Last updated 28 September 2026
ShiftSwapHub (shiftswaphub.com) provides shift-swap software for restaurants, bars and hotels. For venue staff data, the venue is the controller and ShiftSwapHub is the processor. For account and billing data, ShiftSwapHub is the controller. Contact privacy@shiftswaphub.com.
Account data: name, email, password (stored by our auth provider as a hash), role and venue. Schedule data: shifts, swap notes, approval status and weekly hours. Optional alert data: a phone number used only for the SMS or WhatsApp simulator until you connect a sender. Billing data: plan and customer id. Payment card numbers are collected by Stripe and never stored on our servers.
We process account and schedule data to perform the contract with your venue (GDPR Art. 6(1)(b)). We process security logs and product diagnostics on the basis of legitimate interests (Art. 6(1)(f)). We do not sell personal data and we do not use it for advertising.
Supabase hosts the database and authentication in the region you select when you create the project. Stripe processes subscriptions. Vercel hosts the application. Each acts as a processor under their data processing terms. If you later connect an SMS or WhatsApp provider, that provider receives only the phone number and message you enable.
We keep venue records while the subscription is active and for up to 30 days after a venue is deleted, unless a longer period is required for tax or legal claims. You can remove a staff profile from the team page; that removes them from future shifts.
Depending on where you live, you can request access, correction, deletion, restriction, portability, or object to processing. Email privacy@shiftswaphub.com. You can also complain to your local supervisory authority. EU users can contact their national data protection authority.
If a processor stores data outside the EEA, we rely on that provider's Standard Contractual Clauses or an adequacy decision. Choose an EU Supabase region if your venue requires data to stay in the EU.
The app stores an essential session cookie (or local storage token) so you stay signed in, plus a preference for theme, demo mode and this cookie banner. We do not set advertising cookies. Declining the banner keeps only the essential session.