ShiftFlow — Clock In/Out

This Privacy Policy explains how ShiftFlow ("we," "us") collects, uses, and shares information when you use our time-tracking application (the "Service"). By using the Service, you agree to the collection and use of information as described here.

1. Information we collect

We collect the following types of information:

Account information: name, email address, business name, and password (stored in hashed form), provided when you register or are added to a business.
Time and attendance data: clock in/out timestamps, shift history, and hourly-rate information entered by a Manager.
Geolocation data: the device location at the moment of clock in/out, used to verify shift attendance. This is only collected if the browser or device grants location permission at that moment.
Billing information: subscription plan and status. Payment card details are handled directly by our payment processor, Lemon Squeezy, and are not stored on our servers.
Device and usage data: browser type, and basic usage logs needed to operate and secure the Service (for example, as an installable PWA).

2. How we use information

We use the information we collect to:

Provide, operate, and maintain the Service;
Verify shift clock in/out and generate shift and payroll reports for Managers;
Process subscription payments and manage billing;
Communicate with you about your account, such as verification emails or password resets; and
Detect, prevent, and address technical issues, fraud, or abuse.

3. Geolocation data

Location data is collected only at the moment an employee clocks in or out, and is visible to the Managers of that employee's business for attendance-verification purposes. We do not track location continuously or outside of clock in/out events. If you are an Employee, your Manager is responsible for telling you how this data is used within your workplace.

4. How we share information

We do not sell your personal information. We share information only with:

Members of your own business (for example, a Manager can see the shift and location data of their Employees);
Service providers who process data on our behalf, such as our hosting provider and Lemon Squeezy for payment processing; and
Authorities, where required to comply with a legal obligation.

5. Data retention

We retain account and shift data for as long as your account is active, and for a reasonable period afterward as needed for record-keeping, legal, or payroll-audit purposes. You may request deletion of your account and associated data, subject to any retention we are legally required to keep.

6. Security

We use reasonable technical and organizational measures to protect your information, including encrypted connections and hashed passwords. No system is completely secure, and we cannot guarantee absolute security.

7. Your rights and choices

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. You can update most account information from within the Service, or contact us using the details below to exercise these rights. You can also disable location permissions in your browser or device, though this may prevent clock in/out from recording a location.

8. Children's privacy

The Service is intended for use by businesses and their adult employees. It is not directed at children, and we do not knowingly collect personal information from children.

9. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify you.

10. Contact

Questions about this Privacy Policy or your data can be sent to support-shiftflow@utilthings.com.