Privacy Policy

Last updated: 11 July 2026

This Privacy Policy explains how ShiftlyAI Ltd ("Shiftly", "we", "us"), the company behind the Shiftly WhatsApp shift assistant and website at getshiftly.co.uk, collects, uses, and protects your personal data. ShiftlyAI Ltd is the data controller for the personal data described below.

If you have any questions, contact us at info@getshiftly.co.uk.

1. Who we are

Shiftly is a personal assistant for shift workers, delivered over WhatsApp. You send a photo of your roster and we read it and keep your calendar up to date, alongside reminders, leave, swaps, and related scheduling help. Shiftly is operated by ShiftlyAI Ltd, a company registered in England and Wales under company number 17248938, with its registered office at 66 Paul Street, London, EC2A 4NA.

2. What data we collect

  • Account details — your WhatsApp phone number (which identifies you to us) and the name you give us.
  • Roster and schedule data — the roster photos, screenshots and PDFs you send; the shift times, duty codes, rest days, annual/lieu/banked leave, swaps and personal events extracted from them.
  • Calendar connection — for Google Calendar users, an OAuth access/refresh token that lets us add events to your calendar; for Apple users, a private subscription token for your calendar feed.
  • Messages — the content of your conversations with Shiftly, including voice notes (which we transcribe to text).
  • Preferences and notes — settings such as your roster-release day and reminder timing, plus facts you tell us (e.g. your depot or shift-code conventions) so we can help you better.
  • Technical data — limited logs needed to operate and secure the service.

3. How we use your data

  • To read your rosters and create, update and remove events in your calendar.
  • To send you shift reminders and roster-day prompts you've asked for.
  • To answer your questions and carry out the scheduling actions you request.
  • To operate, secure, debug and improve the service.
  • To contact you about your use of Shiftly and respond to support requests.

4. Legal bases (UK GDPR)

We rely on the following legal bases:

  • Performance of a contract — to provide the service you signed up for.
  • Consent — for calendar access and for reminder messages; you can withdraw consent at any time.
  • Legitimate interests — to keep the service secure, prevent abuse, and improve it, balanced against your rights.

5. Who we share it with

We do not sell your data. We share it only with service providers (sub-processors) who help us run Shiftly, under contracts that require them to protect it:

  • Twilio — delivers WhatsApp messages to and from you.
  • Supabase — hosts our database and stores your roster images.
  • Anthropic — provides the AI (Claude) that reads your rosters and powers the assistant.
  • OpenAI — transcribes your voice notes.
  • Google — the Calendar API, for Google Calendar users.
  • Amazon Web Services and Vercel — host our backend and website.

We may also disclose data where required by law. Some providers are based outside the UK/EEA; where they are, transfers are protected by appropriate safeguards such as Standard Contractual Clauses.

6. How long we keep it

We keep your data for as long as your account is active. If you delete your account, we remove your personal data from our systems (backups roll off on their normal cycle). You can delete everything yourself at any time — see your rights below.

7. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict, object to, and port your data, and to withdraw consent. Shiftly lets you exercise the main ones directly in WhatsApp:

  • Message "export my data" and we'll send you a copy of everything we hold.
  • Message "delete my account" and we'll permanently erase your data (after a confirmation step).
  • You can disconnect your calendar or turn off reminders at any time by asking.

You can also email info@getshiftly.co.uk. If you believe we've mishandled your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. Security

We use industry-standard measures to protect your data, including encryption in transit, access controls, and private storage for roster images. No system is perfectly secure, but we work to keep your data safe and to notify you and the ICO of any breach where required.

9. Children

Shiftly is for working adults and is not intended for anyone under 18. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. We'll change the "Last updated" date above and, for significant changes, let you know in WhatsApp.

11. Contact

Questions or requests: info@getshiftly.co.uk, or write to us at ShiftlyAI Ltd, 66 Paul Street, London, EC2A 4NA, United Kingdom.