Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how AVERCYN GLOBAL INC ("ShiftKumo", "we", "us" or "our") collects, uses, shares and protects personal information when you visit shiftkumo.com, start a free trial or subscription, use the ShiftKumo app, or contact us. It also explains your choices and rights.

Terms with capital letters that are not defined here, such as "Service", "Customer" and "Customer Data", have the meanings given in our Terms of Service.

2. Our role: controller and processor

• Where we are the controller. We decide how and why we process account data, billing data, website data and support correspondence. This policy describes that processing.
• Where we are the processor (service provider). Our customers are the businesses that subscribe to ShiftKumo. They enter information about their staff into their workspaces, such as names, contact details, availability, shifts, clock-in times and hourly rates. The customer is the controller of that workspace data. We process it on the customer's behalf and on its instructions, as set out in our Terms of Service. How the customer uses its employees' information is governed by the customer's own privacy notice.

If your employer uses ShiftKumo and you want to access, correct or delete your information, please contact your employer first. If you contact us instead, we will pass your request to your employer and help them respond.

3. Personal information we collect

Full card numbers are collected and processed by our PCI DSS Level 1 certified payment processor. ShiftKumo never stores full card numbers. We do not ask for sensitive information such as health data, and we ask customers not to enter it into the Service unless they have a lawful basis and it is necessary.

4. Where we get personal information

• From you: when you start a trial, buy a subscription, set up your account, use the Service or contact us.
• From the customer you work for: when a manager adds you to a workspace, assigns you shifts or records your hours.
• From our payment processor: limited card details (card brand, last 4 digits, expiry date and billing country) and the status of each payment.
• Automatically: technical data that your browser or device sends when you use the website or app.

5. How we use personal information, and our legal bases

The table below lists each purpose and, for people in the European Economic Area (EEA) and the United Kingdom, the legal basis we rely on.

If we ever rely on your consent, we will ask for it clearly, and you can withdraw it at any time. We do not use personal information for advertising, and we do not build profiles to target you. The auto-schedule feature creates draft schedules that the customer's managers review before publishing. ShiftKumo does not make decisions about individuals that have legal or similarly significant effects.

Service e-mails are essential to your account, so you receive them for as long as you have one. E-mails to staff about schedules are sent on the customer's instructions.

6. How we share personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose it only as follows:

• Service providers (sub-processors). We use providers for cloud hosting, payment processing, transactional e-mail and customer support tooling. All of them work under contract, may use personal information only to provide services to us, and must protect it. A current list of sub-processors is available on request.
• Within your workspace. People in a workspace can see information according to the roles and permissions the customer sets. For example, staff see published schedules, and managers see availability and timesheets.
• For legal reasons and safety. We disclose information when the law, a court order or a competent authority requires it, or when it is necessary to protect the rights, property or safety of our customers, the public or ShiftKumo, including to prevent fraud.
• Business transfers. If we are involved in a merger, an acquisition or a sale of assets, personal information may transfer to the successor. The successor remains bound by this policy, and we will notify you.
• Professional advisers. We may share information with lawyers, accountants and auditors who are bound by confidentiality.
• With your consent. We also share information when you ask us to.

7. International data transfers

We serve customers worldwide, and we and our service providers may process personal information in countries other than the one you live in. Those countries may have different data protection laws. When we transfer personal information out of the EEA, the United Kingdom or another region that restricts transfers, we protect it with Standard Contractual Clauses (including the UK Addendum where relevant) or an equivalent safeguard, such as an adequacy decision. For transfers from Japan, we make sure the recipients take measures equivalent to those the Act on the Protection of Personal Information requires. To learn more or get a copy of the relevant safeguards, contact us.

8. How long we keep personal information

We may keep aggregated information that no longer identifies anyone. If the law requires us to keep information longer, or we need it to establish or defend a legal claim, we keep it only as long as that purpose requires.

9. How we protect personal information

• Data is encrypted in transit with TLS 1.2 or higher and encrypted at rest with AES-256.
• We make daily encrypted backups.
• Role-based access controls apply in the Service, and our staff have least-privilege access, limited to what their role requires.
• Payments are handled by a PCI DSS Level 1 certified payment processor, and we never store full card numbers.
• Our service providers are bound by contract to protect personal information.

No method of transmission or storage is completely secure. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires. You can help by keeping your sign-in details private and telling us about any suspicious activity.

10. Your privacy rights and how to use them

Your rights depend on where you live. Sections 11 to 13 describe them by region. Whatever your location, you can make a request as follows:

• How to ask: e-mail support@shiftkumo.com, ideally from your account e-mail address, with the subject "Privacy request". Tell us which right you want to use. For requests to opt out of the sale or sharing of personal information, use the subject "Do Not Sell or Share" (see our Do Not Sell or Share page).
• Verification: for requests to access, know, delete or correct personal information, we verify your identity before acting, usually by confirming that you control the account e-mail address. Requests to opt out of sale or sharing, or to limit the use of sensitive personal information, do not require verification. We use the information you give us for verification only for that purpose.
• Authorized agents: someone can make a request for you if they have your signed, written permission. For requests to know, delete or correct, we may still ask you to confirm your identity directly with us.
• Response time: we reply within 30 days. Requests to opt out of sale or sharing, or to limit the use of sensitive personal information, are acted on within 15 business days.
• Cost: we do not charge for requests, unless the law allows a reasonable fee for requests that are manifestly unfounded or excessive.
• Workspace data: requests about information that an employer has entered into ShiftKumo should go to that employer, as the controller. We will help them respond.

11. Rights in the European Economic Area and the United Kingdom

Under the GDPR and the UK GDPR, you have the right to:

• access your personal information and get a copy of it;
• correct information that is inaccurate or incomplete;
• delete your information (the "right to be forgotten");
• data portability, which means receiving your information in a structured, machine-readable format;
• restrict our processing in certain circumstances;
• object to processing based on our legitimate interests; and
• withdraw consent at any time where we rely on it. This does not affect processing that took place before you withdrew it.

You can also complain to a data protection supervisory authority, especially in the country where you live or work or where you believe an infringement occurred. In the United Kingdom, that is the Information Commissioner's Office. We would appreciate the chance to address your concern first.

12. Rights in the United States, including California

Categories of personal information (last 12 months)

This section serves as our notice at collection for California residents. In the last 12 months, we have collected the categories of personal information below. We collected them from the sources in Section 4, for the purposes in Section 5, and we keep them for the periods in Section 8.

Your California rights

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), California residents have the right to:

• know and access the personal information we have collected about them, including the categories, sources, purposes and recipients;
• delete personal information we have collected from them;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information;
• limit the use and disclosure of sensitive personal information; and
• not be discriminated against for using any of these rights. We will not deny you the Service, charge you a different price or give you a different quality of service because you made a request.

We do not sell or share personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done either in the preceding 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16. We use sensitive personal information only for purposes the CCPA regulations permit, such as providing the Service and keeping it secure, so you do not need to take any action to limit it. For more information, see Do Not Sell or Share My Personal Information.

Making a request

Follow the steps in Section 10. Authorized agents may submit requests on your behalf. We act on opt-out and limit requests within 15 business days, and reply to other requests within 30 days, which is within the 45-day period the CCPA allows. We do not disclose personal information to third parties for their own direct marketing purposes, as described in California's "Shine the Light" law.

Other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with comprehensive privacy laws have similar rights. Where those laws apply to us, they generally include the rights to access, correct, delete and obtain a copy of personal information, and to opt out of targeted advertising, sale and certain kinds of profiling. We do not engage in targeted advertising, sale of personal information or profiling that produces legal or similarly significant effects. To make a request, follow the steps in Section 10. If we decline your request, you can appeal by replying to our decision with the subject "Privacy appeal". We will respond within the time your state's law requires, and if you disagree with the outcome, you may contact your state attorney general.

13. Rights in Japan (APPI)

For users in Japan, we handle personal information in accordance with the Act on the Protection of Personal Information (APPI).

• Purposes of use. We use personal information for the purposes described in Section 5. We will not use it beyond those purposes without your consent, unless the law permits it.
• Provision to third parties. We do not provide personal data to third parties without your consent, unless the law permits it. When we entrust handling to service providers within the scope needed to achieve our purposes, that is not provision to a third party. We supervise those providers appropriately.
• Transfers to foreign countries. AVERCYN GLOBAL INC is located in the United States (Colorado), and we handle the personal information of users in Japan in the United States. Some of our service providers may also be located outside Japan. We require by contract that they take measures equivalent to those the APPI requires. On request, we will tell you about these measures and about the personal information protection system of the relevant countries.
• Security control measures. Our measures fall into four groups. Organizational: clear responsibility for data protection and internal rules for handling data. Personnel: confidentiality obligations for staff. Physical: our data is hosted in the secured data centers of our cloud hosting provider. Technical: encryption in transit and at rest, role-based access and least-privilege access.
• External environment. We handle personal data in the United States and take these measures with an understanding of US federal and Colorado privacy law.
• Your requests. You can ask us to disclose the retained personal data we hold about you, including records of any provision to third parties. You can also ask us to correct, add to or delete it, to suspend its use or erase it, or to stop providing it to third parties. Send your request as described in Section 10. We respond without delay, and within 30 days.
• Business operator and inquiries. The business operator handling your personal information is AVERCYN GLOBAL INC. Our address is shown in the Contact us section below, and the name of our representative is available on request. Please send complaints and inquiries about how we handle personal information to support@shiftkumo.com.

14. Global Privacy Control and Do Not Track

We honor the Global Privacy Control (GPC). When your browser sends a GPC signal, we treat it as a valid request to opt out of the sale and sharing of personal information. The request covers that browser and any account we can associate with it. We already do not sell or share personal information, so the website and the Service work the same way for you either way. We also do not track you across other websites, which means Do Not Track signals do not change how our website works.

15. Children's privacy

ShiftKumo is not directed to children under 16, and we do not knowingly collect personal information from children under 16 through our website or sign-up process. Purchasers must be 18 or older. If you believe a child has given us personal information, contact us and we will delete it. Some customers employ minors where the law allows and add them to a workspace. In that case, the customer is responsible as controller for giving the required notices and obtaining any required consents, including parental consent.

16. Cookies and local storage

Our marketing website stores only three strictly necessary preferences in your browser's local storage: sk_lang, sk_currency and sk_notice. The ShiftKumo app uses a strictly necessary session cookie and a security (CSRF) cookie. On the secure checkout page, our payment processor sets its own strictly necessary fraud-prevention cookies. We use no advertising or analytics cookies, and our fonts are self-hosted. See our Cookie Policy for details.

17. Changes to this policy

We may update this policy to reflect changes to the Service, our practices or the law. When we do, we will post the new version on this page and update the "Last updated" date. If a change is material, we will also notify account holders by e-mail before it takes effect.

18. Contact us

For privacy questions or requests, e-mail support@shiftkumo.com with the subject "Privacy request" (for opt-outs of sale or sharing, use "Do Not Sell or Share"). We give a first reply within 1 business day, and we respond fully within 30 days (opt-out and limit requests are acted on within 15 business days). You can also use our contact page.