Privacy Policy
Last updated 1 August 2026
ShiftPilot helps a small business build its staff schedule and send it out over WhatsApp. Doing that means handling personal information about the people who work there. This page explains exactly what we hold, where it sits, who else can see it, and how to get it back or deleted.
Two kinds of people are described here. A manager signs up and runs a schedule. An employee is someone that manager adds to their team — employees do not create an account and do not install anything; they receive WhatsApp messages.
What we collect
| About | What | Why |
|---|---|---|
| Managers | Email address, password, business name, opening hours | To sign you in and know which business you run |
| Employees | Name, WhatsApp phone number, job roles, hourly wage, preferred language | To build the schedule, work out pay, and message the right person in a language they read |
| Work records | Shifts, time-off requests, shift swaps, invoices | This is the schedule itself — the product does not exist without it |
| Messages | WhatsApp messages sent to and from ShiftPilot | To understand requests like "can I swap Friday" and reply |
We do not collect payment card details, government identification, bank details, or location. ShiftPilot does not read your personal WhatsApp conversations — only messages sent to or from the ShiftPilot business number.
An employee did not sign up. Why do you have their number?
Their manager entered it, so the schedule can reach them. The business they work for decides what goes in and is responsible for having a reason to hold it. ShiftPilot stores and processes it on that business's behalf.
If you are an employee and want your details corrected or removed, ask your manager first — they can do it immediately in the app. You can also contact us directly using the details at the bottom.
Where it is stored
Your data lives in a database hosted in Montreal, Canada. We moved it there deliberately, so that Canadian businesses' staff records stay in Canada.
The software that reads and writes that database runs on servers in Virginia, United States. So while your data is stored in Canada, it passes through the United States each time the app is used, and is subject to US law while it is there. We are telling you this plainly because you cannot consent to something you were not told.
Who else can see it
We use a small number of outside services. Each one only receives what it needs:
| Service | What it receives | Where |
|---|---|---|
| Meta (WhatsApp) | Phone numbers and the content of messages we send and receive | Meta's own infrastructure |
| Supabase | The database — everything listed above | Montreal, Canada |
| Render | Runs the software; data passes through in use | Virginia, USA |
| Groq | The text of WhatsApp messages, to work out what was asked | USA |
| Sentry | Technical error reports when something breaks | Germany |
We do not sell personal information, and we do not share it for advertising.
How long we keep it
- While the business uses ShiftPilot: schedules, shifts and invoices are kept, because a business needs its own pay and hours records.
- When an employee is removed: their personal details are deleted. Past shifts may remain in the business's records without their contact details attached.
- When a business closes its account: everything belonging to it is deleted within 30 days of the request.
Your rights
Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and similar laws elsewhere, you can ask us to:
- tell you what we hold about you
- correct anything wrong
- delete it
- send you a copy
Write to the address below and we will reply within 30 days. If you are an employee, the fastest route is usually your manager, who can change or remove your details straight away.
Keeping it safe
Connections are encrypted. Passwords are stored hashed, never in readable form — we cannot see yours. Each business's data is walled off from every other business's, and incoming WhatsApp messages are checked to confirm they genuinely came from Meta before anything is acted on.
No system is perfectly secure. If a breach ever affects your information, we will tell the people affected and the relevant regulator, as the law requires.
Children
ShiftPilot is a tool for workplaces and is not intended for anyone under 16. If a young person is employed lawfully and added by their manager, their details are handled the same as any other employee's.
Changes
If this policy changes in a way that affects how your information is used, we will update the date at the top and notify account holders before it takes effect.
Contact
Questions, or a request about your data:
archayan123@gmail.com
ShiftPilot