Privacy Policy

This Privacy Policy describes how ShiftLead ("ShiftLead," "we," "us," or "our") collects, uses, and protects information about you when you use the ShiftLead platform, including our web application and mobile application (collectively, the "Service").

By using the Service, you agree to the collection and use of information as described in this policy.

1. Who We Are

ShiftLead is a Coaching OS designed for frontline leaders and support managers. We are not a human resources compliance system, a surveillance tool, or a therapy platform. Our Service helps managers structure coaching, evaluate team interactions, and build consistent leadership practices.

Operator contact: support@getshiftlead.com

2. Information We Collect

Information you provide directly

• Name and email address (at account registration)
• Job title and role
• Profile photo (if uploaded via the mobile app)
• Team member names and roles you enter
• Coaching notes, evaluation inputs, and guideline content you create
• Support communications you send to us

Information collected automatically

• Authentication events (login timestamps, session tokens managed by Supabase Auth)
• Usage activity within the application (pages visited, features used)
• Aggregate site analytics via Vercel Analytics, which is cookieless and does not identify individual users — no personal identifiers are included in analytics data
• IP address, collected by our infrastructure providers for security and fraud prevention

Information from third parties

• When you sign in with Google, we receive only your name and email address. We do not access or store Google Drive, Gmail, Google Contacts, or any other Google service data.
• Billing information is processed by Stripe. We do not store raw payment card data.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service
• Authenticate your identity and maintain your session
• Deliver AI-assisted evaluation, coaching, and brief features
• Send transactional emails related to your account (password resets, billing receipts)
• Respond to support requests
• Detect and prevent fraud, abuse, and security incidents
• Comply with applicable legal obligations

We do not sell your personal information. If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and the right to opt out of the sale of personal information (which we do not engage in).

We do not use your data to train AI models without your explicit, separate consent.

4. AI Processing

ShiftLead uses third-party AI models (including models from Anthropic) to power evaluation, coaching, and guideline features. When you use these features:

• Content you submit (such as call transcripts, evaluation notes, or guideline text) may be sent to AI providers for processing
• AI outputs are generated responses — they are not guaranteed to be accurate, complete, or suitable for any specific purpose
• You are responsible for reviewing AI-generated content before acting on it
• We configure AI providers to minimize data retention; however, their own privacy policies govern how they handle submitted content
• We do not include personally identifiable employee information in AI prompts beyond what you explicitly submit

AI processing is a core part of the Service. If you do not consent to AI processing of your content, you should not use the AI-powered features.

5. Third-Party Services

We rely on the following categories of third-party services:

Each provider has its own privacy policy and data processing terms. We are not responsible for their practices beyond what is addressed in our data processing agreements with them.

6. Data Retention

We retain your account data for as long as your account is active or as needed to provide the Service. If you close your account:

• Your profile data will be deleted within 90 days of account closure
• Evaluation and coaching records may be retained for a limited period for legal and audit purposes
• Anonymized, aggregated usage data may be retained indefinitely

Stripe retains billing records as required by applicable law and their own retention policies.

7. Security

We take reasonable technical and organizational measures to protect your data, including:

• Encrypted connections (TLS/HTTPS) for all data transmission
• Row-level security enforced at the database layer
• Authentication tokens scoped per session and rotated regularly
• Access controls limiting which personnel can access production data

No system is completely secure. You are responsible for maintaining the confidentiality of your account credentials.

8. Data Breach Notification

In the event of a security incident that compromises your personal data, we will notify affected users as required by applicable law, within the timeframes required by your jurisdiction. We will describe the nature of the incident, the data affected, and the steps we are taking in response.

9. Your Rights

Depending on your location, you may have rights including:

• Access — Request a copy of the personal data we hold about you
• Correction — Request correction of inaccurate data
• Deletion — Request deletion of your account and associated data
• Portability — Request your data in a structured, machine-readable format
• Objection — Object to certain processing activities

To exercise these rights, email us at support@getshiftlead.com. We will respond within 30 days.

We do not discriminate against users who exercise their privacy rights.

10. Children's Privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, contact us immediately at support@getshiftlead.com.

11. International Data Transfers

Your data may be processed in countries other than your own. We use providers whose infrastructure may be located in the United States or other jurisdictions. By using the Service, you consent to such transfers subject to appropriate safeguards.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new effective date. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

13. Contact

For questions about this Privacy Policy or your personal data:

ShiftLead
For questions about this policy, contact ShiftLead Support at support@getshiftlead.com.