ShiftSync — Privacy Policy
ShiftSync holds things people are rightly protective of: where they were, what they look like, and what they are paid. This policy sets out what the application collects, when it collects it, and who can see it.
1. Who we are
ShiftSync is made and run by Covenra-Goshen Ltd, House No. 20, Donut Street, Community 25, Tema, Greater Accra, Ghana. Contact us at [email protected].
Your employer decides to use ShiftSync for their team and decides who is scheduled, what is recorded and how you are paid. For your employment and pay records your employer is the controller and we process the data for them. For running the service itself, such as your sign-in, security and our own records, we are the controller. Questions about your schedule, your pay or your employment record are usually best directed to your employer first.
2. What we collect
| Category | Examples | Why we need it |
|---|---|---|
| Account and job details | Name, email address, phone number, job title, department, branch, crew, role, who you report to, start date, type of contract, contracted hours, probation and contract end dates | To create your account, place you on the right team and build the roster |
| Record photo | A photograph of you kept on your staff record, taken or uploaded by your employer | To show who you are on the team list, and to compare with your clock-in photos (section 4) |
| Personal details | Date of birth, gender, home address, GhanaPostGPS address, emergency contact, next of kin | The details employers in Ghana keep for HR, SSNIT and your safety at work |
| Pay and tax | Basic pay or hourly rate, allowances and benefits, overtime, deductions, staff loans and advances, SSNIT number, Taxpayer Identification Number, tax residency and reliefs, payslips and the history of changes to your pay | To work out your pay, PAYE and SSNIT, and to produce payslips and the returns your employer files |
| How you are paid | Bank name, branch, account name and number, or your Mobile Money number and network | To prepare the payment list your employer sends to the bank or uses to pay you |
| Schedule and leave | Shifts, swaps, leave requests and balances, availability, and any doctor's note or document you attach to a leave request | To build and publish the roster and handle requests |
| Attendance | The times you clocked in and out, your phone's location at those moments, which phone or terminal you used, lateness and lost time with the reason given, and any flags on the entry | To confirm attendance and produce accurate pay |
| Clock-in and clock-out photos | A photo of your face taken by the front camera when you clock in, and when you clock out if your employer asks for one, with the result of the face check | To confirm that the person clocking in is you (section 4) |
| Employment records | Documents your employer stores on your record (contracts, certificates, copies of ID) and their expiry dates, training and certifications, performance reviews, conduct and disciplinary records, checklists, expense claims and receipts, concerns you raise, and the reason and notes when you leave | To keep the staff record your employer is responsible for |
| Roster documents | Photographs or files of existing duty rosters a manager uploads | To read an existing schedule into ShiftSync |
| Sign-in and security | Your password (held by Google's sign-in service, never by us in readable form), two-step sign-in set-up and backup codes for managers, supervisors and admins, a staff PIN for site tablets (stored only as a scrambled value), and a log of who changed pay or employment status and when | To keep your account and your company's records safe |
| Device and diagnostic data | Application version, device model, operating system, a device identifier, a notification token, crash reports, and a check that the request came from the genuine app | To keep the application working, send you notifications, investigate faults, and detect two people clocking in from the same phone |
3. Location — read this section
ShiftSync uses your phone's location to confirm that you are at your place of work when you clock in or out.
- Location is taken only when you tap clock-in or clock-out. The application does not follow your position, and does not collect location while it is closed or in the background.
- The coordinates are stored, not only a yes or no. Each clock-in and clock-out keeps the latitude and longitude your phone reported at that moment, and whether it fell inside the permitted area. Two positions per shift are kept, one at the start and one at the end, and nothing in between.
- Your employer sets the permitted area. They choose the work sites and how far from one you may be, which is 150 metres unless they change it. They can exempt a person from the check; the punch is then still recorded and marked as exempt.
- Your employer can see your clock-in records, including whether a punch was made outside the permitted area.
- You can refuse the permission. Location-checked clock-in will then not work, and your employer may ask you to record attendance another way.
4. Photos and the face check — read this section too
Your employer can ask for a photo of your face when you clock in, and when you clock out. On most installations this is switched on.
- A live check happens first, on your phone. The camera asks you to do two of these: blink, turn your head, or smile. This is done entirely on your phone, by Google's on-device ML Kit, to show that a real person is in front of the camera and not a photograph. Only the final photo leaves your phone. Your employer can switch the live check off for a person.
- Your photo is compared with your record photo. After the punch, our servers compare the clock-in photo, and the clock-out photo where there is one, with the record photo your employer keeps of you. This is a one-to-one check that you are the person on your own record. It is not used to search for you anywhere else, and your face is not compared with any other database.
- What is kept. The face measurements are worked out for the comparison and then thrown away. We keep the photo, the result (matches, does not match, could not tell, or no face found) and the score behind it, with your time entry.
- A person decides. The check never stops you clocking in. A result that does not match, or could not tell, puts a flag on the entry for your manager to look at. Your manager can see the photos and the result beside your timesheet.
- If there is no record photo, nothing is compared, and the entry says the face was not checked.
If your phone asks for your fingerprint or face to unlock
Your employer can require your phone's own unlock check before a punch. That check happens entirely on your phone. Your fingerprint or face data is never sent to us; your phone only tells the application whether the check passed.
Why the device identifier matters
Every punch records which phone it came from. Besides diagnosing faults, that identifier is used to spot two different employees clocking in from the same phone within half an hour of each other. When that happens the entry is flagged for your manager. A flag on your record is not a neutral log entry, so you should know it can happen.
Site tablets and attendance terminals
Your employer may put a shared tablet at a work site, where you clock in with your staff PIN and a photo instead of your own phone. The same photo and face check apply.
Your employer may also use a fingerprint clock at the door. Your fingerprint stays on that terminal and never reaches us. ShiftSync receives only the number the terminal gives you and the time it recorded, which your manager links to your record.
Other permissions
- Camera: for the photos above, and when you photograph a roster, a receipt or a document.
- Photo library and files: only when you choose to upload a picture or a document.
- Notifications: to tell you when a schedule is published, a request is answered, or a shift is about to start.
5. What we do not do
- We do not sell your personal data.
- We do not show you advertising or share your data with advertising networks.
- We do not track your location outside a clock-in or clock-out.
- We do not hold or move your pay. Your bank or Mobile Money details are used only to prepare the payment list for your employer.
- We do not use your data to build profiles for any purpose other than running the service for your employer.
6. Who processes your data on our behalf
| Provider | What it handles | Where |
|---|---|---|
| Google Firebase | Sign-in and two-step sign-in, the database holding all the records above, file storage for photos and documents, server functions including the face check, notifications, crash reports, and the check that requests come from the genuine app | Google Cloud in the United States |
| Google Gemini | Two optional manager features only; see "Where artificial intelligence is used" below | Google's international infrastructure |
| Resend | Sending account emails, such as invitations to join and password resets: your name and email address | United States |
| OpenStreetMap (Nominatim) | Turning a typed address into map coordinates when your employer sets up a work site. Only the address text is sent, never employee data | OpenStreetMap Foundation, Europe |
This means your information is stored and processed outside Ghana, under these providers' contractual data protection terms.
Where artificial intelligence is used
Two features send data to Google's Gemini model. Both are used by a manager, not by you, and neither can change your schedule on its own: each returns a suggestion a person has to accept.
- Reading a schedule document. When a manager sets up scheduling rules, they may attach an existing schedule, often a photograph of a paper roster or a spreadsheet. That file is sent to Gemini so its contents can be read back as rules. A duty roster usually has employee names on it, so names can reach Google this way. The file is sent only to be read.
- Schedule insights. A manager can ask for plain-language observations about recent scheduling. What is sent is a summary built on our servers, limited to first names: no surnames, contact details, photographs or locations. The result is kept for a day.
We do not send photos, face check results, locations, contact details, personal details or pay figures to any AI service. The face check runs on our own servers and is not an AI service of a third party.
7. Who else can see your information
- Managers and admins at your employer can see your schedule, requests, attendance, photos and face check results, pay, personal details and employment records.
- Supervisors can see the schedule, requests and attendance of the team they supervise, and the performance reviews they take part in. They cannot see your pay, personal details, conduct records or concerns you raise.
- Colleagues in your company can see the team list (names, job titles, record photos and work contact details) and who is rostered for a shift. They cannot see your pay, personal details or employment records.
- You can see your own schedule, attendance, payslips and personal details, and keep your address, emergency contact and next of kin up to date.
- Authorities and banks, through your employer. Your employer may send your pay and tax figures to the Ghana Revenue Authority and SSNIT, and the payment list to their bank, as the law and paying you require.
Beyond that, we disclose data only where the law requires it, or where it is needed to investigate fraud or a serious breach of our terms.
8. How long we keep it
Attendance records, face check results, and pay and tax records are kept for at least six years, because they may be needed to settle a pay dispute or answer a tax audit. Schedules, requests and employment records are kept for as long as your employer uses ShiftSync and your record is on it. After those periods your employer can ask us to delete them.
Clock-in and clock-out photos are kept while you work there. Once your account is closed, they are deleted automatically after the period your employer has set, which is 12 months unless they choose otherwise (from 1 month to 10 years).
How to delete your account
Employees and supervisors ask in the application: Me, then Account settings, then Ask to delete my account. Your account is also your employer's record of your work, so asking does not delete anything straight away:
- Your manager is told at once and can approve the request after finishing your leaving steps, such as final pay.
- If nobody has approved it after 7 days, your manager is reminded.
- If nobody has approved it after 30 days, your account is closed automatically.
- Until then you can take your request back in the same place.
When your account is closed, your sign-in is deleted, your phone is unregistered, and your notifications, availability, pending leave and swap requests, and future shifts are removed. Your employer keeps the records the law requires: your name and staff ID, department and job title, hours worked, payslips, tax and SSNIT records, and your HR file, for the periods above. Your clock-in photos are deleted later, as described above.
Managers and admins delete their own account in the application under Account settings, after handing the company to another manager. Their account is deleted at once: name and contact details are removed from the profile and their clock-in photos are deleted. Past hours and shifts stay for payroll. If they are the company's only member, the whole company is deleted.
If you can no longer sign in, write to [email protected] from the email address on your account, with your company's name. We will pass the request to your employer and it follows the same steps and time limits.
9. How we protect it
- Traffic is encrypted in transit using TLS, and data is encrypted at rest by Google.
- Access rules restrict each person to their own company's data, and keep pay, personal details and concerns away from colleagues who should not see them.
- Managers, supervisors and admins must use two-step sign-in with an authenticator app.
- Changes to pay and employment status are logged with who made them and when.
- Our own administrative access is limited to the people who need it to run the service.
If a breach occurs that is likely to put your rights at risk, we will tell your employer, you and the Data Protection Commission without undue delay.
10. Your rights
You may ask for a copy of your data, and ask for it to be corrected, deleted, exported, or no longer processed in certain circumstances. Write to [email protected] and we will respond within 30 days. Where the request concerns your employment or pay record, we will work through your employer, who is responsible for it.
In Ghana you may complain to the Data Protection Commission. In the UK or EU, you may complain to your national supervisory authority.
11. Children
ShiftSync is a workplace tool and is not meant for anyone under the minimum legal working age. We do not knowingly collect data about children.
12. Changes to this policy
We will update this page and the dates above when our practices change, and tell you inside the application before a significant change takes effect.