ShiftTrek Privacy Policy

Last Updated & Effective Date: September 18, 2026

Welcome to ShiftTrek ("we", "our", or "us"). ShiftTrek provides enterprise workforce management, employee scheduling, time clock kiosk systems, and desktop activity tracking software designed to streamline employee scheduling, break compliance, attendance recording, and payroll calculations.

This Privacy Policy explains how ShiftTrek collects, uses, protects, and discloses personal information when you access or use our platform, including:

The ShiftTrek web application and administrative dashboards at https://shifttrek.com
The ShiftTrek Kiosk application for Android tablets and wall-mounted devices
The ShiftTrek Mobile App for iOS and Android
The ShiftTrek Desk workstation application for Windows, macOS, and Linux
Related APIs, notifications, and customer support services

Please read this Privacy Policy carefully. By accessing or using ShiftTrek, you acknowledge that you have read and understood this Privacy Policy. If you are an employee using ShiftTrek through your employer, your employer is the Data Controller of your workplace records, and ShiftTrek acts as the Data Processor / Service Provider.

1. Information We Collect

We collect information necessary to deliver accurate time tracking, ensure wage-and-hour legal compliance, prevent time theft and identity fraud, and provide enterprise workforce analytics.

A. Account and Profile Information

Personal Identifiers: Full name, business or personal email address, phone number, physical address, and emergency contact details.
Employment Attributes: Job role, department, branch/location assignment, employee identification number, assigned schedules, hourly pay rate or salary designation, and manager/supervisor relationships.
Authentication Credentials: Password hash, 6-digit security PIN for kiosk entry, session tokens, and OAuth identifiers (such as Google Sign-In profile IDs).

B. Time, Attendance, and Break Records

Punch Data: Exact timestamps of clock-in, clock-out, paid rest break start/end, unpaid meal break start/end, and shift transfers.
Shift & Leave Management: Scheduled shift assignments, availability preferences, time-off requests, and shift cover/swap marketplace transactions.
Payroll Auditing: Overtime calculations, holiday offsets, grace period tolerances, and supervisor shift adjustments or merge notes.

C. Biometric & Camera Photo Verification (ShiftTrek Kiosk)

Facial Verification Photos: When using the ShiftTrek Kiosk terminal, the front camera captures a still image at the moment of clock-in, clock-out, or break transition to verify that the individual punching in matches the employee PIN.
No Unsolicited Recording: Cameras are activated strictly on-demand during the punch action. ShiftTrek Kiosk does not conduct continuous video recording, live audio surveillance, or persistent passive background capture.
Access Control: Facial capture images are securely stored in encrypted cloud storage and are accessible exclusively to authorized company administrators and supervisors for punch dispute resolution. They are never sold, rented, or utilized for commercial facial recognition advertising.

D. Desktop Workstation Transparency & Monitoring (ShiftTrek Desk)

For desk-based workers assigned roles requiring desktop verification, the ShiftTrek Desk workstation client collects:

Active Window & Process Inspection: The title of the foreground active window and executable process name (e.g., code.exe, excel.exe) sampled at scheduled intervals to determine productivity or flag non-work distractions.
Periodic Panoramic Screenshots: Screen captures taken at randomized intervals (or escalated intervals when blacklisted applications are active). Captures are automatically suspended during paid and unpaid breaks.
Activity Velocity Indicators: Aggregate keyboard and mouse movement indicators used strictly to evaluate idle time. ShiftTrek does not log raw keystrokes, passwords, private chats, or form inputs (no keylogging).
Hardware Integrity & Single-Session Concurrency: MachineGuid, local hostname, operating system version, hardware integrity hash, and virtual machine detection to enforce single-workstation concurrency and prevent automated clock-in spoofing.

E. Network and Location Data

Office Wi-Fi & Network Geofencing: Local network subnets and public IP addresses are collected to verify whether attendance punches originate from authorized workplace facilities.
Mobile Punch GPS: When specifically enabled by an employer's company policy for mobile clock-in, coarse or precise geographic coordinates are collected strictly at the moment of the punch. Continuous background location tracking is never performed.

2. How We Use Your Information

We process personal data for legitimate business purposes and statutory labor compliance:

Accurate Payroll & Wage Calculation: Recording hours worked, paid rest breaks, and unpaid meal breaks to comply with the Fair Labor Standards Act (FLSA), state wage-and-hour regulations, and international labor standards.
Identity Verification & Anti-Fraud: Verifying punch authenticity at kiosk stations to prevent buddy punching and unauthorized shift tampering.
Scheduling & Roster Optimization: Generating shift schedules, administering availability preferences, and processing peer shift swaps and time-off requests.
Workplace Transparency & Notification: Providing immediate desktop and mobile alerts for shift milestones, break expirations, idle checks, and company policy modifications.
System Security & Integrity: Protecting accounts against brute-force attacks, enforcing single-session workstation limits, detecting virtual machine automation, and securing API endpoints.

3. Data Sharing and Third-Party Disclosures

ShiftTrek does NOT sell, rent, or lease your personal information to data brokers, advertisers, or third-party marketers.

We share data only in the following limited circumstances:

With Your Employer: Authorized administrators, managers, and HR personnel have access to attendance records, time cards, shift reports, and audit photos for employees within their branch or organization.
Trusted Subprocessors: We partner with industry-leading infrastructure providers under strict data protection agreements:
- Cloud hosting, database, and object storage providers (e.g., DigitalOcean, Amazon Web Services) with data encryption at rest.
- Real-time websocket notification services (e.g., Laravel Reverb, Pusher) for instant attendance synchronization.
- Transactional email dispatchers (e.g., Amazon SES, Postmark) for password resets, shift alerts, and schedule changes.
Legal Compliance: When required by subpoena, court order, or applicable law, or to defend ShiftTrek's legal rights against fraud or wage claims.
Business Transfers: In the event of a merger, acquisition, or asset sale, user data may be transferred as a business asset subject to this Privacy Policy.

4. Data Retention and Security

A. Data Security

Encryption in Transit: All communications across web, mobile, kiosk, and desktop clients are encrypted using TLS 1.3 / HTTPS.
Encryption at Rest: Passwords, tokens, database backups, and media files (photos, screenshots) are stored using AES-256 encryption.
Role-Based Access Control: Strict organizational boundaries ensure that company administrators can only access records belonging to their respective company tenant.

B. Retention Periods

Attendance & Payroll Records: Retained for the statutory duration mandated by applicable labor laws (e.g., at least 3 years under US Fair Labor Standards Act § 211(c)).
Verification Photos & Screenshots: Retained according to the retention window configured by your employer's account administrator (typically 30 to 90 days), after which media files are permanently purged.

5. Account and Data Deletion Policy (Google Play Mandate)

ShiftTrek respects your right to control your personal data. In full compliance with Google Play Store User Data policies and global privacy regulations:

How to Request Account & Data Deletion

In-App Self-Service (Admins & Direct Account Holders):
- Log in to your ShiftTrek web account.
- Navigate to Settings → Security → Account Management.
- Click Delete Account and confirm your password.
Employees / Supervised Staff:
- Because your employer is the primary Data Controller of employment attendance records, you may request your employer's administrator to archive and delete your employee profile.
Direct Privacy Request via Email:
- You or your employer may email our Data Protection Team at privacy@shifttrek.com or support@shifttrek.com with the subject line "Data Deletion Request".
- Include your full name, email address, and company name.
- We will verify your identity, coordinate with the account controller, and process the permanent deletion of your account, authentication credentials, biometric punch photos, and personal profile data within 30 business days.
- Note: Certain non-identifying historical payroll records may be retained in anonymized or immutable form solely to satisfy statutory tax and labor record-keeping obligations.

6. Regional Compliance and Employee Rights

A. European Union & United Kingdom (GDPR / UK GDPR)

If you reside in the EEA or UK, you have the following rights:

Right of Access (Article 15)
Right to Rectification (Article 16)
Right to Erasure / Right to be Forgotten (Article 17)
Right to Restriction of Processing (Article 18)
Right to Data Portability (Article 20)
Right to Object (Article 21)

To exercise these rights, contact privacy@shifttrek.com.

B. California Residents (CCPA / CPRA)

California employees and consumers have the right to:

Know what personal information is collected, disclosed, or retained.
Request deletion of personal information.
Non-discrimination for exercising privacy rights.
ShiftTrek does not sell or share personal information for cross-context behavioral advertising.

C. Electronic Workplace Monitoring Disclosures

New York Civil Rights Law § 52-c: ShiftTrek provides prior written disclosure and transparent indicators on desktop workstations regarding computer and network monitoring.
Ontario Employment Standards Act (ESA): Employers utilizing ShiftTrek to track electronic work hours must maintain an electronic monitoring policy detailing when, how, and why monitoring is conducted.

7. Children's Privacy

ShiftTrek is a business workforce management solution designed exclusively for commercial workplace operations and adult employees. We do not knowingly collect or solicit personal data from children under the age of 16. If we learn that we have inadvertently collected information from a child under 16, we will immediately delete that information.

8. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect modifications in our software, legal obligations, or industry best practices. When changes occur, we will update the "Last Updated" date at the top of this document. Material changes will be communicated via in-app notification, email, or a prominent notice on our website prior to taking effect.

9. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: privacy@shifttrek.com or support@shifttrek.com
Website: https://shifttrek.com
Contact Form: https://shifttrek.com/contact-us