Privacy Policy

1. Introduction

MyShifts is provided by Srini.AI ("we", "our" or "us"). This policy explains what personal data we collect when you visit our website or use the MyShifts workforce scheduling platform (the "Service"), why we use it, who we share it with and your rights. We comply with the UK GDPR and the Data Protection Act 2018. This policy forms part of our Terms and Conditions.

2. Who is responsible for your data

• Business customers' staff data: when a business (your employer) uses MyShifts to manage its staff, the business is the data controller for its staff's personal data and we are its data processor. We only process that data on the business's instructions and under our Terms (clause 12). If you are a member of staff, please contact your employer first about your data; we will help them respond.
• Our own data: we are the data controller for account-holder and billing details, website visitors, enquiries, support requests and security records.

Data protection contact: privacy@myshifts.ai

3. Information we collect

• Account and business details: name, work email, phone number, job title, business name, type, country, currency and location addresses.
• Staff and workforce data (entered by the business or its staff): names, contact details, roles, departments, pay rates, availability, rotas and shifts, time-off requests, shift swaps, messages and notifications.
• Time and attendance data: clock-in and clock-out times and, where the business switches on location-based clock-in, the device's location at the moment of clocking in or out. We do not track location continuously or outside clock events.
• Billing data: plan, invoices and payment status. Card and Direct Debit details are handled by our payment providers; we do not store full card numbers.
• Security and technical data: IP address, device and browser information, sign-in and security logs, two-factor settings, and the result of an automated bot check when you sign up or sign in.
• Website usage: pages visited and, if you start but don't finish signing up, the details entered so far so you can resume.
• Records of agreement: the version of these documents you accepted and when.

4. How we use it and our legal basis

• Providing the Service (scheduling, attendance, payroll exports, messaging) — performance of our contract with the business; for staff data, on the business's instructions.
• Accounts, billing and support — contract.
• Security and fraud prevention (bot checks, rate limiting, sign-in protection, logs) — legitimate interests in keeping the Service and its users safe.
• Service emails and SMS (invitations, rota and shift notifications, password resets) — contract / legitimate interests.
• Improving the Service — legitimate interests, using aggregated or de-identified data where possible.
• Marketing emails — only with consent or where the law allows for business customers; you can unsubscribe at any time.
• Legal obligations — tax, accounting and responding to lawful requests.

Location data: businesses that switch on location-based clock-in are responsible for telling their staff and having a lawful basis for it. AI features: some optional features (such as suggested rotas) use AI models to produce suggestions; a manager always reviews them, and we make no decisions with legal or similarly significant effects about anyone by automated means alone.

5. Who we share data with

We never sell personal data. We share it only with:

• The business you work for, if you are a member of staff.
• Service providers (sub-processors) who process data for us under contract: cloud hosting, database and authentication (Lovable Cloud / Supabase); bot protection (Cloudflare Turnstile); payments (Stripe, GoCardless); email delivery (Resend and our hosting provider's email service); SMS (Twilio); AI model providers for optional AI features (accessed through Anthropic and the Lovable AI gateway); website analytics, only with your consent (Google Analytics); currency exchange rates (no personal data).
• Authorities or advisers where required by law or to protect rights and safety.

Public website: our homepage can show anonymised activity across MyShifts (for example "a shop in Bradford published a rota" or total hours rostered). It never shows staff names. A business is only named publicly with its permission, and can ask to be left out at any time via privacy@myshifts.ai.

6. International transfers

Some providers process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.

7. Security

We use encryption in transit and at rest, role-based access controls with tenant separation, optional two-factor authentication, bot protection on sign-up and sign-in, and audit logging.

8. How long we keep data

• Business and staff data: for as long as the business's account is active; after it closes, it can be exported and is then deleted or anonymised as set out in our Terms (clause 13), unless the business instructs otherwise or the law requires us to keep it.
• Billing and tax records: 6 years, as required by UK law.
• Security logs: only as long as needed to protect the Service and investigate incidents.
• Records of agreement to these documents: for the life of the account plus 6 years.
• Unfinished sign-up details: deleted after 30 days. Website activity records: deleted after 90 days.

9. Your rights

Under UK data protection law, you have the right to:

• Access a copy of your personal data
• Rectification of inaccurate or incomplete data
• Erasure (subject to legal requirements)
• Restriction of processing
• Portability of data you provided
• Object to processing based on legitimate interests, and to direct marketing at any time
• Withdraw consent where processing is based on consent

Contact privacy@myshifts.ai. If your data is held for your employer, we will pass your request to them as controller. We respond within one month.

10. Cookies and similar technologies

We use essential cookies and local storage to keep you signed in, remember settings and protect the Service (including the Cloudflare Turnstile bot check). Google Analytics is loaded only if you accept analytics cookies in our cookie notice; you can change that choice at any time by clearing it in your browser.

11. Children

Business accounts must be created by adults authorised to act for the business. Staff aged under 18 may be added by their employer, who is responsible for that data as controller.

12. Changes to this policy

When we make material changes we will update the version and date above and tell account holders by email or in the app before they take effect.