Privacy policy

Shiftpoint is provided by MCH DYNAMIC SOLUTIONS SRL. Shiftpoint is used by employers to record attendance at their workplaces. Your employer decides how attendance records are used in your workplace; for questions about your own work records, contact your employer.

Support and privacy inquiries: contact@shiftpoint.app

• Account: name, email, and your password (stored hashed by our sign-in provider), or Google or Apple sign-in. With Apple, we receive an Apple account identifier and the email you choose to share (which may be an Apple private relay address); Apple may share your name only on first sign-in. The current app has no phone-number entry form; a legacy phone field may hold a value supplied through the sign-in service.
• Work records: company, role, staff code, assigned workplaces, schedules, check-in/out times, breaks, time away, late/early/overtime minutes and approval status.
• Location: repeated GPS verification samples while tracking is enabled, not only check-in/out. Events include position, accuracy, distance to the workplace, device/server time, source and flags for poor accuracy, suspected fake location or impossible movement. With permission, the installed phone app may send samples in the background.
• Phone: a random device ID, device type label, permission states and last-seen time.
• Correction requests you send, your data-protection consent (date and version), and alerts shown to your employer's staff.
• Billing (company admins who subscribe): customer and subscription references. Card details are handled by Stripe, not stored by Shiftpoint.
• On your device: sign-in session, language, "keep me signed in" choice, cookie acceptance and device ID.

We do not use advertising trackers or third-party analytics. Our hosting provider's built-in site analytics records aggregate visit statistics (page views, visit duration, referring source, country and device type). According to the provider, it sets no cookies, stores nothing in your browser, uses a random per-visit identifier discarded when the visit ends, and does not link visits to your account. Reports cover up to the last 90 days; the provider has not stated an exact retention period.

Operational request and error logs may include IP addresses, request paths, timestamps, error messages and stack traces. Hosting/sign-in services process these diagnostics; the editor preview also receives runtime error reports. These are for operation and debugging, not advertising. Exact provider log and backup retention has not been verified, and deleting your account does not promise immediate erasure from those systems.

To sign you in, confirm presence at approved workplaces, calculate worked time, show attendance to your employer's staff, handle corrections, and bill subscribing companies. Your employer cannot see your location away from its workplaces through Shiftpoint's screens.

• Lovable Cloud — hosting, database and sign-in.
• Stripe — subscription payments.
• Google — only if you choose "Sign in with Google".
• Apple — only if you choose "Sign in with Apple".

Data is kept while your account exists, until you delete it or your employer removes it. Employers can set a retention period in their settings, but automatic scheduled deletion based on that setting is not currently implemented.

Pseudonymized work history has no automatic expiry in the app. Failed account deletion keeps a private retry record (old account ID and a hashed recovery secret, with no link to archived work history) until removal succeeds; there is no scheduled retry or cleanup job. Canceled subscription references are removed from the app on deletion, but Stripe keeps its own customer/payment records under its policies; this flow does not delete Stripe customers.

You can delete your account yourself in the app. Your login, sessions, roles, phones, schedules, assignments, consent records, correction requests, alerts and all precise GPS points are removed. Your employer keeps only work dates, times, hours totals and workplace under a new random "Former employee" ID without your name, email, phone or staff code. These remaining records are pseudonymized, not guaranteed anonymous.

How to delete your account

Under the GDPR you may ask for access, correction, deletion, restriction, portability or object to processing, and complain to your data-protection authority. Contact contact@shiftpoint.app or your employer.