Privacy Policy

Two different relationships run through this policy, and which one applies changes what we can do for you.

• Employee and workforce data. When a business signs up and adds its team, that business decides what to collect and why. It is the controller — a "business" under California law — and we act as its service provider, handling the data on its instructions to run the Service.
• Our own customer data. For the account itself — who signed up, billing, support conversations, and how the Service is used and secured — we decide the purposes, and we are the controller.

The practical consequence is in section 10: if your employer added you, most changes to your record are theirs to make, and we will point you to them rather than act behind them.

Nearly all of it is provided directly by you or by your employer. We do not buy personal information, and we do not collect it from data brokers, social networks, or advertising networks.

What we do not collect

We do not track individual users' locations — the only location in the Service is an approximate one for a business site, used to fetch a weather forecast. We do not collect government identifiers, payment card numbers, biometric data, health or medical information, precise geolocation, or racial, religious, political, or sexual-orientation data, and the Terms of Service prohibit entering them. We collect no sensitive personal information as California defines it, and we therefore have nothing to limit the use of.

We use personal information to:

• build, publish, and display schedules, and keep availability and time off consistent with them;
• route and record time-off, shift-swap, and shift-pool requests, and tell people the outcome;
• send the notifications a User has enabled, and the account, security, and billing messages the Service requires;
• estimate labour cost and individual pay from the rates and hours entered;
• produce the reports, printable schedules, and exports the Service offers;
• generate AI scheduling analysis when a Customer has enabled it, as described in section 5;
• process subscriptions, invoices, and seat counts;
• provide support and respond to what you ask us;
• secure the Service — authenticate users, enforce tenancy boundaries, rate-limit abuse, investigate incidents, and keep audit records; and
• fix defects, understand how features are used in aggregate, and improve the product.

We do not use personal information for advertising, profiling for marketing, or automated decisions that produce legal or similarly significant effects about a person. The AI feature in section 5 produces written suggestions for a manager to weigh; it decides nothing on its own.

Access inside the app is role-based, and enforced at the database level so one business can never read another's data.

• Employees see their own schedule, profile, pay rate and pay estimates, and their own requests.
• Colleagues at the same location can see each other as a work directory: name, role, profile photo, work phone number, email address, hire date, published shifts, approved time-off dates, and marked availability. Time off that is still waiting for a decision is between the employee and their managers. This is what makes swapping a shift and covering for each other possible without a manager relaying it. Pay rates are never visible to colleagues — only to the employee they belong to and to managers.
• Managers and Administrators see their team's schedules, profiles, contact details, availability, requests, and pay rates, because that is what running a schedule and a payroll requires. Their view is scoped to the locations they are responsible for.
• Anyone holding a calendar feed URL can read the published shifts of the User it belongs to, without signing in. The token is unguessable and can be regenerated, but the URL should be treated like a password.

If you would rather your colleagues not have your personal mobile number, give your employer a work number, or ask them to leave the phone field empty — notifications will fall back to email.

LazShift staff

Our staff do not access a Customer's data except to provide support that has been requested, to investigate a security or billing problem, or where the law requires it. The Service includes an administrative "view as" capability for that purpose; every use of it is recorded in an audit log, along with other privileged administrative actions.

Legal disclosure

We may disclose information if we are legally compelled to, to enforce our Terms, or to protect the rights, safety, or property of LazShift, our customers, or the public. Where we are permitted to notify the affected Customer first, we will. If LazShift is involved in a merger, acquisition, or sale of assets, data may transfer as part of it, subject to this policy; we will give notice before it becomes subject to a materially different one.

LazShift offers an optional AI scheduling assistant. It is switched off unless an Administrator enables it for a location, and it runs only when a manager asks for analysis after building a schedule.

When it runs, we send Anthropic the facts behind that run: employees' first names and last initials (enough for a manager to tell two people called Sarah apart, and no more), roles, employment types, hour minimums and caps, marked availability, stated shift and day preferences, dates of approved and pending time off, standing shifts, start and last-work dates, and the coverage figures our scheduler computed. We do not send pay rates, email addresses, phone numbers, or any other contact information.

Anthropic processes the request to return the analysis and does not use it to train its models. Neither do we. Turning the feature off stops the transfer entirely — the Service then shows the numbers-only summary its own scheduler produced.

We do not sell personal information, and we do not share it for cross-context behavioural advertising — as those terms are defined by the California Consumer Privacy Act and equivalent state laws. We have not done so in the preceding twelve months, including for anyone under 16.

We disclose personal information for business purposes only to the providers that run the Service for us, each under a contract limiting them to that purpose:

Browser push notifications are additionally relayed by the push service your browser maker operates — Apple, Google, or Mozilla — which receives an encrypted message addressed to your device's subscription.

Changes to this list

The table above is the complete list, and we keep it that way: it is part of this policy rather than a page maintained somewhere else, so it cannot quietly fall behind. Before a new provider begins processing personal information on our behalf, we will update this section and notify Administrators by email or in the app at least 30 days beforehand, so a Customer who objects has time to raise it with us or to stop using the Service before the change takes effect. Replacing a provider with another doing the same job counts as a new provider for this purpose.

LazShift runs no advertising or social-media trackers and sets no advertising cookies.

We do measure how our public pages are used, so we can see where people get stuck before they ever become customers. That covers the marketing site, the signup form, and the first-run setup wizard — and it stops there. Nothing inside the app is measured: not the schedule, not your team, not anyone's hours, availability, time off or pay.

The measuring is done by PostHog. It is configured to record which of those pages was opened and a handful of named steps — "someone reached step three of setup" — and nothing else. There is no automatic capture of clicks or of what you type into a form, and no session recording of any kind. It sets no cookies, the events are not tied to a name, an email address, or an account, and PostHog is set to discard the IP address a request comes from.

If your browser sends a Global Privacy Control or Do Not Track signal, we do not measure you at all: the signal is checked before anything runs, and the analytics code is never loaded.

The Service stores data in your browser for three purposes: keeping you signed in, remembering your own interface preferences such as light or dark mode and dismissed hints, and — on the public pages above — the anonymous identifier the measurement described here uses. Clearing it signs you out and resets those preferences. If you sign in with "This is a shared computer" ticked, the sign-in is kept only until the browser closes, and ends after 30 minutes without activity. The free staffing-forecast tool remembers the last place you looked up in your browser only; what you type into it is not sent to us.

We protect personal information with measures appropriate to its sensitivity, including:

• encryption in transit (TLS) and at rest;
• row-level security in the database, so every query is scoped to the requesting user's company and location — a tenancy boundary enforced by the database itself, not only by application code;
• role-based permissions, with pay rates readable only by the person they belong to and by managers, and never exposed to colleagues;
• privileged operations confined to server-side functions that verify the caller — including that a manager is responsible for the person they are acting on — with an audit log of administrative actions;
• two-step sign-in, with an authenticator app, required for LazShift staff accounts;
• an email to a person, at their previous address, when a manager changes their sign-in email or password after they have used their account;
• printable schedule PDFs kept as private files, reached by links that expire 30 days after they are sent;
• credentials stored hashed by our authentication provider, never in readable form; and
• rate limiting and input validation on endpoints exposed to the browser.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify affected Customers and, where required, regulators and individuals, without undue delay and within the timeframes the law sets. Report a suspected vulnerability or compromise to support@lazshift.com; our security page sets out what to expect when you do, and states plainly which assurances we do not yet have.

We keep personal information only as long as it serves the purpose it was collected for.

• Active accounts. Customer Data is retained while the account is active, so that schedule history, requests, and reports remain available to you.
• Deactivated employees. A deactivated record is retained, and stops counting toward billing, until an Administrator deletes it.
• Deleted employees. Deletion by an Administrator is permanent and removes the person's profile, schedule, availability, requests, and notifications.
• Read notifications. Purged automatically 60 days after they are read.
• Schedule PDFs. The file behind a publish email is kept until that schedule is sent again or the account is closed; the link in the email stops working after 30 days.
• Data exports. Built when an Administrator asks and handed straight to their browser. We do not keep a copy, only an audit record that the export happened.
• Closed accounts. Customer Data is retained for 30 days after termination so it can be exported or the account reinstated, then deleted in the ordinary course.
• Backups. Deleted data may persist in encrypted backups until those backups expire on their normal cycle.
• Billing and audit records. Invoices, payment records, and administrative audit entries are kept as long as tax, accounting, and security obligations require, typically several years, and are not deleted with the account.

If your employer put you in LazShift

Your employer controls your record, and we handle it on their instructions. Ask them first: most changes — correcting your name, phone number, hire date, or pay rate, adjusting availability, or removing your record — an Administrator can make immediately in the app, and you can edit much of your own profile and notification settings yourself. An Administrator can also download a copy of the account's data at any time. If you contact us directly with a request about employer-controlled data, we will refer you to them and let them know you asked, unless the law requires us to act ourselves.

Rights under California law

If you are a California resident, the CCPA as amended by the CPRA gives you the right to:

• know what personal information we have collected about you, the categories of sources, our purposes, and the categories of third parties it has been disclosed to;
• receive a copy of that information in a portable format;
• correct inaccurate personal information;
• delete personal information, subject to exceptions such as completing a transaction, security, and legal obligations;
• opt out of the sale or sharing of personal information — we do neither, so there is nothing to opt out of;
• limit the use of sensitive personal information — we collect none; and
• be free from discrimination for exercising any of these rights. We will not deny service, change prices, or reduce quality because you did.

These rights apply to employment-related information as well as to consumer information.

Rights under other state laws

Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as they take effect — have comparable rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising, sale, and profiling, none of which we do. If we decline a request, you may appeal by replying to our decision; if the appeal is denied, you may complain to your state attorney general.

How to exercise them

Email support@lazshift.com, telling us what you are asking for and the account or email address involved. We will verify your identity — usually by confirming control of the email address on the account, and asking for more only where the request is sensitive. We respond within 45 days, and may extend once by a further 45 days where the request is complex, telling you why. There is no charge unless a request is manifestly unfounded or excessive. An authorised agent may act for you with written permission we can verify.

LazShift is a workplace tool and is not directed to children. Whether someone is old enough to work, and on what terms, is for their employer under the law that applies to them, and a Customer that adds a minor is responsible for any consent that law requires. We handle a minor's information, including a date of birth used to apply limits on their hours, as Customer Data on the Customer's instructions, and we do not sell or share it. The Service is not directed to children under 13, and we do not knowingly collect personal information from them; if you believe a child under 13's information has been entered, contact us and we will delete it.

LazShift is operated from the United States, and personal information is stored and processed there. The Service is intended for businesses in the United States and is not offered to individuals in the European Economic Area, the United Kingdom, or Switzerland. If you use it from outside the United States, you understand that the information will be processed in the United States, where privacy law differs from your own.

We may update this policy as the Service changes. We will update the effective date above, and for material changes — a new category of information, a new purpose, or a new provider receiving personal information — we will notify Administrators by email or in the app before the change takes effect. Continued use afterwards is acceptance of the updated policy.

Questions about this policy, or a request about your personal information, go to support@lazshift.com. We will provide a mailing address for formal notices on request.