Privacy Policy

Information we collect

When your employer's admin creates or invites your account, or when you set one up yourself, Shiftova collects:

• Account details — your full name and email address.
• Company and role — which company account you belong to, and whether you're set up as an employee or an admin.
• Time and attendance records — the timestamp of every clock-in and clock-out, and the payroll-period totals calculated from them (regular hours, overtime, and statutory holiday hours).
• Adjustment history — if an admin corrects one of your time entries, we record what changed, who changed it, and when, so the change is visible to you.
• Location at clock-in/out — see the next section.

How location is used

Shiftova records a single GPS coordinate at the moment you tap Clock in and again when you tap Clock out. That's it — the app does not track your location in the background, between those two moments, or at any other time.

How we use your information

We use the information above only to run the core functions of the app:

• Recording your worked hours and computing payroll-period totals, including overtime and stat-holiday hours.
• Letting your company's admin review, and where necessary correct, the team's attendance.
• Authenticating you and keeping your account secure.
• Sending account-related email — invites, password resets, and confirmations.

We do not use your information for advertising, and we do not sell it to anyone.

Who can see your information

• You can always see your own time entries, edit history, and account details.
• Admins at your company can see the time entries, names, and emails of everyone at that same company — this is how they run payroll and cover shifts. They cannot see data belonging to any other company using Shiftova.
• Nobody outside your company — including other companies using Shiftova — can see your information. Company data is kept strictly separate at the database level, not just hidden in the app.

How your information is stored

Shiftova's data is stored with Supabase, a hosted Postgres database provider. Access to every table is enforced by row-level security policies at the database layer — meaning even a bug in the app's own code can't leak one company's data to another, because the database itself refuses the query. Passwords are never stored in plain text.

Data retention and deletion

We keep your account and time-tracking data for as long as your account is active with your company. To request access to, correction of, or deletion of your data, contact your company's admin or reach out to us directly (see Contact us).

Note that payroll and attendance records may need to be retained for a period after a deletion request to meet your employer's legal recordkeeping obligations, even if your account itself is removed.

Children's privacy

Shiftova is a workplace tool and is not directed at, or knowingly used by, children. We do not knowingly collect information from anyone under the minimum working age in their jurisdiction.

Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page. We encourage you to check back periodically.

Contact us

Questions about this policy or your data? Reach us at hello@shiftova.ca.