Privacy Policy
This Privacy Policy explains how Digital Alley AB (org. no. 559259-2504, Kalkstensvägen 42, 216 31 Limhamn, Sweden — “we,” “us”) collects, uses, and protects personal data through ShiftScout (the “Service”).
In short: if you use ShiftScout as a manager, we’re the data controller for your own account and billing data, and a data processor acting on your instructions for the data of the employees you invite. If you use ShiftScout as an employee, your employer (the organization that invited you) is the controller of your scheduling data, and we process it on their behalf — for questions about your data, start with them, though you can always contact us too.
1. Data we collect
Account & profile data
- Name, email address, and phone number;
- Password (stored as a salted hash, never in plain text) — not applicable if you sign in with Google;
- Employee code/number and qualifications, if your organization uses them;
- Your role (manager or employee) and which organization you belong to.
Scheduling data
- Shifts, schedules, shift-swap and marketplace activity, and approval history;
- Notification preferences and delivery records (so we can send you shift-related alerts).
Billing data
Handled directly by our payment processor, Stripe. We receive confirmation of payment and subscription status, but never your full card number.
Technical & usage data
We use Simple Analytics, a cookieless, privacy-first analytics service, to understand aggregate traffic on our marketing site. It doesn’t use cookies, doesn’t track you across sites, and doesn’t collect personal data such as your IP address in an identifiable form. The Service also uses one strictly necessary session cookie to keep you signed in — no advertising or cross-site tracking cookies.
2. How we use it
- To provide and operate the Service — accounts, schedules, swaps, approvals, and notifications;
- To authenticate you, including via Google sign-in where you choose it;
- To process payments and manage subscriptions, via Stripe;
- To send service emails (verification, password reset, shift notifications) via Resend;
- To maintain security, prevent abuse, and debug issues;
- To comply with legal obligations, such as bookkeeping requirements.
3. Legal basis (GDPR)
Where GDPR applies, we process personal data to perform our contract with you (running the Service you signed up for or were invited to), to comply with legal obligations (like accounting rules), and based on our legitimate interest in keeping the Service secure and working reliably — balanced against your rights and interests. Employee scheduling data is processed by us as a processor, on the legal basis the employer (as controller) has established for that processing.
4. Who we share data with
We don’t sell personal data. We share it with the following subprocessors, each engaged solely to help us run the Service:
- Vercel Inc. — application hosting;
- Supabase Inc. — database hosting;
- Resend — transactional email delivery;
- Stripe, Inc. — payment processing;
- Google LLC — optional sign-in with your Google account.
Some of these providers may process data outside the EU/EEA (for example in the United States). Where that’s the case, we rely on appropriate safeguards such as the EU Standard Contractual Clauses. A current subprocessor list and, for business customers, a Data Processing Agreement are available on request at info@shiftscout.io.
We may also disclose data if required by law, or in connection with a merger, acquisition, or sale of assets — in which case we’ll make reasonable efforts to require the recipient to honor this Policy.
5. Data retention
We keep account and scheduling data for as long as your account is active, and for a reasonable period afterward in case you or your organization reactivates it or needs export. We keep billing records as long as required by Swedish accounting law (generally seven years). You or your organization can request earlier deletion as described in Section 6, subject to any legal retention obligations we have.
6. Your rights
If GDPR applies to you, you have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on it. If you’re an employee using ShiftScout through your employer’s organization, some of these requests may need to go through your employer, since they control that data — but you’re welcome to contact us directly and we’ll help route it appropriately. You also have the right to lodge a complaint with your local data protection authority — in Sweden, that’s Integritetsskyddsmyndigheten (IMY).
7. Security
We use industry-standard safeguards to protect personal data, including encryption in transit, hashed password storage, and access controls limiting who at Digital Alley can see your data. No method of transmission or storage is perfectly secure, but we work to keep these protections current.
8. Children
The Service is intended for use by working adults and isn’t directed at children under 16.
9. Changes to this Policy
We may update this Policy from time to time. If a change is material, we’ll let you know (for example by email or an in-app notice) before it takes effect.
10. Contact us
Digital Alley AB, Kalkstensvägen 42, 216 31 Limhamn, Sweden — info@shiftscout.io. See also our Terms of Service.