Privacy policy

This policy explains what Shiftly collects, why, and what you can do about it. It covers both this website and the Shiftly application.

Who we are

Shiftly is operated by Happy Team Apps B.V., a Dutch besloten vennootschap (private limited company) established in the Netherlands. Under the GDPR, Happy Team Apps B.V. is the controller of the personal data described below.

Registered name

Happy Team Apps B.V.

Registered address

Willem Parelstraat 28, 1018 KZ Amsterdam, Netherlands

Chamber of Commerce (KvK)

98201166

VAT (BTW) number

NL868396874B01

The short version

We collect what is needed to run a shift schedule and tell people when their turn is coming. We do not sell your data, we do not run advertising, and there are no third-party analytics or tracking cookies on this website.

What we collect

Account information

Your name and email address, the organisations you belong to, and your role within them. Passwords are handled by Amazon Cognito and stored hashed. Shiftly never sees your password.

Scheduling information

The content you create in the product: rotations and their configuration, groups, shifts and who is assigned to them, overrides, periods you mark yourself unavailable, and your notification preferences.

Unavailability is stored as dates, not reasons. Shiftly has no field for why you are away and does not ask.

Connected services

If you connect Google Calendar, we store the access and refresh tokens that authorise the connection, and the identifiers of the calendar events Shiftly created, so those events can be updated or removed when the schedule changes. We do not read the rest of your calendar. Disconnecting the integration revokes the tokens.

Technical information

Standard server and delivery logs, meaning IP address, browser user agent, timestamps and the result of each request. We keep them to secure the service and to debug faults. We also record whether a notification email was delivered, bounced, or was marked as spam, because a sending domain that ignores that gets blocked.

Cookies

This website sets no cookies at all. The application stores your sign-in session in your browser’s local storage so you stay logged in. It is not shared with anyone and is not used to track you across sites.

Why we are allowed to hold it

• To provide the service. Account and scheduling data exist because there is no product without them. This is processing necessary to perform our contract with you.
• To keep it working and secure. Logs and delivery records rest on our legitimate interest in running a service that is available and not being abused.
• With your consent. Connecting Google Calendar is optional and takes an explicit authorisation you can withdraw at any time.

Who else processes it

• Amazon Web Services for hosting, database, file storage and email delivery.
• Google, only if you choose to connect Google Calendar, and only for that calendar.

We do not pass your data to anyone else. If that ever changes, this list changes with it before the transfer happens, not after.

Where it lives

Customer data is stored in Frankfurt, Germany (AWS eu-central-1). We are established in the Netherlands and the data sits in the EU, so none of this involves an international transfer.

This website and the application are served through a content delivery network with points of presence worldwide, so the pages themselves are cached close to you. The database behind them does not move.

How long we keep it

• Account and scheduling data is kept for as long as your account exists. Delete your account, or ask us to, and it goes.
• Historic shifts are kept while the organisation exists, because a rotation that forgets who covered last month cannot share turns out fairly.
• Logs and delivery records are kept for a short rolling window, then discarded.

Your rights

We are established in the Netherlands, so the GDPR governs everything we do with your data. These rights are yours wherever you happen to live. You can ask for a copy of your data, have it corrected or erased, receive it in a portable format, restrict or object to how it is processed, and withdraw consent wherever processing rests on it.

Write to contact@shift.ly and we will action it. If you think we have got it wrong, you can complain to our supervisory authority, the Dutch Autoriteit Persoonsgegevens, or to the data protection authority where you live or work.

Children

Shiftly is a workplace tool and is not intended for anyone under 16. We do not knowingly collect their data.

Changes

When this policy changes we update the date at the top. If a change materially affects how your data is handled, we will tell account holders by email rather than leaving you to notice.

Contact

Questions about any of this go to contact@shift.ly.