Privacy Policy — ShiftGo FLEX

1. Service Identity

• Service name: ShiftGo FLEX
• Website: shiftgo.site
• Operator: Sebastian Gruza, GruzaLab Software
• Contact: [email protected]

2. Nature of the FREE Service

ShiftGo FLEX is a free, browser-based shift schedule generator. In its FREE tier:

• No user accounts are required.
• No permanent database stores your data.
• All schedule data is ephemeral — stored temporarily on the server with a 72-hour TTL (time to live), after which it is automatically deleted.
• Schedule configuration is kept in your browser's localStorage for convenience between sessions.

3. Types of Data Processed

When you use ShiftGo FLEX, you may enter:

• Worker names (or initials/codes like A, B, C)
• Shift assignments (Morning, Evening, Night, OFF)
• Availability and constraints (days off, preferred shifts)
• Schedule period (year, month, duration)

These may constitute personal data under GDPR if real employee names are used.

4. Data Controller vs. Data Processor

• You (the Manager/User) are the data controller for any employee data you enter into ShiftGo. You decide what data to input and how the generated schedule is used and shared.
• ShiftGo acts as a data processor — we process the data you provide solely to generate the schedule you requested. We do not use this data for any other purpose.

5. Data Storage Layers

No data is written to a permanent database in the FREE tier.

6. Share Links

When you generate a share link (for WhatsApp, email, etc.):

• The link provides public, unauthenticated access to the schedule.
• Share links are not indexed by search engines.
• Links expire automatically after 72 hours.
• You are responsible for deciding who receives the link and what data the schedule contains.
• We recommend using worker codes (A, B, C) instead of full names when sharing.

7. Security Measures

• All traffic is encrypted via HTTPS/TLS.
• Server data is subject to 72-hour TTL — automatic deletion, no archival.
• We do not sell, share, or transfer your schedule data to any third party.
• We do not use your data for analytics, advertising, or AI training.
• No permanent copies of schedule data are retained after TTL expiry.

8. Technical Logs

For security and operational purposes, our servers may log:

• IP address
• User-Agent (browser type)
• Timestamp of requests
• HTTP request path (e.g., /api/compute)

These logs are used exclusively for security monitoring and debugging. They do not contain schedule data and are rotated/deleted regularly.

9. Cookies

ShiftGo uses only technical cookies necessary for the service to function:

• Session cookie (Flask session) — required for form handling (e.g., contact form CSRF protection).
• Locale cookie — remembers your language preference.

We do not use:

• Marketing or advertising cookies
• Third-party tracking cookies

Note: We use Google Analytics and Microsoft Clarity for anonymous usage statistics. These services may set their own cookies. You can opt out using browser extensions or privacy settings.

10. Your Rights Under GDPR

As a user of the FREE tier, you have the following rights:

• Right of access — You can view all your data in your browser's localStorage at any time.
• Right to erasure — Clear your browser data, or simply wait 72 hours for server-side data to auto-delete. You can also click "Reset" in the app.
• Right to restriction — You control what data you enter. Use codes instead of real names to minimize personal data.
• Right to data portability — Export your schedule as PDF or JSON at any time.
• Right to object — Stop using the service at any time. No account deletion needed because no account exists.

Because the FREE tier has no accounts and auto-deletes data within 72 hours, most GDPR rights are satisfied automatically by design.

11. Contact

For any privacy-related questions or requests:

• Email: [email protected]
• Website: shiftgo.site/contact