Privacy Policy
Last updated 11 November 2026
This policy explains what personal information Shiftable collects, why, who sees it, and your rights. We follow South Africa's Protection of Personal Information Act (POPIA) and treat the same principles as our standard everywhere.
1. Who we are
Shiftable is operated by Destinos.dev, Cape Town, South Africa ("we", "us"). Contact: hello@shiftable.app.
2. Who is responsible for what
Each company that uses Shiftable decides which staff to add and what to record. For that staff information, the company is the "responsible party" and we are its "operator": we process it only to provide Shiftable to the company. For the people who register or contact us directly (managers, enquiries), we are the responsible party.
3. What we collect
| Information | Why |
|---|---|
| Name and email address | To create your account, sign you in with a one-time code, and send your roster and reminders. |
| Phone number and birthday, if your company adds them | To contact staff and, for birthdays, to show them to the team. |
| Shifts, swaps, time off and hours | To build and show the roster, process swaps and produce the hours report. |
| Notification settings and your device's push address | To send shift reminders to your phone or computer if you turn them on. |
| Company details, if you register a company | To set up and run your company's account, and to bill you when paid plans apply. |
| Basic technical logs (such as time of request and error details) | To keep Shiftable secure and fix faults. |
We do not ask for ID numbers, and we do not collect payment card details ourselves.
4. How we use it
Only to run Shiftable: sign you in, build and show rosters, send reminders and emails, produce reports your manager asks for, keep the service secure, answer your messages, and meet our legal duties. We do not sell personal information and we do not use it for advertising.
5. Who we share it with
Your information is visible within your own company only, to the people who need it (staff see the roster, managers see more). We use a small number of service providers to run Shiftable, each bound to protect your information:
- Supabase - database and sign-in.
- Cloudflare - hosting, delivery and security.
- Resend - sending emails such as sign-in codes and reminders.
- Browser and device push services (for example Apple, Google, Microsoft, Mozilla) - delivering notifications you have turned on.
- Google Fonts - the typeface used by the site; your browser asks Google for it.
- Paystack - when you pay for a plan, it handles card and payment details directly. We never see or store your card number.
We may also disclose information where the law requires it.
6. Where it is stored
Our providers may store and process information in other countries. Where that happens, we rely on providers that protect personal information to a standard comparable to POPIA.
7. How long we keep it
For as long as your company's account is active. When a staff member is removed, their personal details are removed or anonymised, though past shift and hours records may be kept for the company's payroll history. When a company closes its account, we delete its data within a reasonable time unless the law requires us to keep something.
8. Security
Connections are encrypted. There are no passwords to steal, because sign-in uses one-time email codes. Access to data is limited by role and company, and we limit who at Destinos.dev can see it. No system is perfectly secure, and if a breach affects you we will tell you and the Information Regulator as the law requires.
9. Your rights
You can ask us to tell you what we hold about you, correct it, or delete it, and you can object to how it is used. For staff information entered by a company, we may pass your request to that company. Email hello@shiftable.app from the address on your account. If you are unhappy with how we handle your information, you can complain to South Africa's Information Regulator at inforegulator.org.za.
10. Children
Shiftable is a workplace tool and is not meant for people under 18. We do not knowingly collect information from children.
11. Cookies
See our Cookie Policy.
12. Changes
If we change this policy in a meaningful way we will update the date above and, where it matters, tell you by email or in the app.
13. Contact
Questions about this policy: hello@shiftable.app.