Last updated 10 August 2026
Privacy policy
Shiftpint puts people into shifts, which means handling your name, your phone number and where you are willing to work. This explains exactly what we hold, who sees it, and how to get rid of it.
Who is responsible
Shiftpint is operated by Rivet SAAS Limited, a company registered in Ireland (CRO 819875), at 13 Castle Street, Mullingar, Co. Westmeath, Ireland. Under the GDPR we are the data controller for the personal data described here.
For anything in this policy, including a request to see or delete your data, email info@rivet.ie.
What we collect, and why we are allowed to
Every processing activity needs a lawful basis. Ours are set out below rather than summarised, so you can see which is which.
| What | Why | Lawful basis |
|---|---|---|
| Your email address | Signing you in, and telling you what happened to a shift you claimed | Performance of a contract |
| Your name, mobile number and years of experience | Shown to a venue when you claim one of its shifts, so it can decide and then reach you | Performance of a contract |
| Anything you type into a claim | Passed to that venue as part of your claim | Performance of a contract |
| Which shifts you claimed and what was decided | The record of who agreed to work where, relied on by both sides | Performance of a contract, and our legitimate interest in a usable record |
| Venue details and who manages the account | Running the venue side of the service | Performance of a contract |
| Server logs, including IP address | Keeping the service up and dealing with abuse | Legitimate interests |
We do not ask for anything the service does not need. There is no marketing list, no profiling, and no automated decision-making that produces legal effects for you: a human at the venue decides who works.
Special category data
We do not ask why a shift needs cover in terms of anybody’s health, and venues should not put that in a listing. A reason like “chef called in sick” is about the venue’s staffing, not a named person’s medical condition. Please do not enter health information about yourself or anyone else.
What the venue sees
This is the part worth reading twice. When you claim a shift, the venue that posted it sees your name, mobile number, years of experience and your note. It sees this whether or not it confirms you, because it needs it to decide.
Once your details reach a venue, that venue decides what it does with them, and for that it is an independent controller in its own right. We require venues to use your details only for the shift you claimed, but we cannot reach into their phone. If a venue misuses your details, tell us and tell the Data Protection Commission.
Other people looking for work never see who claimed a shift. Your claim is visible to you and to the venue, and to nobody else.
Who else processes it
We use a small number of suppliers to run the service. They act on our instructions under a data processing agreement, and none of them may use your data for their own purposes.
| Who | What they do | Where |
|---|---|---|
| Supabase | Database and accounts | EU (Ireland) |
| Vercel | Hosting and delivery of the site | EU region, with a US parent company |
| Resend | Sending the emails about your shifts | EU and US |
| OpenFreeMap | Map tiles on the shift board | EU |
Your data is stored in the EU. Where a supplier is US-owned or sends email through US infrastructure, transfers rely on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. We do not sell data, and we do not share it with advertisers, because we have none.
How long we keep it
| What | Kept for | Why |
|---|---|---|
| Your account and profile | Until you delete it, then removed within 30 days | You control this. Deleting the account deletes the profile behind it. |
| Shifts a venue posted | Two years after the shift date | Employment and revenue records a venue may need to produce. |
| Claims you made, and who was confirmed | Two years after the shift date | It is the record of who agreed to work where, for both sides. |
| Emails we sent you about a shift | 12 months | So a dispute about what a venue told you can be settled. |
| Server and security logs | 30 days | Investigating abuse and faults. |
Deleting your account removes your profile. It does not erase the fact that a confirmed shift happened, because the venue has its own legal reasons to keep that record — but your claim is disconnected from your account.
Cookies, and the banner you are not seeing
There is no cookie banner on Shiftpint because there is nothing to consent to. We set one kind of cookie: the session cookie that keeps you signed in. It is strictly necessary for a service you asked for, which is exactly the case that does not require consent under the ePrivacy Regulations.
Your region toggle and your saved search area are kept in your browser’s local storage. They never leave your device and never reach our servers. Clearing your browser data clears them.
We run no analytics, no advertising pixels and no third-party trackers of any kind.
Your rights
Under the GDPR you can ask us to:
- Give you a copy of everything we hold about you, in a portable format
- Correct anything wrong
- Delete your account and your personal data, subject to section 5
- Restrict or object to processing based on our legitimate interests
- Withdraw consent where we relied on it, without affecting what came before
Email info@rivet.ie. We answer within 30 days, and it is free. We will ask you to confirm you are who you say you are, which is a protection for you rather than an obstacle.
If we get it wrong, you can complain to the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland. You can do that without going through us first. If you are in the UK, you may instead complain to the Information Commissioner’s Office.
Keeping it safe
Everything travels over HTTPS. Passwords do not exist here: signing in uses a one-time code sent to your email, so there is no password of yours for us to leak. Access to the database is restricted, and one venue cannot read another venue’s applicants — that separation is enforced by the database itself, not only by the app.
If a breach ever puts your rights at risk, we will tell the Data Protection Commission within 72 hours and tell you without undue delay.
Children
Shiftpint is for people who can lawfully work in a licensed premises. You must be at least 18 to use it. We do not knowingly collect data about children, and we delete it if we discover we have.
Changes
If we change how we use your data in a way that affects you, we will email you before it takes effect, not after. Minor corrections are made here with the date at the top updated.