Privacy Policy

Who we are

Shiftick is operated by Shiftick, Dhaka, Bangladesh ("Shiftick", "we", "us"). We provide a mobile app for Android and iOS, a web console at app.shiftick.com, and this website. The Android app is published as com.invalidco.officehour.office_hour.

For privacy questions, write to [email protected].

Employers and staff — who controls what

Shiftick is sold to businesses. That makes the relationship two-sided, and it matters for your rights:

Your employer is the data controller for the attendance records, shifts, and staff profiles held in their workspace. They decide who is enrolled, what shifts are set, and who may see the reports. We act as their data processor and handle that data on their written instructions.
We are the data controller for our own account, billing, support and website data — the information we need to run Shiftick as a business.

If you are an employee asking to see, correct or delete your attendance history, contact your employer first: they administer the workspace and can act immediately. If they do not respond, write to us and we will help.

Data we collect

Account and profile

Name, work email address and, where your employer records one, phone number.
Job title or role, team or branch assignment, and employment start date.
A profile photo, where you or your employer uploads one.
An encrypted password, or the identifier returned by the sign-in provider you used.

Attendance and scheduling

Check-in and check-out timestamps recorded when you scan your workplace QR code, plus which code was scanned.
The network your device was on at the moment of the scan, used only to confirm you were on the workplace Wi-Fi. We record whether the network matched — we do not record your browsing or anything else about your traffic.
Shifts assigned to you, hours worked, breaks, lateness and overtime calculated from those timestamps, leave and holiday records, and any note an administrator attaches to an entry.

Device and technical

Device model, operating system version, app version, language and time zone — used to support the app and to apply the right time zone to a shift.
A push notification token, so shift reminders and alerts can reach your device.
Log data: IP address, the actions taken in the app or console, and crash diagnostics.

Billing

For paying workspaces we hold the billing contact, company name, billing address, plan, invoice history and tax identifiers. We never see or store full card numbers— payments are handled by our payment processor, and subscriptions bought inside the apps are handled by Apple or Google under their own terms.

Website and support

If you submit the quote or guest-post form on this site, we receive what you typed into it. If you email support, we keep the correspondence so we can follow up. This website uses no advertising or cross-site tracking cookies.

What we do not collect

No continuous or background location tracking. Shiftick does not follow where you are between check-ins.
No biometrics. No face, fingerprint or voice data is collected.
No access to your contacts, photo library, messages, call logs or other apps.
We do not sell personal data, and we do not share it for cross-context advertising.

Device permissions the app asks for

Permission	Why we ask	Optional?
Camera	To scan the workplace QR code at check-in. Images are read on the device and not uploaded or stored.	Required to check in by QR
Notifications	Shift reminders, roster changes and missed check-in alerts.	Yes — the app works without them
Network state / Wi-Fi info	To confirm the check-in happened on the workplace network.	Required where your employer enables Wi-Fi verification
Photos / files	Only when you choose to set a profile picture.	Yes

You can withdraw any of these in your device settings at any time. Turning off a required permission will stop the related feature from working.

Why we use it

To run the service: record attendance, publish rosters, and send shift notifications.
To produce the reports your employer relies on — punctuality, hours worked, overtime, and the PDF payroll logs.
To authenticate you and keep accounts secure, including detecting fraudulent check-ins.
To provide support and respond to what you ask us.
To bill workspaces and keep the accounting records the law requires.
To fix bugs and improve the product using aggregated usage and crash data. This analysis is done on data that does not identify you individually wherever that is possible.

We do not use your data to train machine learning models for third parties, and we do not use it for advertising.

Legal bases (UK/EU GDPR)

Where the GDPR applies, we rely on these bases:

Purpose	Basis
Providing the service to a workspace	Performance of a contract with the employer
Recording an employee's attendance and hours	The employer's legitimate interest in managing its workforce, and its legal obligations on working time and pay
Security, fraud prevention and service improvement	Our legitimate interests
Billing and tax records	Legal obligation
Marketing email to business contacts	Consent, withdrawable at any time

Your employer and its administrators. Anyone your employer grants console access can see your attendance records, shifts and reports. This is the point of the service.
Service providers who act only on our instructions: cloud hosting and database providers, push notification delivery, error and crash reporting, email delivery, and our payment processor. Each is bound by a written contract that limits them to the work we ask of them.
Apple and Google, for app distribution and for subscriptions purchased in-app, under their own privacy policies.
Authorities, where we are legally required to disclose. We will tell the affected workspace unless the law forbids it.
An acquirer, if the business is sold or merged. The data stays subject to this policy until you are given notice of a replacement.

We do not sell personal data to anyone, for any purpose.

International transfers

Our providers may process data in countries other than yours. Where data leaves the UK or the EEA, we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses, together with technical measures such as encryption in transit and at rest. Write to us if you would like details of the safeguards for a particular transfer.

How long we keep it

Attendance and shift records: for as long as the workspace is active, because they are payroll evidence. Your employer sets the retention period inside those limits.
Account and profile data: until the account is deleted, then removed from live systems within 30 days.
Backups: purged on a rolling cycle, no later than 90 days.
Billing and tax records: as long as tax law requires, typically six to seven years.
Support correspondence: up to 24 months after the ticket is closed.

Security

Traffic is encrypted in transit with TLS; stored data is encrypted at rest.
Passwords are stored hashed and salted; we cannot read them.
Access by our staff is role-based, logged and limited to those who need it to do a job.
Each workspace's data is logically separated from every other workspace's.

No system is perfectly secure. If a breach affects your data we will notify the affected workspace and, where the law requires, the relevant regulator — without undue delay and within 72 hours of becoming aware where the GDPR applies. To report a vulnerability, write to [email protected].

Your rights

Depending on where you live, you can ask to:

access a copy of the personal data we hold about you;
correct data that is wrong or incomplete;
delete data, where no legal or contractual duty requires us to keep it;
restrict or object to a particular use, including any based on legitimate interests;
receive your data in a portable, machine-readable format;
withdraw consent, without affecting what was done before you withdrew it;
complain to your data protection authority.

If you are in California, you additionally have the rights to know, delete, correct and to opt out of sale or sharing — and we confirm that we do not sell or share personal data as the CCPA defines those terms. We will not discriminate against you for exercising any right.

Send requests to [email protected]. We reply within 30 days. If the data belongs to an employer's workspace we will pass the request to them and support them in answering it.

Deleting your account and data

You can delete your Shiftick account and the personal data attached to it:

In the app: open Account → Delete account and confirm.
In the web console: open Account → Delete account.
By email: write to [email protected] from your registered address with the subject "Delete my account".

Deletion removes your profile, login credentials and notification tokens from live systems within 30 days, and from backups within 90 days. Attendance records that your employer must keep as payroll evidence are retained by the employer under their own obligations; ask them directly to erase those. Invoices we are legally required to keep are also retained.

If a whole workspace is closed, all of its data is deleted within 30 days of the closure taking effect.

Children's privacy

Shiftick is a workplace tool and is not directed at children. We do not knowingly collect data from anyone under 16. Where an employer lawfully employs someone aged 16 or 17, that person's data is handled exactly as any other employee's. If you believe a child under 16 has an account, write to us and we will delete it.

Changes to this policy

We update this policy when the product or the law changes. The effective date at the top always shows the current version. For material changes we will notify workspace administrators by email, and show a notice in the app, at least 14 days before the change takes effect.

Contact us

Shiftick
Dhaka, Bangladesh
Privacy: [email protected]
Support: [email protected]