Privacy Policy

Last updated: August 5, 2026

1. Introduction

SyncShift365 ("we", "our", "us") provides workforce management software — employee scheduling, time and attendance, leave management, compliance, and team communication — to small businesses. This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and the rights you have over it.

By creating an account or using SyncShift365 (including the web app at syncshift365.com, our mobile app, and our API), you agree to the practices described in this policy.

2. Information We Collect

2.1 Account information

When you create an account, we collect your name, email address, and a securely hashed password. If your employer invites you to their organization, we also record your membership and role (Owner, Manager, or Employee).

2.2 Profile information

Depending on your organization's settings, you may be asked to provide: date of birth, emergency contact details, medical conditions relevant to your role, a short bio, a profile photo, qualifications and certifications (with issue and expiry dates), and uploaded documents. These fields are optional and configured by your organization.

2.3 Work data

The service stores the work information you and your team enter: schedules, shifts, availability, shift trade requests, time clock entries, timesheets, PTO and sick leave requests, tasks, job roles, skills, compliance rules and violations, labour costing data, messages, newsfeed posts, and notifications.

2.4 Location data

If your organization uses the mobile time clock with location validation, your device's location may be checked when you clock in or out to confirm you are at the correct work location. Location data is used only for this purpose and is not sold or used for advertising.

2.5 Device and technical data

We collect device push notification tokens (to deliver notifications to your phone), IP addresses, browser type, and basic usage logs to operate, secure, and improve the service.

3. How We Use Your Information

  • To provide and operate the SyncShift365 service you or your organization subscribed to
  • To authenticate you and secure your account
  • To deliver notifications about schedules, messages, and approvals
  • To send service emails (invitations, password resets, receipts) — never marketing without consent
  • To generate the analytics, labour costing, and compliance reports your organization requests
  • To detect, prevent, and investigate abuse, fraud, or security incidents
  • To comply with legal obligations

4. Legal Basis for Processing (GDPR)

For users in the UK and EU, we process personal data on the following bases:

  • Contract: processing necessary to provide the service you or your organization signed up for
  • Legitimate interests: securing the platform, preventing fraud, and improving the service
  • Consent: where we ask for optional data such as precise location, you may withdraw consent at any time
  • Legal obligation: where required by law

5. Who We Share Data With

We do not sell your personal data. We share data only with service providers necessary to run the platform:

  • Hosting & infrastructure — our servers and database are hosted on Railway (United States), with data encryption in transit and at rest
  • Email delivery — transactional emails (invites, resets, notifications) are sent via Resend or your organization's own SMTP provider
  • Object storage — profile photos and uploaded documents are stored in S3-compatible cloud storage
  • Push notifications — Apple Push Notification service (iOS) and Firebase Cloud Messaging (Android) deliver notifications to your device
  • Real-time messaging — WebSocket communication is facilitated by our own infrastructure

Your organization (the account owner and managers you work for) can see the work data associated with your membership, including schedules, time entries, and any profile information your organization requires.

6. Data Retention

We retain your data for as long as your account is active and for a reasonable period afterwards to allow reactivation, comply with legal obligations (including employment and tax record-keeping requirements in your jurisdiction), and resolve disputes. When you leave an organization, your membership is deactivated but historical records (e.g., completed timesheets and schedules) may be retained by the organization as required by law. You may request deletion of your account and personal data at any time — see Section 8.

7. Security

We protect your data with industry-standard measures: passwords are hashed with bcrypt, data is encrypted in transit (TLS) and at rest, access to production systems is restricted and monitored, and role-based access control limits what each user can see within an organization. No method of transmission over the internet is 100% secure, but we work hard to protect your information.

8. Your Rights

Depending on your jurisdiction (including under the UK GDPR and EU GDPR), you have the right to:

  • Access — request a copy of the personal data we hold about you
  • Rectification — correct inaccurate or incomplete data
  • Erasure — request deletion of your data ("right to be forgotten")
  • Restriction — limit how we process your data in certain circumstances
  • Portability — receive your data in a structured, machine-readable format
  • Object — object to processing based on legitimate interests
  • Withdraw consent — where processing is based on consent

To exercise any of these rights, contact us at the address in Section 10. We will respond within 30 days. If you are unsatisfied with our response, you may complain to your local data protection authority (in the UK, the Information Commissioner's Office).

9. Children's Privacy

SyncShift365 is intended for businesses and is not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

10. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

SyncShift365
Email: keith@ShiftCraft.app
Website: syncshift365.com

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and, where appropriate, by email. The "Last updated" date at the top of this page reflects the most recent revision.