We collect several types of information to provide and improve our service:

1.1 Information You Provide Directly

• Account Information: When you create an account, we collect your name, email address, phone number, business name, and password.
• Business Information: Business name, address, operating hours, timezone preferences, and business settings.
• Employee Information: Names, positions, hourly rates, contact information, role assignments, and employee PINs for time clock access.
• Schedule Data: Shift schedules, time-off requests, shift swap requests, availability preferences, and blocked dates.
• Time Clock Data: Clock-in/out times, break times, location data (if using geolocation features), and time record overrides.
• Payroll Information: Hours worked, overtime calculations, pay rates, and timesheet data (we do not process actual payments).
• Communications: When you contact support, we collect the contents of your messages, email address, and any attachments you provide.

1.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on the platform, actions taken (e.g., shift creation, employee additions).
• Device Information: IP address, browser type and version, device type, operating system, unique device identifiers.
• Log Data: Access times, error logs, and system performance data for troubleshooting and service improvement.
• Cookies and Tracking: We use cookies and similar technologies to maintain your session, remember your preferences, and analyze platform usage (see Section 8).

1.3 Payment Information

Payment information (credit card numbers, billing addresses) is processed directly by our third-party payment processors. We do not store full payment card details on our servers. We only retain the last 4 digits of your card and expiration date for billing reference purposes.

We use the information we collect for the following purposes:

2.1 To Provide and Maintain Our Service

• Create and manage your account
• Deliver scheduling, time tracking, and payroll calculation features
• Process shift assignments, time-off requests, and shift swaps
• Generate schedules using AI algorithms
• Calculate hours worked, overtime, and payroll estimates
• Send notifications about schedule changes and requests

2.2 To Improve and Optimize Our Service

• Analyze usage patterns to improve features and user experience
• Develop new features based on user needs
• Fix bugs and technical issues
• Optimize AI scheduling algorithms for Trinidad & Tobago businesses
• Conduct internal research and development

2.3 To Communicate With You

• Send service-related emails (e.g., password resets, account changes)
• Respond to your support requests and inquiries
• Send important updates about our Terms or Privacy Policy
• Notify you about new features or service improvements (you can opt out)

2.4 For Security and Legal Compliance

• Detect, prevent, and investigate fraud and abuse
• Enforce our Terms of Service and other policies
• Comply with legal obligations and respond to legal requests
• Protect the rights, property, and safety of ShiftSync TT, our users, and the public

We share information in the following limited circumstances:

3.1 Service Providers

We share data with trusted third-party service providers who help us operate our platform:

• Cloud Hosting: Supabase (for database and authentication services)
• Email Services: Resend (for sending transactional emails)
• Payment Processing: Stripe or other payment processors (for subscription billing)
• Analytics: Web analytics tools to understand platform usage

All service providers are bound by strict confidentiality obligations and are only permitted to use your data to perform services on our behalf.

3.2 Within Your Business

Employee data is shared with authorized users within your business based on their role permissions:

• Business owners and managers can access all employee information
• Employees can view their own schedules, time records, and personal information
• Role-based access controls limit what each user can see and do

3.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities, including:

• Compliance with legal obligations (e.g., court orders, subpoenas)
• Protection of our legal rights and property
• Investigation of potential violations of our Terms of Service
• Protection of the safety of our users or the public

3.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our platform before your information becomes subject to a different privacy policy.

We take data security seriously and implement industry-standard measures to protect your information:

Security Measures:

• Encryption: All data is encrypted in transit (HTTPS/TLS) and at rest
• Authentication: Secure password hashing and session management
• Access Controls: Role-based permissions limit data access
• Regular Audits: Periodic security reviews and vulnerability assessments
• Employee PINs: 6-digit PINs for time clock access are hashed and never stored in plain text
• Infrastructure Security: Hosted on secure, SOC 2 compliant cloud infrastructure

We retain your information for as long as necessary to provide our services and comply with legal obligations:

Retention Periods:

• Active Accounts: We retain your data for the duration of your active subscription
• Canceled Accounts: After cancellation, we retain your data for 90 days to allow for reactivation
• Backup Retention: Backup copies may be retained for up to 180 days for disaster recovery purposes
• Legal Requirements: We may retain data longer if required by Trinidad & Tobago law (e.g., employment records, payroll data)
• Aggregated Data: We may retain anonymized, aggregated data indefinitely for analytics and research

For more details on data retention, please see Section 4 of our Terms of Service.

You have the following rights regarding your personal information:

How to Exercise Your Rights:

To exercise any of these rights, please contact us at support@shiftsynctt.com with your request. We will respond within 30 days. You may also have the right to lodge a complaint with the Trinidad & Tobago data protection authority.

We use cookies and similar tracking technologies to improve your experience and analyze platform usage.

What Are Cookies?

Cookies are small text files stored on your device that help us recognize you and remember your preferences. We use both session cookies (deleted when you close your browser) and persistent cookies (stored until expiration or deletion).

Types of Cookies We Use:

• Essential Cookies: Required for authentication, security, and basic platform functionality. These cannot be disabled.
• Functional Cookies: Remember your preferences (e.g., timezone, language) to enhance your experience.
• Analytics Cookies: Help us understand how users interact with our platform so we can improve it.
• Performance Cookies: Measure platform speed and performance to optimize loading times.

Managing Cookies:

Most browsers allow you to control cookies through their settings. You can choose to block or delete cookies, but this may affect platform functionality. To learn more about cookies and how to manage them, visit www.allaboutcookies.org.

Our platform integrates with third-party services to provide certain features. These services have their own privacy policies:

Third-Party Services We Use:

• Supabase: Cloud database and authentication services. View their privacy policy at supabase.com/privacy
• Resend: Transactional email service. View their privacy policy at resend.com/legal/privacy-policy
• Payment Processors: Stripe or other payment services for subscription billing (we do not store full payment card details)

We carefully vet all third-party services for security and privacy compliance. However, we are not responsible for the privacy practices of third-party services. We encourage you to review their privacy policies.

Links to External Websites:

Our platform may contain links to external websites (e.g., help documentation, social media). We are not responsible for the privacy practices of external sites. We encourage you to read their privacy policies before providing personal information.

ShiftSync TT is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13.

Our service is designed for business owners, managers, and employees who are at least 18 years old (or the legal working age in Trinidad & Tobago). By using our service, you represent that you are at least 18 years old.

If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information as soon as possible. If you believe we have collected information from a child under 13, please contact us immediately at support@shiftsynctt.com.

ShiftSync TT operates primarily in Trinidad & Tobago. However, some of our third-party service providers (e.g., cloud hosting, email services) may store or process data in other countries.

When data is transferred internationally, we ensure that appropriate safeguards are in place to protect your information, including:

• Contractual protections with service providers
• Compliance with data protection frameworks and standards
• Encryption during transfer and storage

By using our service, you consent to the transfer of your information to countries outside Trinidad & Tobago where our service providers are located, subject to the protections described in this Privacy Policy.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

How We Notify You:

• We will update the "Last Updated" date at the top of this page
• For material changes, we will notify you via email or through a prominent notice on our platform
• We will provide at least 30 days' notice before material changes take effect

Your continued use of ShiftSync TT after the effective date of the revised Privacy Policy constitutes your acceptance of the changes. If you do not agree with the changes, you should discontinue use of the service and contact us to delete your account.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

As a Trinidad & Tobago-based company, we comply with the Data Protection Act of Trinidad & Tobago (Act No. 13 of 2011) and related regulations.

Data Controller Information:

• Data Controller: ShiftSync Services [COMPANY REGISTRATION NUMBER]
• Registered Address: 88 Glen Rd, 900412, Scarborough, Tobago, Trinidad & Tobago
• Contact Email: support@shiftsynctt.com

Your Rights Under Trinidad & Tobago Law:

In addition to the rights described in Section 6, Trinidad & Tobago residents have the right to:

• Know what personal data we collect and how we use it
• Access copies of your personal data
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Object to processing of your data for direct marketing
• Lodge a complaint with the Trinidad & Tobago data protection authority

Employment Data:

We recognize that employment data (schedules, time records, payroll information) is subject to specific legal requirements in Trinidad & Tobago. We retain employment-related data for the periods required by Trinidad & Tobago employment and tax laws.