This translation is provided for convenience. If the language versions differ, the Polish version prevails.
This policy explains how personal data is processed in the EVoShift apps for Android and iOS, the web app at evoshift.app and the services behind them (together the "Service").
1. Who is responsible
The controller of your personal data is Mateusz Janicki, an individual developer who publishes the Service under the name EVoApps as an unregistered activity (działalność nierejestrowana, art. 5 of the Polish Entrepreneurs' Law), address ul. Opacka 23/62, 80-330 Gdańsk, Poland, e-mail contact@evoshift.app. Write to this address with any question about your data or to exercise your rights.
Employers and their staff. A business that uses EVoShift (the owner of a workplace) decides whom it invites and what it records about its staff: schedules, working time, absences, pay and contact details. For that data the business is the controller and we process it on its behalf under the data processing agreement in our terms. If you work for such a business, please contact your employer first; we will help them answer your request.
2. What we process, why, and on which legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Your account and sign-in (e-mail and password, or Google) | E-mail, name, profile photo (from Google when you sign in with Google, or one you upload), Google account identifier, verification status. Passwords are handled by Firebase Authentication and never seen by us. A photo you upload is cropped and re-encoded on your device (512×512 JPEG) without its metadata, such as location or camera details; the people you work with see it. You can remove it in your profile at any time. | Contract, Art. 6(1)(b) |
| Workplaces, teams and invitations | Workplace name, address and location set by its manager; your role, permissions, employment start and end dates; invitation codes and e-mails. When a manager searches for the workplace's address, the typed text is looked up at OpenStreetMap (see section 5) | Contract, Art. 6(1)(b); for staff data we act as processor for the employer |
| Rosters and working time | Planned and actual shift times, clock-in and clock-out times and how each was made (in the app, on the workplace's clock-in tablet, by scanning the tablet's code, or corrected by a manager), shift swap requests, availability preferences and their comments, notes | Processor for the employer (the employer's basis is typically the employment contract and labour law, Art. 6(1)(b) and (c)) |
| Location check at clock-in (only where the employer turns it on) | When you clock in or out on your phone or in the browser at such a workplace, the app reads the device's position once, at that moment, and sends it to our server. The server compares it with the workplace's location and keeps only the result (at the workplace, outside it, or not verified) and the distance in metres, next to your clock time. The coordinates themselves are not stored or logged, and there is no tracking in the background. The app explains this the first time; you can refuse location access, and the clock-in is then marked as not verified or refused, depending on the workplace's setting. Clock-ins on the workplace's tablet, a watch or the desktop app are not located. | Processor for the employer. The employer's basis is its legitimate interest in accurate working-time records, Art. 6(1)(f); in Poland it introduces such a check under art. 22³ §4 of the Labour Code (work regulations, informing staff in advance) |
| Clock-in checks | Marks on unusual clock times (much earlier or later than planned, much longer or very short shifts, outside the workplace area, two people clocking on one tablet moments apart, a tablet PIN clock-out without the person's app opened since the clock-in where the employer turns that on), clock-ins without a shift of one's own (covering a colleague or an unplanned shift) and the manager's decisions on them with who made them and when. Nothing is refused because of a mark; a manager reviews it. | Processor for the employer: legitimate interest in accurate working-time records and pay, Art. 6(1)(f), and labour law, Art. 6(1)(c) |
| Clock-in photo on the workplace's tablet (only where the employer turns it on; off by default) | Where the employer chooses it, the workplace's tablet asks for a photo right after a PIN clock-in. The photo is stored privately for that workplace's managers, deleted automatically after 30 days, and never used for face recognition, face matching or any other biometric processing; you may skip it, and the clock-in stands. Photos are not taken on your own phone. | Processor for the employer: its legitimate interest in preventing clock-ins for someone else, Art. 6(1)(f). Before turning it on, the employer carries out a data protection impact assessment and informs staff in advance (in Poland as for monitoring, art. 22² and 22³ of the Labour Code) |
| Absences | Type (e.g. sick leave, holiday), dates and an optional short note. We ask for no diagnoses or medical details and store no documents (e.g. sick notes). Notifications about an absence request never show its type. | Processor for the employer. Sick leave is health data; the employer processes it under labour law, Art. 9(2)(b) |
| Pay and employment details | Contract type, pay rates or salary, employer cost, payroll settings (e.g. under-26 relief, student status, tax-reducing amount (kwota zmniejszająca podatek)), bonuses, deductions and refunds, calculated pay, phone number, address, bank account number | Processor for the employer (Art. 6(1)(b) and (c) on the employer's side) |
| Medical exam and OHS dates, documents and workplace policies | The validity dates of your occupational medical exam and OHS training. Documents you or the workplace's owner or financial managers upload: contract, medical certificate of fitness for work (never test results or diagnoses), OHS certificate and other files (PDF, JPEG or PNG, up to 10 MB), with their type, expiry date, who uploaded them and when. Only you and that workplace's owner and financial managers can open them, never your colleagues. Workplace policies (e.g. the work rules or the OHS instruction) and your confirmation that you have read one, with the time our server recorded. Such a confirmation records only that you confirmed reading the document: it is not a qualified electronic signature and signs nothing. | Processor for the employer. The employer's basis is labour law and the employment contract, Art. 6(1)(b) and (c); for the medical certificate (health data) Art. 9(2)(b) with art. 229 of the Polish Labour Code |
| Training and OHS training record | Courses your employer asks you to complete: which pages you have read, your test results (score, pass or fail, number of attempts, the course version) and when you passed, stamped by our server. The right answers are kept apart and only managers see them. For OHS (BHP) training: your position group, the general and workplace instructions (who conducted them, when, the position, admission to work), the periodic training (exam, commission, certificate number) and your confirmations of the instructions with the time our server recorded. A confirmation identifies you as the signed-in person; it is not a qualified electronic signature. Visible to you and the workplace's managers, never to colleagues. Video pages of a course are links: the video opens on the provider's website (for example YouTube), outside EVoShift, which then receives your visit under its own privacy policy; EVoShift sends it nothing. Presentation pages work the same way: a link to Google Slides, Prezi or Microsoft Office opens on that provider's website, and in the web version it is shown inside the course only after you choose to show it, then the provider receives your visit. A presentation file the workplace uploaded stays in EVoShift's storage, readable only by the people working there, and opens on your own device. | Processor for the employer. The employer's basis is labour law (OHS training, art. 237³ of the Polish Labour Code and the regulation on OHS training) and the employment contract, Art. 6(1)(b) and (c) |
| Subscriptions of workplace owners | Plan, purchase and renewal dates, store and transaction identifiers (no card details) | Contract, Art. 6(1)(b); invoices and tax records, Art. 6(1)(c) |
| Data exports you request | A copy of your data (or, for an employer, of a workplace) prepared as a ZIP file | Legal obligation (your right of access and portability), Art. 6(1)(c) |
| Business figures | Daily takings, costs and labour statistics entered or calculated for a workplace | Contract, Art. 6(1)(b) |
| Transactional e-mails (invitations, verification, password reset, published rosters, availability requests with a personal link to a form) | E-mail, name, workplace name, a delivery log of each message | Contract, Art. 6(1)(b) |
| Notifications in the app and push notifications | Notification contents, push token (FCM), device name and platform, last activity | Contract, Art. 6(1)(b); push only after you allow notifications on your device |
| Team announcements and shift notes | Announcements a manager posts to the people of a workplace (text, author's name, the role it is for, pinned or not, time); read receipts: that you opened an announcement and when, which only the workplace's managers see; a manager's note on your shift, which only you and the managers see. Employees cannot post or message each other. | Processor for the employer (the employer's legitimate interest in informing its staff and knowing that important information reached them, Art. 6(1)(f), or the employment contract, Art. 6(1)(b)) |
| Job applications (hiring), for businesses that publish a job offer | What a candidate sends through a job page on evoshift.app/jobs: name, e-mail address and/or phone number, availability, a short note, an optional CV (PDF or DOCX, up to 5 MB, stored privately), the confirmation of being at least 16, the acknowledgement of the privacy notice and, if given, the consent to future recruitment; then the stage the employer sets and its managers' note. Candidates have no account. Sending the form sends them no e-mail; the employer may send its decision or an interview invitation (with a calendar file) to the address the candidate gave, through us. Interviews in the employer's schedule keep only the candidate's name. To stop abuse of the form we keep, for at most two days, hashed (not readable) network addresses and contacts with the times of submissions, and Cloudflare Turnstile checks that a person sends the form. The page asks not to include health data. | The business that publishes the offer is the controller and we process the data on its behalf: data the Labour Code lets an employer ask for (art. 22¹ KP, Art. 6(1)(c)), steps before a contract (Art. 6(1)(b)), anything else the candidate gives on their own initiative and future recruitment on consent (Art. 6(1)(a), art. 22¹a KP); the anti-abuse check is our and the business's legitimate interest (Art. 6(1)(f)) |
| AI shift suggestions (on request, when a manager chooses "Suggest with AI") | Pseudonymised scheduling data, no names or pay: random per-request codes instead of people, roles and shifts, shift times, days of the month, availability (available or not and the preferred time window), days a person cannot work (without the reason), contracted and planned hours, contract type, shift lead and supervision flags, rest rules. Never names, user ids, e-mail, phone, pay rates or costs, comments or notes, the workplace's name or address, or medical exam and OHS training dates. Only the person's device can turn the codes back into names; the request and the answer are not stored, only a daily count of requests per owner (2 days) | Contract with the workplace owner, Art. 6(1)(b); for staff data we act as processor for the employer. The suggestions decide nothing on their own: the manager reviews and assigns |
| Support requests (when you write to contact@evoshift.app) | Your e-mail with its subject, text and attachment names; your name and e-mail address stay only in our mailbox. The text is recorded as a support ticket without your e-mail address, with e-mail addresses and long numbers (phones, account numbers, PESEL) in it removed | Our legitimate interest in answering you and fixing reported problems, Art. 6(1)(f), or the contract, Art. 6(1)(b), if you use EVoShift. A person reads and answers every message; no reply is sent automatically |
| Security and keeping the Service working | Technical logs, IP address in server logs | Our legitimate interest in a secure service, Art. 6(1)(f) |
| Crash reports (Android and iOS apps), only if you allow them | Details of the crash or error (stack trace), device model, operating system and app version, time, a random installation identifier, your EVoShift user id, your role at the workplace and the number of your workplaces | Consent, Art. 6(1)(a) |
| Usage statistics (apps and web app), only if you allow them | Screens opened and actions taken (for example "roster published", "shift taken", the plan bought by its product name), device model, operating system, app version, approximate country, a random app-instance identifier, your EVoShift user id | Consent, Art. 6(1)(a) |
Account data is needed to use the Service. Pay calculations are made for your employer and do not decide anything about you on their own; we don't make decisions based solely on automated processing. We don't use advertising tools and we don't sell your data.
Working for more than one employer
If you work at several workplaces in EVoShift, each employer plans its own roster, and the app keeps you from being booked twice. This is what one employer learns about your work elsewhere:
- Workplaces of the same owner (one business): when planning, its managers see your shifts at its other workplaces, including ones not yet published, with the workplace's name and the times.
- Another employer: its managers see only that you are busy ("Busy (another employer)") at the times of shifts that employer has already published. They never see the other employer's name, your role, pay, notes, or shifts that are still a draft (a draft is the other employer's internal plan). The check runs on our server; no employer's app reads another employer's rosters.
- The 11-hour rest kept around work elsewhere is a rule of the app, shown as such: under the Polish Labour Code each employer counts working time separately.
Your availability is given once for all your workplaces and stored in your account, where only you can read it. Each workplace gets its own copy, shown in its own time slots. Workplaces of the same owner always get it. Another employer gets it only if you sent it from one of its workplaces or you turn on "Share my availability with all employers" (Profile; the app asks once when you start working for a second employer). A comment you mark for one workplace reaches that workplace only. Turning sharing off removes the copies other employers received through it, except copies their managers have already locked for planning.
Crash reports and usage statistics
To fix errors and to learn which features are used, the Service can send crash reports (Firebase Crashlytics, apps only) and usage statistics (Google Analytics for Firebase), both provided by Google. Both are off until you allow them. On first start the app asks once, with two separate choices that are not ticked; "Not now" leaves both off. Nothing is collected before you allow it, and crash reports recorded on the device before that are deleted, not sent.
- What is collected is listed in the table above. Reports and statistics never contain your name, e-mail, phone, pay, amounts, notes or other contents you enter. They are linked to your EVoShift user id, a random identifier, so we can tell which problems affect the same account; it says nothing about you on its own.
- Purpose: finding and fixing errors, keeping the apps stable and improving the features people use.
- Legal basis: your consent, Art. 6(1)(a), separately for each of the two.
- Withdrawing: turn either switch off at any time in Profile → Crash reports and statistics. It takes effect at once: sending stops, unsent crash reports are deleted and the statistics identifier of the device is reset. Withdrawal does not affect what was sent before. The choice is stored on each device.
- Retention: crash reports 90 days; usage statistics at the event level 2 months (the shortest setting of Google Analytics), after which only aggregated reports without identifiers remain.
- No advertising: we don't collect the advertising ID, Google signals and ad personalisation are off, the data is not shared with Google for its own purposes, and it is not used for profiling or decisions about you.
- In the web app only usage statistics are offered (Crashlytics has no web version). Test and development builds never collect anything.
Google user data
When you choose Sign in with Google, we receive from Google only your name, e-mail address, profile photo and Google account identifier. We use them only to create your EVoShift account, sign you in and show your name and photo to the people you work with. We don't request access to anything else in your Google account. EVoShift's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: Google user data is not sold, not used for advertising or analytics (crash reports and usage statistics carry only your random EVoShift user id, never your Google name, e-mail or photo), not transferred to others except the processors listed in section 5 to run the Service, and not used to develop, improve or train AI or machine-learning models. You can disconnect EVoShift in your Google account settings at any time; deleting your EVoShift account deletes this data.
3. Device permissions
The apps ask for permission to show notifications, and for your location only when you clock in or out at a workplace whose employer checks it (see "Location check at clock-in" above): once, at that moment, never in the background ("while using the app" on iPhone, "precise or approximate" on Android, the browser's own prompt on the web). The camera is used only when you choose to: to take a profile photo (only the square you crop is uploaded), to scan the code on your workplace's clock-in tablet, or, on a workplace tablet whose employer turned it on, to take the clock-in photo (see "Clock-in photo" above). A scanned code is read on your device; the camera image is never stored or sent. On Android the scan is done by Google Play services' code scanner, so the app itself has no camera permission. Printing and PDF reports are prepared on your device. The Android app excludes its data from device backups and transfers; everything is loaded again from the server after you sign in.
4. Website and web app storage
The web app stores only what it needs to work in your browser: the sign-in session, offline data
and your language. It sets no advertising cookies. Only if you allow usage statistics does the web
app set Google Analytics cookies (_ga); they are removed when you withdraw. The pages
of this website outside the web app set no analytics cookies. This website loads its fonts from
Google Fonts, which receives your IP address when the page is opened.
5. Who receives the data (processors)
We use these service providers, bound by data processing agreements, only for the purposes above:
- Google (Google Ireland Ltd. / Google LLC): Firebase Authentication including Sign in with Google, Cloud Firestore, Cloud Functions and Cloud Storage (data exports, profile photos, staff documents, workplace policies and course pictures) in Warsaw (europe-central2), Firebase Hosting, Firebase Cloud Messaging (push), Firebase Remote Config (switching features on and off, no personal data), Google Fonts, the Gemini API (AI shift suggestions, only pseudonymised scheduling data, only on request), and, only if you allow them, Firebase Crashlytics (crash reports) and Google Analytics for Firebase (usage statistics).
- Apple (Apple Distribution International Ltd. / Apple Inc.): delivering push notifications to iOS devices.
- Twilio SendGrid (Twilio Inc., USA): sending e-mails.
- On job pages (evoshift.app/jobs): Cloudflare Turnstile (Cloudflare, Inc., USA) checks that a person, not a robot, sends an application; it sees the network address and browser details, not the application.
- For support requests: Cloudflare (Cloudflare, Inc., USA) receives and forwards the e-mail, it is stored in our mailbox at Google (Gmail), and its text, without your e-mail address, is recorded as a ticket in a private repository at GitHub (GitHub, Inc., USA), where Claude by Anthropic (Anthropic Ireland, Ltd. / Anthropic PBC, USA) helps us categorise it and draft a reply or a fix.
- For workplace owners' subscriptions: RevenueCat (RevenueCat, Inc., USA), Stripe (Stripe Payments Europe Ltd.) for web purchases, and the App Store (Apple) and Google Play (Google), which process the payment.
Workplace address search and map. When a manager searches for a workplace's address in the app, our server sends the typed address (only the text, with the country and language, never who typed it) to the Nominatim service of the OpenStreetMap Foundation (United Kingdom, a country with an EU adequacy decision), which returns matching places; we keep the results, without the typed text, for 30 days. The map in the same dialog loads its images directly from OpenStreetMap's tile servers, which receive your IP address, your browser or app identification and, on the web, the address of the page. The OpenStreetMap Foundation acts as an independent controller under its own privacy policy. Map data © OpenStreetMap contributors.
Within a business, its owner and managers see the data their role allows; pay and contact details only the person and the business's financial managers. Authorities receive data only where the law requires it.
6. Transfers outside the EEA
Some providers above may process data in the USA. Such transfers rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.
7. How long we keep data
- Your account and profile: until the account is deleted.
- Workplace data (rosters, working time, absences, pay data, figures): until the business deletes it or closes its account. Employers must themselves keep employment records, such as working-time records and payroll, for as long as labour and tax law require.
- Job applications with their CVs: 90 days after the employer's decision or after the job offer closes, 12 months with the consent to future recruitment, 30 days after the candidate is hired, and never more than 180 days while nobody decides; the employer can delete one at any time. Anti-abuse records of the form: 2 days.
- Team announcements with their read receipts, and notes on shifts: 12 months (a note is also deleted with its shift); a manager can delete an announcement earlier.
- Notifications: 12 months. Queued e-mails and their delivery logs: 90 days. Invitations: 30 days after they expire; the invitee's e-mail address is removed as soon as the invitation e-mail has been sent. Links to the availability form: they work until the request's due date and 3 days more (they stop earlier when the manager replaces the request or the engagement ends); their records (when sent and used, never the link itself) are deleted 30 days later or with the account.
- Push tokens and device names: until the account is deleted, or 270 days after the device was last active.
- Profiles a manager created for someone who never joined and who has no shifts: 90 days.
- Clock-in photos from the workplace's tablet: 30 days. Clock-in marks and the managers' decisions on them: with the working-time records they belong to.
- Documents about you (contract, certificates, other files): while you work at that workplace and up to 90 days after your work there ends, unless deleted sooner. Confirmations of having read a workplace policy: as long as the employer keeps the policy, at most until your account is deleted. Employers keep their own personnel files outside EVoShift.
- Training results and the OHS training record: while you work at that workplace and up to 90 days after your work there ends; a course's results are deleted with the course. Employers keep the printed initial training card and certificates in their own personnel files.
- Workplace address search: results (place names and coordinates) for 30 days; the typed address is not stored.
- AI shift suggestions: the pseudonymised request and the answer are not stored; the count of a business's requests per day is kept for 2 days.
- Data exports: the download link works for 24 hours and the file is deleted after 7 days; a record that an export or a deletion happened is kept for 12 months.
- Subscription and purchase records: as long as tax law requires (5 years).
- Crash reports: 90 days. Usage statistics: 2 months at the event level, then only aggregated reports without identifiers.
- Support requests: up to 12 months after the matter is closed, unless we need them longer to establish or defend legal claims.
- Deleted data can remain in backups and logs for a limited time before they expire.
8. Your rights
You have the right to access your data and receive a copy, to rectify it, to have it erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interest. Where we rely on your consent (crash reports, usage statistics), you can withdraw it at any time in the app (Profile → Crash reports and statistics). You can change your profile in the app. Download your data in the app (Profile → Download my data, once a day, after signing in again): a ZIP file with everything we hold about you at all your employers, including your working time (planned and clocked), pay records, your documents (the files themselves), your policy confirmations and your training results and OHS training record, in JSON and spreadsheet (CSV) form with a readable summary. Employers can export a workplace's data or one employee's records to answer requests.
Delete your account yourself in the app (Profile → Delete account) or, without the app, at evoshift.app/delete-account. Deleted at once: your profile, contact and pay details, devices, notifications, availability, invitations and e-mails for your addresses, your documents (the files) and policy confirmations, your training results and OHS training record, your data exports and, for owners, the subscription record at RevenueCat. Your name is also removed from your colleagues' notifications. Records your employer must keep by law (shifts and working time, pay, leave) stay with the employer under an anonymous number instead of your account, without your name; free-text notes on absences are deleted. Owners first delete or hand over their workplaces; deleting a workplace removes all of its data. Data your employer recorded about you is handled together with the employer (see section 1); you can also write to contact@evoshift.app.
We answer requests within one month. You can also lodge a complaint with the supervisory authority: in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority in your country of residence.
9. Security
Data is encrypted in transit and at rest by our providers. Access is limited by tested database rules, by role and by workplace; pay and contact details are kept in separate, more restricted records. If a breach affects your data in a way that is likely to result in a high risk, we will inform you without undue delay.
10. Children
The Service is meant for businesses and their staff and is not directed at children. We don't knowingly collect data from children under 16; if you believe a child has given us data, contact us and we will delete it.
11. Changes
We will update this page when the processing changes and show the new effective date; material changes will also be announced in the app.