, and family tracking pages, are never recorded.

Employer Access:Employee location data, attendance records, selfie photos, and profile information are accessible to the business (employer) that manages the employee's account on Shiftelio. This access is limited to the employing business and is enforced via row-level security policies.

4a. Background Location Collection

The Shiftelio Android app collects precise location data in the background to enable attendance tracking during active work shifts. This collection occurs even when the app is closed or not in use. A persistent notification is displayed on the device whenever background location tracking is active. Location collection is tied exclusively to active shift sessions and stops immediately upon clock-out or shift end. This data is not used for advertising or analytics.

Field stops: for staff the employing business marks as field staff, the stops of the working day are worked out from the location recorded on duty, and their place names come from OpenStreetMap or Google (only the coordinates are sent, never a name or phone number).

Fake-location check:to prevent attendance fraud, the Shiftelio Android app checks whether a known fake-GPS app from Shiftelio's list is set up on the phone when an employee clocks in or out, and during a shift while location tracking is running if the phone reports a faked location. Only the name of that one matching app is sent and shown to the employing business, and only for businesses that use this check. The full list of installed apps is never read, collected or shared.

4b. Camera & Photo Data

The Shiftelio Android app captures a selfie photo when an employee clocks in or clocks out to verify their identity. Photos are uploaded securely to Shiftelio's cloud storage and are accessible to the employing business. Photos are retained for the duration of the employee's account. This data is not used for advertising, biometric analysis, or facial recognition, and is not shared with any third party beyond the employing business.

Receipt photos:when you choose to scan a receipt for an expense, the photo or file is sent to Google only to read the bill (shop, date, amounts and items), and is kept in Shiftelio's private storage for the employing business.

4c. YouTube API Services

Shiftelio uses YouTube API Services to publish Shiftelio's own product and tutorial videos to the official Shiftelio YouTube channel. By using any Shiftelio feature that relies on YouTube API Services, you agree to be bound by the YouTube Terms of Service. Google's handling of your information is described in the Google Privacy Policy.

What we access:only our own Shiftelio channel. That covers the channel's name and ID; the details of videos we upload to it (title, description, tags, thumbnail, captions, playlist and privacy setting); the YouTube Analytics reports for our own channel and videos (views, watch time, audience retention, traffic sources, likes and subscriber gains and losses, which YouTube provides as totals, not per person); the public comments people post on our own videos, so we can read and reply to them; and the public channel name of subscribers who have chosen to make their subscriptions public. We do not access any YouTube channel other than our own, we do not contact commenters or subscribers outside YouTube, and we do not use YouTube data for advertising.

How it is stored and shared:the access token Google issues is kept encrypted on Shiftelio's own systems and is used only to upload and manage our own videos. Comments, subscriber names and analytics are read on screen when we check the channel; we do not build a database of them, and any copy we keep for planning is deleted or refreshed within 30 days. None of this data is shared with, or sold to, any third party.

Revoking access: access can be withdrawn at any time from the Google security settings page. Revoking access immediately stops the stored token from working, and you can ask us to delete any related data by emailing support@shiftelio.com.

4d. Feature Requests From Our Website

If you use the “Tell us what is missing” form on our website, we store what you asked for, your name, the WhatsApp number or email address you give us, your type of business if you choose it, and the page you sent it from. To stop abuse of the form we also keep a one-way hash of your network address and browser, never the address itself. We use these details only to reply to you about your request and to plan what we build next. We keep requests so we can follow up when something you asked for is built. You can ask us to delete yours at any time by emailing support@shiftelio.com. We never sell these details.

5. Data Security

We implement industry-standard security measures including encryption in transit (TLS), row-level security in our database, and regular security audits. However, no method of transmission over the internet is 100% secure.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. You can delete your account yourself in the app (Settings, then Delete my account), or request deletion of your data at any time by emailing support@shiftelio.com.

Location Data:Real-time location records are retained for up to 90 days after the shift in which they were collected. Attendance check-in/check-out coordinates are retained as part of the attendance record for the duration of the employee's account.

Field staff stops: for businesses that use field staff tracking, the list of places a staff member stopped at during a shift (the place name, the times and the time spent there) is kept for 90 days after the stop, then deleted automatically.

Website visits: individual page views on our public website are kept for 90 days, after which only daily totals remain. A visitor who never signs up is deleted 180 days after their last visit. For a business that signs up, a short record of how it found us (the sources and the first pages viewed) is kept with the business, and removed if the business is deleted.

Unfinished signups: while you fill in the signup form on our website, we save what you have typed so far (your name, email, WhatsApp number, business name and country - never your password) so we can help if you get stuck. It is deleted as soon as you finish signing up, and otherwise after 90 days. Visitors from the UK, the EU, Iceland, Liechtenstein, Norway and Switzerland are only saved after choosing Accept.

7. Cookies

We use cookies to keep you signed in, to count visits to our public website and to learn which pages and ads bring people to us. You can clear or block cookies through your browser settings.

• Our own visit counter (sh_vid, 180 days): a random visitor number, signed by our server, set only on our public website. It records which pages were viewed, buttons tapped and how far a page was scrolled, plus the country and the type of device and browser. It never stores your IP address.
• Where you came from (sh_attrib): each source that brought you to our website (for example a Google search, an ad, ChatGPT or a WhatsApp link) in order, so we can see which ones lead to sign-ups. Only the source is kept, never the full address you came from.
• Google Analytics, Google Ads and Microsoft Clarity: see section 4.

Visitors from the UK, the EU, Iceland, Liechtenstein, Norway and Switzerland are asked first: none of these cookies or tools are used until you choose Accept. If you choose No thanks, nothing is set. The app on your phone never sets sh_vid or sh_attrib.

8. Your Rights & Data Deletion

Depending on your jurisdiction, you may have the right to: access, correct, or delete your personal data; object to or restrict processing; and data portability. To exercise these rights, contact us at support@shiftelio.com.

Data Deletion Request: You can delete your account and associated data yourself in the app (Settings, then Delete my account; it is final after 30 days and you can cancel before then), or by emailing support@shiftelio.com with the subject line "Data Deletion Request". We will process your request within 30 days; step-by-step instructions are on our Delete your account page. Note that your employer (business account) may retain attendance records as required by applicable labour laws.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a prominent notice on our Service.