Privacy Policy
Last updated: June 2026
Operator: [Company name and address, to be completed] · Contact: info@codemental.de
ShiftPilot is a workforce-management app that lets organizations manage staff scheduling, attendance, leave and related operations. This policy explains what personal data the app processes, why, and the rights you have. We process data in line with the EU General Data Protection Regulation (GDPR).
1. Data we collect
- Account & profile: your name, work email, role and the branch you belong to.
- Attendance: clock-in/out times, the method used (QR, NFC, PIN, photo or signature) and the device used.
- Location: captured only when your organization has enabled geofenced attendance, and only at the moment you clock in or out, to confirm you are at your assigned branch.
- Photos & documents: attendance photos and any staff photos or documents you upload.
- Operational data: shifts, leave requests, tasks, meetings and announcements.
- Device push token & basic device info: used to deliver notifications.
2. How we use your data
Your data is used solely to operate the workforce-management features of ShiftPilot: clocking in and out, planning shifts, tracking leave, assigning tasks and sending you relevant notifications. We do not use it for advertising and we do not sell it.
3. Legal basis (GDPR)
Processing is based on the performance of the employment/service relationship between you and your organization (Art. 6(1)(b)), our and your organization's legitimate interest in managing the workforce (Art. 6(1)(f)), and, for location and camera use, your consent given through the device permission prompts (Art. 6(1)(a)), which you can withdraw at any time in your device settings.
4. Who can see your data
Your information is visible to authorized managers and administrators within your own organization, according to their role. We use the following processors on our behalf:
- Firebase Cloud Messaging (Google): to deliver push notifications (device token only).
- Our hosting infrastructure in Germany, where application data is stored.
5. Data retention
Personal data is kept for as long as your account is active within your organization, and is deleted or anonymized when no longer needed, or on a valid deletion request, subject to any legal retention obligations.
6. Your rights
Under the GDPR you may request access to, correction of, deletion of, or a copy of your personal data, and you may object to or restrict certain processing. To exercise these rights, contact your organization's administrator or us at the email above. You also have the right to lodge a complaint with a data protection authority.
7. Security
All traffic between the app and our servers is encrypted with HTTPS/TLS. Access to data is restricted by role-based authorization.
8. Children
ShiftPilot is intended for use by employed staff and is not directed at children under 16.
9. Changes to this policy
We may update this policy from time to time. The "last updated" date above reflects the latest version.