Privacy Policy

1. Introduction

Welcome to 48shift. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform. Please read it carefully. If you do not agree with this policy, please do not use our services.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you voluntarily provide when you:

• Create an account (email, name, password)
• Complete your profile (avatar, location, bio, phone number)
• Post marketplace listings, job listings, or items for sale
• Participate in video groups, chat rooms, or direct messages
• Scan receipts and track expenses
• Make purchases or process payments
• Contact our support team

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent, clicks, and navigation paths
• Device Information: IP address, browser type, operating system, device identifiers, screen resolution
• Location Data: Approximate location from IP address (for marketplace proximity features)
• Cookies & Similar Technologies: See our Cookie Policy section below

2.3 Information from Third Parties

• Payment processors (Stripe, PayPal) for transaction data
• Authentication providers if you sign in via OAuth
• Analytics providers (for aggregate usage statistics)

3. How We Use Your Information

We use your information to:

• Provide & Improve Services: Operate the platform, personalize your experience, develop new features
• Account Management: Create accounts, authenticate users, manage subscriptions
• Marketplace Operations: Facilitate transactions, connect buyers/sellers, process payments
• Communications: Send notifications, license reminders, order updates, security alerts, marketing (with consent)
• Safety & Security: Detect fraud, enforce terms, prevent abuse, comply with legal obligations
• Analytics: Understand usage patterns, improve performance, optimize features
• Legal Compliance: Respond to legal requests, protect rights, prevent harm

4. Data Sharing & Visibility

4.1 Publicly Visible Information

The following may be visible to other users:

• Display name and avatar on listings, chats, and video groups
• Marketplace listings include your general location (city/area) for proximity search
• Messages in public or group chats are visible to participants
• Ratings and reviews you give or receive

4.2 Private Information (Not Shared Publicly)

• Email address, phone number, exact address
• Payment details (handled by payment processors)
• Private direct messages
• Receipt scans, expense data, license tracking data
• Account credentials and security settings

4.3 Third-Party Service Providers

We share data only with trusted service providers who perform services on our behalf:

• Payment Processors: Stripe, PayPal (payment data only)
• Cloud Infrastructure: Base44, Vercel, AWS (hosting and data storage)
• Analytics: Aggregated, anonymized usage data
• Email/Notifications: Transactional emails only

These providers are contractually bound to protect your data and use it only for specified purposes.

5. Cookies & Tracking Technologies

5.1 Types of Cookies We Use

• Essential Cookies: Required for authentication, security, and core functionality
• Preference Cookies: Remember your settings (theme, language, filters)
• Analytics Cookies: Help us understand how visitors interact with the platform

5.2 Your Cookie Choices

You can control cookies through your browser settings. Disabling essential cookies may break core functionality. We do not currently respond to "Do Not Track" signals.

6. Data Security

We implement industry-standard security measures:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Secure password hashing (bcrypt/argon2)
• Regular security assessments and penetration testing
• Access controls and principle of least privilege
• Payment data tokenized via PCI-DSS compliant processors

No method of transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

• Account Data: Retained while your account is active
• Transaction Records: Retained for 7 years for legal/tax compliance
• Chat/Message History: Retained while account is active
• Analytics Data: Aggregated data retained indefinitely; raw logs purged after 90 days
• Deleted Accounts: Data purged within 30 days of deletion request (except legal holds)

8. Your Rights & Choices

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to processing for direct marketing or legitimate interests
• Withdraw Consent: Where processing is based on consent

To exercise these rights, visit Settings → Account or contact us via our Contact page. We respond within 30 days.

9. Children's Privacy

Our services are not directed to children under 13 (or 16 in some jurisdictions). We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

10. International Data Transfers

Your data may be processed in countries other than your own (including the United States). Where required by law, we ensure adequate protection through Standard Contractual Clauses or other approved mechanisms.

11. License Management Disclaimer

48shift is a license management and organizational tool. We have no control over the renewal of your expired licenses, subscriptions, or certificates. All renewal actions are your sole responsibility. Our platform provides reminders and organizational tools only—we do not automatically renew licenses unless you explicitly configure and authorize such actions through third-party providers.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights:

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to opt-out of the sale of personal information
• Right to non-discrimination for exercising privacy rights

We do not "sell" personal information as defined by CCPA.

13. European Users (GDPR)

If you are in the EEA/UK, your data controller is 48shift. Our lawful bases for processing include:

• Contract performance (providing services)
• Legal obligations (tax, anti-fraud)
• Legitimate interests (security, analytics, improvement)
• Consent (marketing, optional features)

You may lodge a complaint with your supervisory authority.

14. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be announced via email or in-app notification. Continued use after the effective date constitutes acceptance.

Previous versions available upon request.

15. Contact Us

Questions, concerns, or requests regarding this Privacy Policy?
Email: privacy@48shift.com
Form: Contact Page
Address: 48shift Privacy Team, [Your Business Address]