Privacy Policy

Shiftly is a product of MAXMEN LTD., the data controller for the personal data described here. You can reach us at:

MAXMEN LTD.
Stoneycove, Checkbar, Nigg, Aberdeen, United Kingdom, AB12 4LP
Email: support@maxmenukk.shop
Phone: +44 7381027803

When you use Shiftly to schedule your staff, you are the controller of your employees’ personal data and Shiftly acts as your processor for that information, handling it only to provide the service.

We collect only what we need to run the service:

• Account data: your name, email and password credentials.
• Subscription data: plan, billing status and payment processor identifiers (not card numbers).
• Scheduling inputs: the opening hours, team member names or labels, availability, rules and briefs you enter to generate a rota.
• Generated results: the rotas, coverage checks, hours summaries, timesheets, diagrams and recap videos produced from your inputs.
• Uploaded or pasted files: any clock-in/clock-out notes or files you provide for timesheet generation.
• Support data: messages you send us and their contents.
• Technical data: IP address, device/browser type and basic usage logs for security and reliability.

Employee contact details and availability can be sensitive. Please share only what is necessary and avoid special-category data (such as health information) in free-text fields.

Our collection sources are:

• Directly from you, when you sign up, subscribe, enter scheduling data or contact us.
• Automatically, from your device when you use the service (technical/usage data such as IP address and browser type).
• From our payment processor, which confirms subscription and payment status (not card numbers).

We do not buy personal data from data brokers or other third-party collection sources.

• To provide the service — generate rotas, checks, diagrams and exports (performance of a contract).
• To take payment for subscriptions (performance of a contract).
• To support and communicate with you about your account (legitimate interests / contract).
• To secure and improve the service and prevent abuse (legitimate interests).
• To meet legal obligations such as accounting and tax records (legal obligation).

We do not sell your personal data, and we do not use your scheduling inputs, generated outputs or uploaded files to train machine-learning models.

User input: the opening hours, team details, availability, rules, briefs and any clock-in/out notes you enter are the user input that drives generation. Rotas, coverage checks, hours summaries, diagrams and recap videos are generated from that user input. Diagrams and recap videos are rendered in your browser from your rota data. We process your input and results only to deliver the service to you.

• We retain your saved scheduling input and results only for as long as your account needs them.
• You can delete input and generated results from your workspace; deletion removes them from active systems, with backups expiring on our normal cycle.
• Uploaded clock-in/out notes and example data are used only to build the requested timesheet and are not repurposed.
• We never use your input, generated results or uploaded files to train AI models, and we never sell them.

AI provider: Shiftly’s core rota generation runs on our own servers. Where an external AI provider is used to process a request (for example an optional language or media generation step), it acts as our processor under contract, processes your input only to return your result, and is contractually prohibited from using your data to train its models. We update the processor list below if this changes.

We share personal data only with service providers who help us operate Shiftly, under contract:

• Hosting & infrastructure: our cloud hosting provider for running the application.
• Payments: our payment processor, which handles card data and subscriptions. We never receive full card numbers.
• Database & storage: our managed database/storage provider for account and scheduling data.
• Email: our email provider for transactional and support messages.
• AI provider: where an external AI provider processes a generation request, it does so as our processor under contract and does not train on your data.

We may also disclose data where required by law, or to protect our rights, users and the security of the service. We do not sell or share personal data for cross-context behavioural advertising.

Our providers may process data in countries outside the UK or EEA. Where they do, we rely on appropriate safeguards such as UK/EU Standard Contractual Clauses or an adequacy decision to protect your data to an equivalent standard.

• Account & subscription data: for the life of your account and up to 7 years afterward where needed for tax/accounting.
• Scheduling inputs & results: until you delete them or your account closes, then removed from active systems.
• Support messages: up to 24 months.
• Technical logs: a short rolling window for security and reliability.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data or complete incomplete data.
• Delete your data (right to erasure).
• Restrict or object to certain processing.
• Data portability.
• Withdraw consent where processing is based on consent.
• For California residents: know, delete, correct, and opt out of “sale”/“sharing” — we do not sell or share personal data, and we do not discriminate against you for exercising your rights.

To exercise any right, email support@maxmenukk.shop. We respond within the time limits set by applicable law.

We do not sell your personal information and do not share it for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA. There is therefore nothing to opt out of, but you may still contact us with any request.

We use essential cookies to keep you signed in and to secure the service, and limited privacy-respecting analytics to understand usage. See our Cookie Policy for details and choices.

Rota suggestions are algorithmic aids that you review and approve; they are not legally significant automated decisions made without human involvement, and Shiftly does not make employment decisions for you.

Shiftly is a business tool for employers and is not directed to children. The account holder must be at least 18. Where a scheduled worker is a minor, the employer is responsible for handling that person’s data lawfully. See our Terms.

We use encryption in transit, access controls and reputable infrastructure providers to protect your data. No method of transmission or storage is perfectly secure, but we work to protect your information and will notify you and regulators of a qualifying breach as required by law.

Email support@maxmenukk.shop or write to us at the registered office above.

If you are in the UK you may complain to the Information Commissioner’s Office (ICO). If you are in the EEA you may complain to your local supervisory authority. If you are in California you may contact the California Privacy Protection Agency. We ask that you contact us first so we can help.

Governing law: England and Wales. This policy was last updated on 21 July 2026.