1. Overview
Shiftbreeze ("we", "us", "our") is committed to protecting the privacy of all individuals who use our platform, including business owners, managers, and their staff members. We operate in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
This policy explains what personal information we collect, why we collect it, how we use and disclose it, and how you can access or correct it. It applies to all users of shiftbreeze.com and any associated mobile applications or services.
2. Information we collect
We collect personal information in two ways: information you provide directly, and information collected automatically when you use the platform.
Information you provide
- Account registration details: name, email address, business name, ABN (optional)
- Staff records: employee names, email addresses, phone numbers, roles, employment type, pay rate information
- Staff onboarding details, collected at your employer’s direction when you complete the onboarding form: date of birth, residential address, and emergency contact name and phone number
- Payroll details collected during onboarding: bank account details (account name, BSB and account number), superannuation fund and member number, and tax details including your tax file number and tax declaration answers (or, for New Zealand staff, IRD tax code and KiwiSaver rate)
- Documents your employer requests during onboarding or employment, such as identification or visa documents and certifications, uploaded to private, access-controlled storage
- Operational data: roster schedules, timesheet entries, clock-in and clock-out records, leave requests
- Clock-in and clock-out location: when your employer turns on location-verified clock-in, the app records your GPS coordinates at the moment you punch in or out. Location is captured only at those moments — Shiftbreeze never tracks your location continuously.
- Checklist submissions, cash count records, stock take data, incident and maintenance reports
- Photos submitted via the Store Photos feature
- Messages sent through the Team Messaging feature
- Payment and billing information (processed securely by our payment provider — we do not store full card details)
- Communications you send us (e.g. support requests, emails)
Tax file numbers. TFNs are collected only at your employer's direction, only for payroll purposes, and are handled in accordance with the Privacy (Tax File Number) Rule 2015. Access to TFN, bank and superannuation details is restricted to your employer's authorised users and the payroll services they connect (see section 4).
Information collected automatically
- Device type, browser type, and operating system
- IP address and approximate location (country/region)
- Pages visited, features used, and time spent on the platform
- Session data and authentication tokens
- Error logs and performance data used to diagnose issues
3. How we use your information
We use the personal information we collect only for legitimate purposes directly related to operating and improving Shiftbreeze. These purposes include:
- Providing and operating the Shiftbreeze platform and its features
- Creating and managing your account
- Processing subscription payments and managing billing
- Sending transactional communications (e.g. account confirmations, invoices, password resets)
- Providing customer support and responding to enquiries
- Improving the platform through usage analytics and error monitoring
- Complying with our legal obligations
- Detecting and preventing fraud, abuse, or unauthorised access
We do not sell, rent, or trade your personal information to third parties. We do not use your information for unsolicited direct marketing without your consent.
4. Disclosure to third parties
We share personal information with third-party service providers only to the extent necessary to deliver our services. All third parties are bound by appropriate data processing agreements and are required to handle data securely.
Our key sub-processors
- Supabase Inc. — database hosting and authentication. Your data is stored on Supabase infrastructure hosted on AWS in Sydney, Australia (ap-southeast-2). Supabase is SOC 2 Type II certified.
- Vercel Inc. — application hosting and content delivery. Servers are located in the United States and Australia (via CDN edge nodes).
- Google LLC — optional Google OAuth sign-in. No additional data is shared with Google beyond the authentication process.
- Stripe Inc. — payment processing. Stripe is PCI-DSS Level 1 certified. We never store raw card numbers.
- Resend / email provider — transactional email delivery (e.g. invitations, password resets).
- Twilio Inc. — SMS delivery. When your business sends roster notifications by SMS, staff mobile numbers and the message content are passed to Twilio to deliver the text.
- Meta Platforms Inc. — advertising analytics on our public marketing pages (see section 9). Meta does not receive your rostering, timesheet or payroll data.
- Xero Limited — payroll hand-off, only when your business connects its own Xero organisation. At your direction we send employee details your business chooses to sync (such as name, date of birth, home address, bank, tax and superannuation details) and approved timesheet hours to your Xero organisation.
- MYOB Australia Pty Ltd — payroll hand-off, only when your business connects its own MYOB company file. At your direction we send the employee details your business chooses to sync (including name, date of birth, bank details, superannuation and tax file number) and approved timesheet hours to your MYOB file.
- Intuit Inc. (QuickBooks) — payroll hand-off, only when your business connects its own QuickBooks company. At your direction we send basic employee details (name, email, hire date) and approved hours. Intuit is a United States company.
- Functional Software Inc. (Sentry) — crash and error reporting for the mobile app, so we can find and fix bugs. Crash reports include device and app-state information; they are not used for advertising and do not include your payroll data. Sentry is a United States company.
- Expo (650 Industries Inc.) — push notification delivery for the mobile app. Expo handles device push tokens and notification content (e.g. "Your roster has been published"). Expo is a United States company.
We may also disclose personal information where required by law, court order, or a request from a law enforcement agency with appropriate authority.
5. Cross-border disclosure
Your Shiftbreeze data — including staff records, rosters, timesheets and payroll details — is stored in Sydney, Australia. It is not stored overseas.
Some of our service providers are incorporated outside Australia (for example Vercel, Stripe, Resend, Twilio, Meta Platforms, Intuit, Sentry and Expo, which are United States companies), and limited personal information is necessarily handled by them to deliver the service: your email address when we send you a notification, a staff member's mobile number when your business sends an SMS, a device push token when we deliver an app notification, crash diagnostics when the app errors, and your billing details when you pay. Those providers may process that information outside Australia. By using Shiftbreeze, you consent to that limited transfer for the purposes described in this policy.
Where personal information is handled overseas, we take reasonable steps to ensure recipients handle it in a way that is consistent with the Australian Privacy Principles (APP 8).
6. Data security
We take the security of your personal information seriously and implement a range of technical and organisational measures, including:
- All data is encrypted in transit using TLS 1.2 or higher
- All data is encrypted at rest using AES-256
- Access to production systems is restricted to authorised personnel only
- Row-level security (RLS) policies ensure businesses can only access their own data
- Authentication supports secure password policies and optional OAuth via Google
- Regular security reviews and dependency updates
No method of transmission or storage is 100% secure. In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act.
See our Security page for more detail on our infrastructure and practices.
7. Data retention
We retain personal information for as long as your account is active or as needed to provide our services. Specifically:
- Active account data is retained for the duration of your subscription
- Upon account cancellation, we retain your data for 90 days to allow recovery if required
- After the 90-day recovery window, your workspace is deleted from our production systems within a further 30 days
- Anonymised analytics data may be retained indefinitely
- Backups may persist for up to 30 days beyond deletion from production systems
You may request early deletion of your data by contacting us at hello@shiftbreeze.com.
A note for employers: Australian workplace law requires employers to keep time and wages records (typically for 7 years). Deleting your Shiftbreeze workspace does not relieve you of those obligations — export your timesheets and records before cancelling.
8. Your rights
Under the Australian Privacy Act and Privacy Principles, you have the right to:
- Access — request a copy of the personal information we hold about you
- Correction — request correction of inaccurate or incomplete information
- Deletion — request deletion of your personal information (subject to legal obligations)
- Opt-out of marketing — unsubscribe from any marketing communications at any time
- Portability — request your data in a portable format (e.g. CSV export of timesheets, rosters)
- Complaints — lodge a complaint if you believe we have mishandled your information
To exercise any of these rights, contact us at hello@shiftbreeze.com. We will respond within 30 days.
10. Junior staff and children's privacy
Many hospitality and retail businesses lawfully employ junior staff, including people under 16. Where your employer rosters and pays junior employees through Shiftbreeze, we hold their staff records (including date of birth and payroll details) at the employer's direction, for employment purposes only, with the same protections described in this policy. Parents and guardians of junior staff can contact us at any time with questions about their child's information.
Outside of employment records managed by an employer, Shiftbreeze is not directed at children and we do not knowingly collect personal information from anyone under 15. If you believe we hold such information outside an employment context, please contact us and we will take steps to delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify account holders via email and update the "Last updated" date at the top of this page. Continued use of Shiftbreeze after changes are posted constitutes acceptance of the updated policy.
12. If your business is in New Zealand
If your business or your staff are in New Zealand, we handle personal information in accordance with the Privacy Act 2020 (NZ) and its Information Privacy Principles (IPPs), alongside our obligations under the Australian Privacy Act 1988. Where the two regimes differ, we apply the standard that better protects your information.
Your Shiftbreeze data is hosted in Sydney, Australia (see section 5). For New Zealand users this means your information is held outside New Zealand, in Australia, where it is protected by the Australian Privacy Act 1988 and the safeguards described in this policy.
New Zealand users have the same rights of access and correction described in section 8: you may request a copy of the personal information we hold about you and ask us to correct it, and we will respond within 30 days.
If you are not satisfied with how we handle a privacy concern, you can complain to the Office of the Australian Information Commissioner (OAIC) (oaic.gov.au, details in section 13) or, in New Zealand, to the Office of the Privacy Commissioner (OPC):
- Website: privacy.org.nz
- Phone: 0800 803 909 (within New Zealand)
- Post: PO Box 10094, Wellington 6143, New Zealand
13. Contact & complaints
If you have questions, concerns, or a complaint about how we handle your personal information, please contact our Privacy Officer:
- Email: hello@shiftbreeze.com
- Subject line: Privacy Enquiry
- Response time: Within 30 days
If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
- Website: oaic.gov.au
- Phone: 1300 363 992
- Post: GPO Box 5218, Sydney NSW 2001