Privacy Policy

1. Data Controller

Shifts-Table is an application developed and operated by Kanatzu Dev, a trade name used by Ignacio Camballo, an independent developer based in Spain.

• Controller: Ignacio Camballo — Kanatzu Dev
• Adress: Anzofé 79, Las Palmas de Gran Canaria, Spain
• Email: support@kanatzu.dev
• Website: kanatzu.dev/Shifts-Table
• Phone: +34 672 517 360

In this Privacy Policy, "Kanatzu Dev", "Shifts-Table", "we" or "our" refer to the data controller identified above.

This Policy explains what information Shifts-Table may process, what it is used for, how it is stored, who it may be shared with, and what rights users have.

2. Information We Collect

The amount and nature of the data processed depends on how you use the app.

2.1 Use Without an Account

Shifts-Table can be used without creating an account.

When you use the app without an account, the data you enter is stored locally on your device and is not synced to our servers.

This data may include:

• Shifts and working days.
• Dates and schedules.
• Breaks.
• Employers.
• Hourly rates.
• Fixed amounts for certain shifts.
• Payment status of shifts.
• App settings.
• Notes entered by the user.

If you later decide to create an account and use sync, the data you choose to sync may be transferred to our servers and associated with your account.

2.2 User Account

To create an account and use sync features, we collect:

• Email address.
• Username chosen by the user.
• A password.

Passwords are never stored in plain text. They are stored on our server using a hashing process with bcrypt.

We use this data mainly to:

• Create and manage your account.
• Authenticate you.
• Recover or change your password.
• Identify your account.
• Associate your synced data with your account.
• Keep your session active and allow access from other devices.

2.3 Work Data

If you use the sync features, we may store on our servers the data you enter into the app, including:

• Information about your employers.
• Employer names and abbreviations.
• Colors assigned to employers.
• Hourly rates.
• Shifts and dates worked.
• Start and end times.
• Break periods.
• Calculated or fixed amount for a shift.
• Payment status.
• Settings related to your data.
• Notes freely entered by you.

Notes are free-text fields. We do not recommend entering passwords, sensitive financial information, medical information, special categories of personal data, or personal information about third parties that is not necessary to use the app.

2.4 Usage and Diagnostic Data

Shifts-Table uses Google Firebase services to understand app usage and detect technical issues.

We use:

• Firebase Analytics / Google Analytics for Firebase, to obtain statistical and technical information about app usage, understand which features are used, and improve the experience.
• Firebase Crashlytics, to detect and diagnose errors and unexpected app crashes.

We do not configure custom Analytics events to send Google information entered in your shifts, employers, notes, wages, or credentials.

Crashlytics is used for technical error-related information, and we do not configure custom fields to send your name, email, shifts, employers, notes, or wages.

Firebase and Google may process certain technical, device, usage, and diagnostic data in accordance with their own services and policies.

Collection of technical information by these services may also occur when you do not have a Shifts-Table account.

2.5 Advertising

Shifts-Table uses Google AdMob to display advertising.

We currently request non-personalized ads.

Non-personalized ads are not selected based on the user's behavioral history. However, Google states that certain identifiers or other mechanisms may be used for functions such as frequency capping and aggregated reporting when non-personalized ads are shown.

Advertising and related data are also subject to Google's own policies and terms.

We do not use your shift, employer, note, wage, or account data to build advertising profiles.

We do not sell your personal data to advertisers.

2.6 Payments and Premium Subscription

Shifts-Table offers an annual Premium subscription.

Payments are processed through Stripe via a Stripe checkout.

We do not store on our servers:

• Card numbers.
• Card security codes.
• Full banking details.
• Payment credentials.

Our server may store an identifier related to the transaction or subscription, needed to verify and manage Premium status.

The information required to process payment is handled by Stripe in accordance with its own policies and terms.

2.7 Exported Files

When you use the schedule export feature to PDF or image, the file is generated locally on your device.

The file is not stored on our servers.

The file is kept temporarily on the device during the export process and is subsequently removed in accordance with how the system and app operate.

The app may use the standard Android or iOS sharing functions so you can send or save the file using other apps installed on your device.

Once you share the file with another app or service, any further processing is subject to that service's own privacy policy.

3. Sync and Storage

Shifts-Table offers two main sync modes.

Free Users

Users with a free account can manually sync their data with our servers using the sync feature available in the app, subject to the limit set by the app.

Premium Users

Premium users have automatic sync. Changes made in the app may be stored both locally and on our servers.

Synced data is associated with the corresponding account identifier.

A user can only access data associated with their own account.

4. Infrastructure and Storage

Synced data is stored on infrastructure under our control, hosted on a private server located in France, within the European Economic Area.

The database used to store the data is not directly exposed to the Internet. It can only be accessed internally, from the application server itself.

Communications between the app and our server use HTTPS.

Passwords are stored using bcrypt hashing and are never stored in plain text.

5. Providers and Third Parties

We may use service providers to deliver certain Shifts-Table features. These providers may process certain data on our behalf, or as independent controllers depending on the nature of the service.

These include:

• Our infrastructure and server hosting provider.
• Google Firebase, for Analytics and Crashlytics.
• Google AdMob, for delivering advertising.
• Stripe, for payment processing and managing the Premium subscription.

We do not sell or rent our users' personal data.

Data is only shared with or made accessible to third parties when necessary to provide the services described in this Policy, when there is a legal obligation to do so, or when necessary to protect our rights or the security of the service.

6. International Transfers

Our main server is located in France, within the European Economic Area.

However, some of the external providers used by Shifts-Table, particularly Google and Stripe, may carry out international data processing or transfers in accordance with their own services.

When international transfers of personal data occur, we will seek to carry them out using the mechanisms and safeguards recognized under applicable law, such as adequacy decisions, standard contractual clauses, or other legally valid safeguards.

External providers may have their own policies regarding international transfers and data processing.

7. Purposes and Legal Bases

We process personal data for the following purposes:

Provision of the Service

We use the data necessary to create and manage your account, authenticate you, sync your data, and provide Shifts-Table's features.

The legal basis is the performance of the contract or of pre-contractual measures requested by the user.

Security and Operation

We process certain technical and diagnostic data to maintain the security, stability, and operation of the app and to detect errors.

The legal basis may be our legitimate interest in maintaining and improving the security and operation of the service, to the extent permitted by applicable law.

Analytics

We use Firebase Analytics to obtain statistical information about app usage and to improve its features and experience.

Processing will be carried out on the legal basis applicable under relevant law and the configuration of the services used.

Advertising

We use Google AdMob to display non-personalized ads and help fund part of the service.

Where applicable law requires consent for certain processing related to advertising, local storage, or advertising identifiers, such consent will be managed through the corresponding mechanisms.

Payments

We process the subscription or transaction identifiers necessary to manage Premium and verify subscription status.

This processing is necessary to perform the contract associated with the purchase.

Account-Related Communications

We may send emails related to:

• Account creation.
• Password recovery.
• Password changes.
• Account deletion.
• Account operation or security.

These communications are necessary to provide and maintain the service.

We do not use these communications to send unsolicited advertising.

8. Data Retention

While an account remains active, we will retain the data necessary to provide the features associated with it.

We do not currently apply an automatic deletion period for inactivity.

When you delete your account, we delete from our servers the information associated with it, including account data, synced data, shifts, employers, notes, settings, and associated identifiers that we store.

We do not keep separate backups of our database intended to retain this data after account deletion.

External providers may retain certain data for the periods established in their own policies and legal obligations.

9. Account Deletion

You can delete your account from within the app.

Deleting your account results in the deletion of the associated data stored on our servers.

Data that remains only on your device and has not been synced with our servers cannot be recovered by us.

Deleting the app from your device does not necessarily mean your account is deleted. If you have an account, use the account deletion feature available in the app or contact us.

10. User Rights

Where applicable under the GDPR and other data protection laws, you may exercise the following rights:

• Right of access to your personal data.
• Right to rectification of inaccurate data.
• Right to erasure.
• Right to request restriction of processing.
• Right to object to certain processing.
• Right to data portability, where applicable.
• Right to withdraw consent where processing is based on consent.

To exercise these rights, you can contact: support@kanatzu.dev

We may request reasonable information to verify your identity before addressing certain requests.

We will try to respond to requests within the timeframes established by applicable law.

You also have the right to lodge a complaint with a data protection authority. In Spain, you can contact the Spanish Data Protection Agency (AEPD).

11. Security

We apply reasonable technical and organizational measures designed to protect data against unauthorized access, loss, alteration, or disclosure.

Measures used include:

• HTTPS communication.
• Password storage using bcrypt hashing.
• Separation of the database from direct Internet access.
• Association of synced data with account identifiers.
• Restricting each user's access to their own account data.

No electronic transmission or storage system can guarantee absolute security.

12. Children's Privacy

Shifts-Table is not specifically directed at children and has not been designed as a children's app.

The app may be available to users of different ages, and app stores may assign their own age ratings.

We do not knowingly collect personal information from minors for purposes other than providing the service.

If a parent or guardian believes a minor has provided us with personal data that should be deleted, they can contact us at support@kanatzu.dev.

13. Sensitive Data

Shifts-Table does not knowingly request special categories of personal data such as medical, biometric, or genetic information, political opinions, religion, or sexual orientation.

However, shift notes are free-text fields. Users are responsible for the content they enter in them.

We recommend not entering sensitive or unnecessary information, especially information belonging to third parties.

14. Changes to This Policy

We may update this Privacy Policy when the app, the services used, applicable law, or our processing practices change.

When material changes occur, we will update the "Last updated" date and, where appropriate, provide additional information within the app or through other means.

We recommend reviewing this Policy periodically.

15. Contact

If you have questions about this Policy, about the processing of your data, or wish to exercise your rights, you can contact:

Kanatzu Dev — Ignacio Camballo
Address: Anzofé 79, Las Palmas de Gran Canaria, Spain
Email: support@kanatzu.dev
Website: kanatzu.dev/Shifts-Table