Privacy Policy

1. Who We Are

SafeShift ("we," "us," "our") provides scheduling, time tracking, break-compliance tracking, reminder, pay-reporting, and recordkeeping software ("the Service") to businesses and their teams. We do not provide legal advice.

Questions about this policy: [email protected] · Oxnard, CA (mailing address TBD)

2. Data We Collect

Business Account Data

• Business name, address, and identifying information
• Manager and owner names, email addresses
• Account credentials (passwords are hashed with bcrypt — never stored in plaintext)
• State and industry sector for break-rule configuration

Employee Data (entered by the employer or synced from a POS system)

• First and last name
• Email address (if provided)
• Phone number (if provided — used for SMS reminders with consent)
• Mailing address (if provided)
• Roles or positions, and the pay rate the employer assigns to each role
• Work state, used for state-specific rule configuration
• Preferred notification language (English or Spanish)
• Kiosk clock-in PIN, when the employer enables a clock-in kiosk (stored as a keyed hash and encrypted at rest; never shown to other employees)
• POS / HR system employee identifiers (Square, Toast, Clover, SpotOn, Shift4, PAR Brink, Tray, or Gusto team member IDs)
• Compliance exemption status

Onboarding & Identity Documents (collected during employee onboarding, if enabled by employer)

• I-9 Employment Eligibility Verification form, including SSN, passport numbers, visa/alien registration numbers, and identity document images — required by USCIS
• Typed electronic signature and signing timestamp
• Signed HR documents (employee handbook acknowledgment, at-will agreements, arbitration agreements)
• Training certificates and acknowledgments
• Custom documents configured by the employer

Work Record Data

• Shift schedules and assignments
• Clock-in and clock-out times
• Break logs (type, start time, end time, duration)
• Missed break and short break records
• Meal break waiver records (pending, signed, revoked) including typed signature and IP address
• Compliance violation records
• Break attestation answers recorded at clock-out (kept as part of the compliance record)
• Tip declarations entered at clock-out (declared cash tips)
• Shift swap and trade requests (parties, consent timestamps, and manager decisions)
• Time-off requests and sick leave balances and usage

Location Data (Geofenced Clock-In)

If — and only if — an employer enables geofenced clock-in for a location, the mobile app captures the device's GPS coordinates at the moment of a clock-in or clock-out punch, solely to verify on-site presence. Location is captured only at punch time and only with the employee's device-level location permission. SafeShift never tracks location continuously or in the background.

Pay, Tip & Payroll Data (when the employer uses SafeShift's pay and payroll tools)

• Pay rate history, including per-role rates
• Computed hours, overtime, break premiums, and gross-pay figures in payroll-ready reports
• Declared cash tips and tip distribution results computed under the employer's configured tip policy
• Sick leave accrual and usage ledger
• Payroll-provider employee and company codes (for example ADP file numbers), when the employer uses that provider

Linked Employment Profiles

Where one person works for two related businesses that both use SafeShift (for example, two locations with different legal entities under one owner group), their employment records may be linked. Each employer's records remain separate and visible only to that employer; linking lets the employee use one login, switch employers in the app, and see their own combined schedule and hours.

Communication Data

• Direct messages between employees and managers via the SafeShift portal
• Broadcast announcements sent by managers to employee groups
• SMS notification logs (type, recipient phone number, delivery status, message body)
• Employee SMS opt-in consent status and timestamp
• Push notifications for shifts, breaks, schedules, and alerts — device push tokens are encrypted at rest
• Weekly hours digest to employees (email; SMS only with a separate opt-in)

POS / HR Integration Data (only if you connect Square, Toast, Clover, SpotOn, Shift4, PAR Brink, Tray, or Gusto)

• OAuth access and refresh tokens or API credentials (encrypted at rest)
• POS-sourced employee roster data, shift records, and clock events
• Pay rates and declared tips reported by the POS or HR system, where the provider supplies them
• Gusto roster and time-sheet data (Gusto is an HR/payroll platform, not a POS)

Billing Data

Payment processing is handled directly by Stripe, Inc. SafeShift does not store full card numbers or CVV codes. We store Stripe customer IDs, subscription status, billing plan, and subscription interval.

Your subscription tier is based on a fixed seat limit set at the time your plan is activated. The number of active, compliance-tracked employees counts against that seat limit. This count — not individually identified employees — is associated with your business account and location, not stored as a personal data profile on any individual employee.

Technical and Usage Data

• IP addresses (recorded at waiver signing for electronic signature validation under the federal E-SIGN Act)
• Session activity for security monitoring
• API request logs for troubleshooting
• Kiosk tablet pairing tokens (per-device, revocable by the employer)

3. Why We Collect Your Data

We collect and use data solely to provide and improve the Service:

• Scheduling and shift management
• Break reminder scheduling and delivery (SMS or in-app notifications)
• Compliance tracking and violation recordkeeping
• Compliance report and evidence export generation
• Time tracking via the mobile app, a PIN kiosk, or a connected POS
• Payroll-ready hours, pay, and tip reporting for employer review
• Tip distribution calculation under the employer's configured policy
• On-site presence verification at clock-in — only where the employer enables geofenced clocking
• Meal break waiver creation, signing, and recordkeeping
• Manager–employee messaging and announcements
• Account management, authentication, and security
• Billing and subscription management
• Fraud prevention and security monitoring
• Compliance with applicable laws

4. Third-Party Services

We share data with third-party service providers only as necessary to operate the Service. We do not sell personal data. We do not share personal data with advertising networks or data brokers.

Managed payroll service: employers may subscribe to have SafeShift's payroll team run their payroll in ADP. Designated SafeShift staff can then view that employer's approved payroll reports and submit them to the employer's ADP account on the employer's behalf. Staff access is limited to viewing and exporting; approving, editing, or voiding payroll always remains with the employer, and staff actions are logged.

5. Data Security

• All data is transmitted over HTTPS/TLS encryption
• Passwords are stored as bcrypt hashes — never in plaintext
• Manager and employee refresh tokens are rotated on each use and stored as SHA-256 hashes
• Each business's data is logically isolated at the database level (tenant isolation)
• Access controls restrict data to authorized accounts only
• Break logs, violation records, and SMS logs are immutable — designed for audit integrity
• File storage is provided by Cloudflare R2 with encryption at rest

No system is 100% secure. We take reasonable technical and organizational measures to protect your data, but we cannot guarantee absolute security.

6. Data Retention

We retain data for as long as your account is active or as needed to provide the Service, subject to the minimum retention periods required by law. Key schedules:

• I-9 forms and identity documents: 3 years from date of hire OR 1 year after termination, whichever is later (USCIS 8 CFR 274a.2). Data is automatically purged after this window with 30 days advance notice to the employer.
• Signed onboarding documents: 4 years from date of signing.
• Break, compliance, and wage/hour records: 3 years (anonymized after retention period, not deleted — FLSA 29 CFR 516).
• Document access audit log: 7 years (required for compliance evidence).
• Payroll reports, pay-rate history, and tip records: 4 years (IRS employment-tax recordkeeping; FLSA and state wage-hour rules).
• Push notification tokens: deleted upon employee termination + 30 days.
• Employee PII (name, email, phone): subject to CCPA right-to-deletion requests; minimum retention floors apply if employment records are legally required. Break logs, violation records, and shift records may be retained beyond an employee's termination date when necessary to exercise or defend legal claims under California Labor Code — including PAGA claims — under Cal. Civ. Code §1798.105(d)(3). Such records are anonymized, not deleted, after the applicable retention period.

Employers using SafeShift may request early deletion of terminated employee data (subject to mandatory minimum retention floors) via Settings → Data & Privacy in the manager portal. To submit a deletion request as an individual: [email protected].

7. Your Rights

You may, at any time:

• Request access to the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Opt out of SMS communications by replying STOP to any SMS message from SafeShift

Employers using SafeShift are responsible for handling employee rights requests related to data they entered. SafeShift will assist employers in honoring such requests as required by law.

To submit a request: [email protected]

8. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal information we collect, the purposes for which it is used, and the categories of third parties with whom it is shared
• Right to delete your personal information (subject to legal retention requirements)
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information — SafeShift does not sell or share personal data for cross-context behavioral advertising
• Right to non-discrimination for exercising your privacy rights
• Right to limit the use and disclosure of sensitive personal information (CPRA) — SafeShift collects sensitive personal information including I-9 employment eligibility data (Social Security numbers, passport numbers, and identity documents). This information is used solely to provide the Service and is not used or disclosed for any other purpose. You may request that we limit processing of your sensitive personal information to what is necessary for the service purpose.

Role clarification (employee data): SafeShift processes employee personal data as a service provider on behalf of employers. Under the CCPA, the employer (the business that created the SafeShift account) is the "business" controlling employee data; SafeShift is the "service provider." Employees are encouraged to direct CCPA requests to their employer first. SafeShift will assist employers in fulfilling such requests as required by law.

Authorized agents: California residents may designate an authorized agent to submit requests on their behalf. The agent must provide written authorization signed by you. Include the signed authorization when submitting the request.

To submit a California-specific request: [email protected]

9. SMS Consent

SafeShift sends SMS break reminders and notifications on behalf of employers to employees who have provided explicit opt-in consent. No SMS is sent to any employee without prior consent. Employees may opt out at any time by replying STOP to any message. Message and data rates may apply. For help, reply HELP.

Employers are responsible for ensuring that their employees have properly consented before enabling SMS for any employee in the Service.

10. Children's Privacy

SafeShift is intended for use by businesses and adults (18 years of age or older). We do not knowingly collect personal data from individuals under 16. If you believe a minor's data has been submitted, contact us at [email protected].

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notice or email to account holders. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

12. Contact Us

• General inquiries: [email protected]
• Mailing address: TBD

13. Account and Data Deletion

You may request deletion of your account and associated data at any time by emailing [email protected] with the subject line "Account Deletion Request" and include the email address associated with your account.

Upon receiving your request, we will:

• Delete your account login credentials and personal profile information
• Remove your name, email address, and phone number from our active systems
• Delete push notification tokens and SMS consent records
• Retain compliance records (break logs, violation records, signed documents) for the minimum legally required retention period (3–7 years depending on record type) as required by FLSA, California Labor Code, and other applicable law

Requests are processed within 30 days. Employer-side data entered by a business owner about their employees is controlled by that employer; employees should direct deletion requests to their employer, who can process them via the SafeShift manager portal.

Change History

• September 16, 2026 — Third-party services table now lists every connectable POS/HR provider (added Clover, Shift4, and PAR Brink alongside Square, Toast, SpotOn, Tray, and Gusto); aligned the integration-data disclosures in Sections 2 and 3 to the same list; added Better Stack (application logs) and Crisp (support chat) to the operational providers.
• August 13, 2026 — Expanded the AI disclosure to cover HR notice drafting alongside screenshot import; noted that data sent for AI processing is not used to train AI models.
• August 9, 2026 — Added disclosures for geofenced clock-in location capture, pay/tip/payroll data and retention, kiosk PINs and device tokens, break attestations and tip declarations, additional POS and HR integrations (Tray, SpotOn, Gusto), the managed payroll service (ADP), and linked employment profiles.
• June 13, 2026 — Prior version.

14. Related Documents

For the full terms governing your use of SafeShift, and our legal disclaimers, see: