Privacy Policy

ShiftServer (“Service”) is a workforce scheduling platform operated by Concept One Solutions, LLC (“we,” “us,” or “our”), a Florida limited liability company. This Privacy Policy explains how we collect, use, and protect your information when you use ShiftServer.

Privacy at a Glance

A plain-language summary of the full policy below, in the same format Apple uses for App Store privacy labels:

Data linked to you

• Contact info — name, email address, mobile phone number
• Employment info — job title, department, work schedule, timecard records (provided by your employer)
• Sensitive employment data — where your employer uses those features: pay rates and tax identifiers, stored encrypted (AES-256-GCM)
• Location — GPS coordinates at clock-in/out, only if your employer enables geofenced time clocking, and only at the moment you punch
• Usage data — pages visited and actions taken in the app, tied to your account for product analytics and support
• Diagnostics — crash and error reports

Data used to track you

None. We do not use your data to track you across apps or websites owned by other companies, we do not sell or share personal data for advertising, and we use no advertising networks.

1. Information We Collect

Account and profile information

When you register for or use ShiftServer, we collect information you provide directly, including your name, email address, mobile phone number, employment information, and any other information you choose to submit.

Usage data, analytics, and diagnostics

We automatically collect information about how you access and use the Service, including device type, browser type, IP address, pages visited, and actions taken within the application. We use PostHog for first-party product analytics (which features are used, where users get stuck) and Sentry for crash and error reporting. Analytics data is used only to operate and improve ShiftServer — never for advertising. Session recording/replay is disabled.

Employee data

If your employer uses ShiftServer to manage scheduling, your employer (as a tenant of the Service) may provide us with employment-related information such as your job title, department, work schedule, and timecard records. This information is processed on behalf of your employer.

2. SMS / Text Message Program

ShiftServer operates an SMS notification program to deliver workforce-related alerts to opted-in employees and managers. These messages include shift assignment notifications, schedule publication alerts, time-off request decisions, shift swap updates, and shift reminders.

Opt-in: You consent to receive SMS messages by providing your mobile phone number during account registration and checking the SMS consent checkbox in the registration form, or by texting START to a ShiftServer phone number.

Message frequency: Message frequency varies based on your work schedule and the actions of your employer. You may receive up to several messages per week.

Message and data rates may apply. Standard message and data rates charged by your mobile carrier may apply to messages you send and receive.

Opt-out: You may opt out of SMS messages at any time by replying STOP to any ShiftServer text message. After opting out, you will receive one confirmation message and no further messages will be sent.

Help: Reply HELP to any ShiftServer text message for assistance, or contact us at josevargas@conceptonesolutions.com.

Mobile number non-sharing policy: We do not sell, rent, share, or otherwise disclose your mobile phone number to third parties for their own marketing purposes. Your mobile phone number is used solely to deliver ShiftServer notifications on behalf of your employer and for account-related communications. We may share your phone number with our SMS delivery provider (Twilio, Inc.) solely for the purpose of transmitting messages you have requested; Twilio's privacy policy governs their handling of that data.

3. How We Use Your Information

• To operate, maintain, and improve the ShiftServer platform
• To deliver shift schedules, time-off decisions, and other workforce communications on behalf of your employer
• To send SMS notifications you have opted in to receive
• To authenticate your identity and maintain account security
• To respond to your support requests
• To comply with legal obligations

4. Information Sharing

We do not sell your personal information. We share information only in the following circumstances:

• Your employer: Employment and scheduling data is shared with the employer company that invited you to ShiftServer. Your employer controls and is responsible for that data.
• Service providers: We use sub-processors to operate the Service. These providers process data only as directed by us and under confidentiality obligations. The complete current list is below.
• Legal requirements: We may disclose information if required by law, regulation, court order, or to protect the safety or rights of ShiftServer, its users, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

Sub-processors

The following providers process data on our behalf to run ShiftServer. We will update this list when providers change.

• Supabase, Inc. — database, authentication, and file storage (all application data)
• Vercel, Inc. — application hosting and content delivery (request logs, IP addresses)
• Stripe, Inc. — subscription billing and payment processing (billing contact and payment details; we never store card numbers)
• Twilio, Inc. — SMS delivery for opted-in notifications (mobile phone numbers, message content)
• Resend, Inc. — transactional email delivery (email addresses, message content)
• Functional Software, Inc. (Sentry) — error and crash monitoring (diagnostic data, IP addresses)
• PostHog, Inc. — first-party product analytics (usage events tied to your account; no advertising use)
• Upstash, Inc. — rate limiting and caching infrastructure (request metadata)

Address lookup in scheduling settings queries geocoding services (Mapbox and OpenStreetMap/Photon) with the address text a manager types; no account data is sent with those requests.

5. Cookies

ShiftServer uses only strictly necessary cookies required for the service to function. No advertising or cross-site tracking cookies are used. Our product analytics (PostHog) stores its identifiers in your browser's local storage rather than cookies, is first-party only, and is never used for advertising.

Cookies set by ShiftServer

• sb-<project-ref>-auth-token — Supabase authentication session token. HttpOnly, Secure, SameSite=Lax. Duration: session / refresh-token lifetime.
• sb-<project-ref>-auth-token-code-verifier — PKCE code verifier used during the OAuth 2.0 authorization flow. HttpOnly. Short-lived; deleted after login completes.
• ss-imp — Operator impersonation token (Platform Operators only). Signed HMAC, HttpOnly, Secure, SameSite=Lax. 1-hour TTL. Only set when a Concept One staff member activates an impersonation session for support purposes.

All cookies above are essential to authentication and cannot be disabled without preventing login. No third-party cookies are set by ShiftServer itself; any third-party cookies you observe originate from browser extensions or external links.

Browser local storage

In addition to the cookies above, ShiftServer stores analytics identifiers (PostHog) and interface preferences in your browser's local storage. These stay on your device, are scoped to ShiftServer only, and are not shared with advertisers.

6. Automated Processing and AI

ShiftServer does not currently use artificial intelligence or machine learning to make decisions about you. Schedules, time-off approvals, shift assignments, and timecard edits are made by your employer's managers — not by automated systems. Rule-based automations (for example, overtime alerts, shift reminders, and geofence checks against your scheduled location) run on criteria your employer configures, and their results are always visible to and reviewable by a human manager.

If we introduce AI-assisted features in the future (such as schedule suggestions), we will disclose them in this policy and label them in the product before they launch, and no AI feature will make employment decisions about you without human review.

7. Data Security

We implement industry-standard security measures including AES-256-GCM encryption of sensitive employee data (Social Security numbers and pay rates), row-level security on all database tables, multi-factor authentication support, and HTTPS encryption in transit. No method of electronic transmission or storage is 100% secure; we cannot guarantee absolute security.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Employers may request deletion of their company's data upon account termination. We retain certain information as required by law or for legitimate business purposes.

9. Your Rights

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal information. To exercise these rights, contact us at josevargas@conceptonesolutions.com. Employees should direct requests to their employer in the first instance, as employers control their company's data within ShiftServer.

10. Children's Privacy

The ShiftServer platform is intended for use by adults in an employment context. We do not knowingly collect personal information from individuals under the age of 16.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy with a revised effective date. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

12. Contact Us

Concept One Solutions, LLC
Pensacola, Florida
Email: josevargas@conceptonesolutions.com