1.Overview
This Privacy Policy explains what personal information ShiftPanda collects, why we collect it, who we share it with, and what you can ask us to do about it. It applies to the ShiftPanda web application and the marketing site.
It should be read together with our Terms and Conditions.
2.Who Controls Your Data
Two different relationships apply, and they matter for the rights you can exercise and with whom.
We Are the Controller
For account registration data, login and security logs, billing records, and support correspondence. Direct these requests to us.
Your Employer Is the Controller
For handover content, area and shift configuration, and role assignments. We process it on their instructions. Direct these requests to your organization’s Admin.
If you ask us for something we hold only as a processor, we will point you to your organization’s Admin rather than act unilaterally on their data.
3.What We Collect
Account Information
Email address, display name, hashed password, role, organization membership, timezone.
Handover Content
Everything your team enters: equipment status, open issues, safety notes, production notes, action items, comments, attachments, and the author and timestamp of each entry.
Billing Information
Subscription status, seat quantity, and Stripe customer and subscription identifiers. Card numbers go directly to Stripe and never reach our servers.
Technical Data
IP address, browser user-agent, request paths, timestamps, and error traces, kept in server logs for security and debugging. Cloudflare derives a country code from the request IP to choose the default language; ShiftPanda does not save that country code to your account.
We collect this information directly from you when you register, when your organization invites you, and as you use the service. We do not buy personal data from third parties or build profiles from outside sources.
4.What We Deliberately Do Not Do
- We do not sell, rent, or trade personal information.
- We do not use your handover content to train machine-learning models.
- We do not run advertising networks, analytics trackers, or third-party marketing pixels.
- We do not store full payment card numbers — Stripe handles those directly.
- We do not log passwords, session tokens, invitation tokens, payment secrets, or private attachment URLs.
5.Why We Use It
- To run the service — authenticate you, show your organization’s handovers, and attribute entries to their author.
- To send necessary email — invitations, password resets, and daily summaries your organization has enabled.
- To bill correctly — manage trials, subscriptions, and seat capacity.
- To keep the service secure — detect abuse, rate-limit authentication, and investigate incidents.
- To provide support — answer the questions you send us.
- To meet legal obligations — keep tax and accounting records and respond to lawful requests.
Where the GDPR or a similar law applies, our legal bases are performance of a contract (running the service and billing you), legitimate interests (security, abuse prevention, and support), and legal obligation (tax and accounting records). We do not rely on consent for any of the processing described here, so there is no consent for you to withdraw.
7.Who We Share It With
We share personal information only with the providers needed to run the service. Each is bound by contract to process data only on our instructions.
Stripe
Payment processing, subscriptions, and invoices
Data Shared: Billing contact, payment method, subscription and seat quantity
Resend
Transactional email delivery
Data Shared: Recipient email address and message content
Cloudflare
Content delivery, DNS, and network protection
Data Shared: IP address, country code used for default language selection, and request metadata
Our hosting provider
Server, database, and attachment hosting
Data Shared: All application data stored at rest
We may also disclose information when legally required, or as part of a merger or sale of assets — in which case we will notify you before your data becomes subject to a different privacy policy.
8.Where Data Is Stored
Application data lives in a PostgreSQL database on a private server. Attachments are stored in a private directory that is never served directly — every download is authorized by the application first. Traffic is proxied through Cloudflare and encrypted in transit.
Our providers may process data outside your country. Where required, transfers rely on Standard Contractual Clauses or an equivalent safeguard.
9.How Long We Keep It
- Handover content is kept for as long as your organization keeps its account — the record is the point of the product.
- Account records are deleted within 30 days of an organization being deleted.
- Server and security logs are kept for up to 90 days.
- Billing and tax records are kept for as long as accounting law requires, typically 7 years.
- Backups age out on their normal rotation after a deletion, rather than being edited individually.
Non-Payment Does Not Delete Anything
If a subscription lapses, the organization becomes read-only. Existing records stay readable and are not erased.
10.How We Protect It
- Passwords are hashed, never stored or transmitted in readable form.
- Sessions use Secure, HttpOnly cookies with CSRF protection and strict cross-origin rules.
- Every organization-owned query is scoped to your authenticated membership, so one organization cannot read another's data.
- Permissions are enforced on the server, not just hidden in the interface.
- Invitation links are opaque single-use tokens; we store only a hash of them.
- Attachment downloads are authorized individually and the storage directory is never publicly reachable.
11.Your Rights
Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to the processing of your personal data, and to lodge a complaint with your data protection authority.
To exercise a right, email privacy@getshiftpanda.com. We respond within 30 days and will not charge you or treat you differently for asking.
Requests About Workplace Records
Handover content belongs to your employer’s account. If you ask us to delete a handover you wrote, we will refer you to your organization’s Admin — we cannot remove their business records on an individual Crew Member’s instruction. Requests about your own account, login history, and support emails come to us directly.
12.Children
ShiftPanda is a workplace tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, write to privacy@getshiftpanda.com and we will delete it.
13.If Something Goes Wrong
If a data breach affects your personal information and is likely to create a risk to you, we will notify affected organization Admins and, where the law requires it, the relevant supervisory authority — without undue delay and within 72 hours of becoming aware where the GDPR applies. The notice will describe what happened, what data was involved, and what we are doing about it.
14.Changes to This Policy
We will update this policy as the product changes. Material changes are announced by email to organization Admins or in the application at least 14 days before they take effect. The “last updated” date at the top of this page always reflects the current version.
15.Contact
For privacy questions or to exercise a right, email privacy@getshiftpanda.com. For anything else, use support@getshiftpanda.com.