Who is responsible
Shiftly is operated by Artem Yablochnyi, an individual in Poland. Contact details and the postal address appear on this page. The operator is the controller for account administration, subscriptions, support and security. Your organization controls the employee schedules, assignments and work records it places in Shiftly; we process these records on its instructions. Contact your organization for information about its workplace processing.
What we collect
You or your organization provide names, email addresses, optional phone numbers and avatars, venue and role details, shifts, checklist answers, photographs, measurements, incidents, comments and support messages. We also receive subscription identifiers and status from Apple or Google, device language, platform and app version, installation identifiers, push tokens and technical access logs including IP addresses. We do not receive full payment card details.
Purposes and legal bases
We use data to provide accounts, organize work, record completion, deliver reminders, verify access, answer support requests and protect the service. Our legal bases are performance of the service contract, compliance with applicable legal obligations, and legitimate interests in security, reliability and resolving disputes. Where processing requires consent, you may withdraw it. Required account information is necessary to provide access. Shiftly does not use advertising identifiers, continuous location tracking or automated decisions producing legal or similarly significant effects.
Who receives data
Access within an organization depends on roles and venue permissions. Authorized platform administrators can access data for support and operation. Hosting and Contabo object storage support the service and backups; Google Firebase and Apple deliver notifications; Apple and Google process purchases independently under their policies. Our email provider handles account correspondence when email delivery is used. Telegram receives the company name, author name, ticket subject, message text or an excerpt, and an administration link to alert the operator to support requests. Avoid putting sensitive information in support messages. We do not sell personal data.
International services and device permissions
Some providers operate internationally and may process information outside the European Economic Area. Information on the providers and applicable transfer arrangements is available from the contact on this page; transfers must follow applicable data protection requirements. Camera, photo access and notifications are requested for the features that need them and can be managed in device settings. The website uses essential session and security cookies for protected forms and administration, without advertising trackers.
Retention and deletion
Account and operational data remain for the duration of the organization’s use, including subscription interruptions, until deletion is requested. An owner’s account deletion deletes the whole company and its team data. Member deletion removes the account, shifts, support conversations and personal evidence; non-identifying completion records and numerical measurements may remain in company history. Access to deleted private files is removed immediately; storage cleanup retries after failures. Diagnostic error groups are removed after 30 days without recurrence; encrypted backups expire after 14 days. Telegram copies are separate from the account database: contact us to remove a support alert there. Limited records may be retained where required by law or necessary for a specific dispute, only for the applicable period.
Your rights and contact
Where applicable, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent. Write to the email on this page or use in-app support; we may verify your identity. We normally answer within one month; any lawful extension will be explained. You may complain to a supervisory authority, including Poland’s President of the Personal Data Protection Office (UODO). Workplace requests may also require your organization’s involvement. Material policy changes will be communicated in the service or through available contact details.
Updated: 2026-10-18