Privacy Policy

This policy explains what personal data Shiftena ("we", "us") collects, why we collect it, how it is stored and protected, and the choices you have. It covers both this website and the Shiftena application, a workforce management platform that companies use to run attendance, leave, payroll profiles, contracts, task boards, time tracking and a credential vault.

The two roles we play

Shiftena is used by companies ("workspaces") to manage their own teams, so we handle data in two distinct roles:

• As a controller for the data you give us directly: your account details, billing records and messages you send us.
• As a processor for workspace data. When an employer adds employees, records attendance, stores documents or enables time tracking, that employer decides what is collected and why. We store and process it on their instructions. If you are an employee with questions about data your employer keeps in Shiftena, please contact your employer first; they control that data.

Data we collect

Account data

• Name, email address and password (stored only as a secure hash)
• Workspace name and plan details
• Support conversations you have with us

Workspace data entered by employers

• Employee profiles: names, contact details, roles and designations
• Attendance records, leave requests and holiday calendars
• Salary profiles, payroll calculations and generated payslips
• Employment contracts and generated PDF documents
• Task boards, work items and daily task submissions
• Vault entries such as shared passwords and API keys. Vault secrets are encrypted with AES-256-GCM before they are written to the database, and opening a vault requires an approval code from the vault owner.

Monitoring data (only when an employer enables time tracking)

• Work session start and end times
• Periodic screenshots and screen recordings captured by the desktop tracker, taken only while a work session is actively running and never when paused or off the clock
• AI-generated summaries of recordings, produced so managers do not have to watch footage manually

Technical data

• IP address, browser type and device information in server logs
• Authentication cookies required to keep you signed in

We do not run advertising trackers on this website or in the application, and we do not sell personal data to anyone.

Payments

All payments are processed by Paddle acting as merchant of record. Your card number never reaches our servers. We receive only the information needed to activate your subscription, such as the plan purchased, the billing email and the transaction status. Paddle's handling of your payment data is described in their own privacy policy.

A note on employee monitoring

Time tracking, screenshots and recordings are optional features that each employer chooses to enable for their own team. The employer is responsible for using them lawfully: informing employees, obtaining any consent required in their jurisdiction, and complying with local employment and privacy law. Shiftena provides the tooling; the decision to monitor, and the legal basis for it, belongs to the employer. We design the tracker conservatively: it captures only during active, employee-started work sessions.

How we use data

• To provide, operate and secure the service
• To process subscriptions and send billing communications
• To send transactional email such as invitations, approval codes and password resets
• To respond to support requests
• To debug problems and prevent abuse

AI features send the relevant content, such as a work-session recording, to the Google Gemini API for processing and return the generated summary to your workspace. We do not use your workspace data to train our own models.

Subprocessors

We rely on a small set of infrastructure providers to run the service. Each one processes data only to provide their function to us:

Because our infrastructure is hosted in the United States, data you submit is transferred to and stored there regardless of where you are located.

Security

• All traffic is encrypted in transit with TLS
• Passwords are stored as salted hashes, never in plain text
• Vault secrets are encrypted at rest with AES-256-GCM
• Access to workspace data is enforced by role-based permissions and strict tenant isolation on every request
• Databases and caches are not exposed to the public internet

No system is perfectly secure, but if we learn of a breach affecting your personal data we will notify affected workspaces without undue delay.

Retention and deletion

We keep workspace data for as long as the workspace account is active. If a subscription ends, the workspace is paused and its data retained so it can be restored, unless the owner asks us to delete it. Upon a verified deletion request from a workspace owner we delete the workspace's data from production systems, with residual copies in backups expiring on the backup rotation schedule. Billing records are retained as long as required for tax and accounting purposes.

Your rights

Depending on where you live, you may have rights to access, correct, export or delete your personal data, and to object to or restrict certain processing. Workspace owners can exercise these rights for their workspace by contacting us. Employees should direct requests about employer-managed records to their employer, who controls that data; we will support employers in fulfilling such requests. For anything related to your own account data, email us and we will respond within 30 days.

Cookies

The application uses essential cookies only: session cookies that keep you signed in. This marketing site sets no advertising or analytics cookies.

Children

Shiftena is a workplace tool and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes to this policy

If we make material changes we will update the date at the top of this page and, for significant changes, notify workspace owners by email.

Contact

Questions about privacy or this policy: support@shiftena.com