Your data, your rights.

Last updated: June 2025

OrcaShift is a workforce scheduling platform for businesses. This policy explains what personal data we collect, how we use it, and what rights you have over it. We are committed to handling your data responsibly and in compliance with applicable privacy laws including the GDPR.

1. Who We Are

OrcaShift (“we”, “us”, or “our”) is a software-as-a-service platform that provides shift scheduling, workforce management, and related tools to businesses and their employees.

If you have any questions about how we handle your data, contact us at the address listed at the bottom of this policy.

2. Data We Collect

We collect the following categories of personal data:

Identity & contact — first name, last name, email address, phone number

Identity documents — date of birth, country of birth, national ID number, passport number (provided optionally by you or your employer)

Emergency contacts — name and phone number of a nominated contact

Profile photo — an image you choose to upload

Work data — shift assignments, leave requests and approvals, schedule history, department and business unit membership

Billing data — subscription status and plan tier (payment card details are handled exclusively by Stripe and are never stored by us)

Device data — push notification tokens to deliver alerts to your device

Activity logs — an audit trail of key actions taken within your account for security and compliance

Usage data — app interactions needed to operate and improve the service

3. How We Use Your Data

We use your personal data to:

Create and maintain your account and profile

Display and manage shift schedules, leave requests, and workforce assignments

Send push notifications, email, and SMS alerts about your shifts and time-off (configurable in Settings)

Process subscription billing via Stripe on behalf of the business owner

Provide owners and managers with activity logs for security and operational oversight

Respond to support requests and investigate reported issues

Comply with legal obligations and enforce our Terms of Service

We do not sell your personal data, use it for advertising, or share it with third parties for their own marketing purposes.

4. Legal Basis for Processing (GDPR)

Where the GDPR applies, we process your data on the following legal bases:

Contract — processing necessary to provide the scheduling service you or your employer signed up for

Legitimate interests — security logging, fraud prevention, and service improvement

Consent — optional notifications (push, email, SMS) which you may withdraw at any time in Settings

Legal obligation — retaining records as required by law

5. Data Sharing & Third Parties

We share data with the following trusted sub-processors only to the extent needed to deliver the service:

Supabase — database hosting and authentication infrastructure (data stored in the EU)

Stripe — payment processing; Stripe receives billing details but we never store card information ourselves

Expo — delivery of push notifications to mobile devices

We may also disclose data if required by law, a court order, or to protect the rights and safety of OrcaShift, its users, or the public.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. When you delete your account, we permanently delete your profile data within 30 days, except where we are required to retain certain records by law (e.g. financial records related to billing).

Anonymised or aggregated data that cannot identify you may be retained indefinitely for analytics purposes.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you

Rectification — ask us to correct inaccurate data (most personal details can be updated directly in Settings)

Erasure — request deletion of your personal data (“right to be forgotten”)

Portability — receive your data in a machine-readable format

Restriction — ask us to restrict processing in certain circumstances

Objection — object to processing based on legitimate interests

Withdraw consent — opt out of non-essential notifications at any time in Settings → Notifications

To exercise any of these rights, contact us using the details below. We will respond within 30 days.

8. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These include encrypted data transmission (TLS), access controls, and row-level security in our database.

No system is completely secure. If you believe your account has been compromised, change your password immediately and contact us.

9. Children's Privacy

OrcaShift is a business tool intended for use by adults in a professional workplace context. We do not knowingly collect personal data from anyone under the age of 16. If you believe a minor has registered, please contact us and we will remove their data promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will notify you via the app or by email. Your continued use of OrcaShift after the effective date constitutes your acceptance of the updated policy.

Questions about this policy? privacy@orcashift.com

OrcaShift

Workforce scheduling platform·Terms of Service