This policy explains how we process personal data when you visit our website, use ShiftLog.it (the "Service") or contact us, as required by Articles 13 and 14 of the EU General Data Protection Regulation (Regulation 2016/679, "GDPR").
1. Who is responsible for your data
1.1. The controller of your personal data is:
Softlane sp. z o.o., a limited liability company incorporated under Polish law, ul. Budowlanych 35/65, 43-100 Tychy, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) kept by the Sąd Rejonowy Katowice-Wschód w Katowicach, VIII Wydział Gospodarczy Krajowego Rejestru Sądowego under KRS number 0001146400, VAT ID PL6463017566, share capital 5000 PLN.
You can contact us about anything in this policy at [email protected] or by post at the address above. We have not appointed a data protection officer, as we are not required to.
1.2. Data in your content. Your tasks, descriptions, agents and reports may contain personal data about other people, such as your clients' employees. For that data, you are the controller and we process it on your behalf, under the Data Processing Agreement in our Terms of Service. This policy covers the data for which we are the controller.
2. What data we process, why, on what basis and for how long
2.1. Your account
Your email address, password (stored only as a hash), display name, timezone and settings such as the first day of the week. We need them to create and run your account and provide the Service under our Terms of Service (Article 6(1)(b) GDPR). We keep them until your account is deleted; deletion is completed within 30 days of your request, and backup copies are overwritten within a further 30 days.
2.2. Your content and AI requests
The tasks, agents and reports you create, to provide the Service (Article 6(1)(b) GDPR), until you delete them or your account. When you start an AI action, the text it needs (your keywords or text, your agent's description, and, within your plan's limits, your earlier tasks) is sent to our AI providers to generate the answer. We may also check the request with an automated classifier to detect requests unrelated to describing or planning work, which is our legitimate interest in preventing misuse of the Service (Article 6(1)(f) GDPR). Our AI providers are listed in Annex 2 to our Terms of Service. They process the text on our behalf and do not use it to train their models; they may keep it for a limited period to detect abuse, under their terms.
2.3. Plan, usage and billing
Your plan, how many AI credits and other plan features you have used, and the emails we have sent you about usage and plan changes, to provide your plan and apply its limits (Article 6(1)(b) GDPR). If you buy a paid plan, Creem, our merchant of record, sends us information about your subscription: a customer identifier, your email address and name, the plan, its status and billing period, and any discount code used. We use it to apply your plan (Article 6(1)(b) GDPR), and we keep it while your account exists and then until claims arising from the subscription are time-barred (generally 3 years), to establish and defend claims (Article 6(1)(f) GDPR). We never receive your full card details.
2.4. Security and sign-in activity
When you sign in, sign out, fail to sign in or change your password, we record the time, your IP address and your browser's user agent. Our servers also record technical logs of requests (IP address, time, requested address, browser). We use this data to keep the Service and your account secure and to detect misuse, which is our legitimate interest (Article 6(1)(f) GDPR). We keep the newest 100 sign-in events per account, none older than 90 days, and server logs for up to 30 days.
If we block an account for misuse, we record the reason and keep a log of such administrative actions, for our legitimate interests in security, accountability and defending claims (Article 6(1)(f) GDPR), while the account exists and then for up to 3 years.
2.5. Emails we send you
We send emails needed to provide the Service: confirming your email address, resetting your password, and telling you when you reach 80% and 100% of a plan limit or when your plan is about to end (Article 6(1)(b) GDPR). We do not send marketing emails unless you have agreed to receive them.
2.6. When you contact us
Your email address and what you write to us, to answer you, which is our legitimate interest (Article 6(1)(f) GDPR), or to perform our agreement with you if your message is about it (Article 6(1)(b) GDPR). We keep correspondence for up to 3 years after the matter is closed, to be able to defend claims.
2.7. Website analytics
We measure visits to our website with Cloudflare Web Analytics, which does not use cookies and does not store anything on your device. It records the page visited, the referring page, the type of browser and device, and the country derived from your IP address, and shows them to us only as aggregated statistics. We use it to understand how our website is used and to improve it, which is our legitimate interest (Article 6(1)(f) GDPR). You can object to it (section 6).
2.8. Legal obligations and claims
We may also process your data where the law requires it (Article 6(1)(c) GDPR), for example to answer a lawful request from an authority, and to establish, exercise or defend legal claims (Article 6(1)(f) GDPR), until the claims are time-barred.
2.9. Is providing your data required?
Your email address and a password are required to create an account; without them we cannot conclude the agreement. Everything else is optional.
3. Who receives your data
3.1. We share personal data only with:
- our service providers (processors), who process it on our behalf under data processing agreements: providers of hosting, storage of reports, AI text generation and screening of AI requests, email delivery and website analytics. They are listed by name in Annex 2 to our Terms of Service;
- Creem, our merchant of record, which sells paid plans and processes payments as an independent controller under its own privacy policy. When you start a checkout, we send Creem your email address and an identifier of your account;
- public authorities, where the law requires it;
- our professional advisers (such as accountants and lawyers), who are bound by confidentiality, where necessary.
We do not sell your personal data.
4. Transfers outside the European Economic Area
4.1. Some of our providers may process data outside the European Economic Area, mainly in the USA; Annex 2 to our Terms of Service shows which. We transfer data outside the European Economic Area only where the GDPR allows it: on the basis of the European Commission's adequacy decision for the EU-US Data Privacy Framework of 10 July 2023, for providers certified under it, or the European Commission's standard contractual clauses. You can ask us for a copy of the relevant safeguards.
5. Automated decisions
5.1. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Article 22 GDPR). AI features generate text at your request; they do not make decisions about you. Plan limits are applied automatically according to the plan you chose.
6. Your rights
6.1. You have the right to:
- access your data and receive a copy of it (Article 15 GDPR);
- have inaccurate data corrected (Article 16 GDPR);
- have your data erased (Article 17 GDPR);
- restrict the processing (Article 18 GDPR);
- receive the data you provided to us in a structured, machine-readable format and have it transmitted to another controller (Article 20 GDPR);
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Article 21 GDPR);
- withdraw your consent at any time, where we process data on the basis of consent, without affecting the lawfulness of processing before the withdrawal.
6.2. To exercise your rights, write to [email protected], if possible from the email address of your account, so we can confirm it is you. We will respond within one month; where a request is complex or there are many requests, we may extend this by two further months, and will tell you why.
6.3. You also have the right to lodge a complaint with a supervisory authority. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You can also complain to the authority in the EU country where you live or work.
7. Security
7.1. We protect your data with technical and organisational measures appropriate to the risk, including encrypted connections, private and encrypted storage of reports, hashed passwords, session timeouts, logging of sign-in activity and limited access to production systems. They are described in more detail in section 8 of the Data Processing Agreement.
8. Cookies
8.1. We use only cookies and similar technologies that are strictly necessary for the Service. See our Cookie Policy.
9. Changes to this policy
9.1. We will update this policy when the way we process personal data changes, and publish the new version on this page with a new date. If a change is significant, we will also tell account holders by email before it takes effect.