Privacy Policy

MyShiftGenius ("MyShiftGenius," "we," "us," or "our") is a franchise scheduling software product operated by FranReal LLC. This Privacy Policy explains what information we collect when you use our website at myshiftgenius.com and our mobile applications (the "Service"), how we use that information, and the choices you have about it.

2.1 Account information

When a franchise owner or operator creates an account, we collect: name, email address, password (stored hashed, never in plain text), and the brand or business name they enter at signup.

2.2 Business and operational information

To generate schedules, the Service stores information you and your managers add, including: business locations (address, city, state, store hours, manager name), employee records (name, role, management tier, hourly availability, days off, requested hours, optionally phone or email if provided), shift templates, scheduling rules, generated schedules, time-off requests, and shift swap history.

2.3 Employee personal information

Employees added by an account owner or invited to the mobile app may provide their own availability, time-off requests, and shift preferences. Employees who are minors are flagged so the Service can apply applicable labor restrictions automatically.

2.4 Payment information

Subscription billing is processed by Stripe, Inc. We do not store full payment card numbers. We store only the last four digits and card brand for your reference, along with a Stripe customer identifier.

2.5 Technical and usage information

We automatically collect basic technical information when you use the Service: IP address, browser type and version, device type, operating system, pages viewed, actions taken in the app, and timestamps. We use this for security, debugging, and improving the product.

2.6 Cookies and similar technologies

We use a small number of cookies and local browser storage to keep you signed in, remember your preferences, and analyze how the Service is used. You can control cookies through your browser settings; disabling them may prevent you from using certain features.

2.7 Mobile push notifications

If you install our mobile app and grant permission, we may send push notifications about your schedule, shift swap requests, and time-off responses. You can disable push notifications in your device settings at any time.

We use the information we collect to:

• Provide, operate, maintain, and improve the Service
• Generate compliant employee schedules using artificial intelligence based on your rules, employee availability, and applicable labor laws
• Process subscription payments and send billing-related notifications
• Send transactional email and notifications: account confirmation, password reset, schedule-ready alerts, shift swap requests, and time-off responses
• Authenticate users and prevent unauthorized access
• Diagnose technical issues, prevent fraud, and enforce our Terms of Service
• Comply with legal obligations

We do not use your information or your employees' information to train third-party advertising models. We do not sell personal information.

We share information only with the service providers we need to operate the Service, and only to the extent necessary. These providers are contractually required to protect your information and use it only for the purposes we direct.

• Supabase, Inc. — database hosting, authentication, and file storage.
• Vercel, Inc. — website and application hosting.
• Stripe, Inc. — payment processing, subscription billing, and invoicing. Stripe's privacy policy is available at stripe.com/privacy.
• Amazon Web Services (Amazon SES) — transactional email delivery.
• Anthropic, PBC — AI processing of your scheduling rules, employee availability, and location information to generate optimized schedules. Anthropic does not use this data to train its models when accessed through its business API.
• Apple, Inc. and Google LLC — mobile app distribution and push notification delivery if you use the iOS or Android apps.

We may also share information when required by law, in response to valid legal process, or to protect the rights, property, or safety of MyShiftGenius, our users, or others. If MyShiftGenius or its parent company is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction; we will notify you before your information becomes subject to a different privacy policy.

We retain your account information and operational data for as long as your account is active. If you cancel your subscription, we retain your data for 90 days in case you choose to reactivate, then we delete it. You may request earlier deletion at any time by contacting support@myshiftgenius.com. Backup copies are purged within 30 days of deletion.

We retain billing records for the period required by applicable tax and accounting laws, typically seven years.

You have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate information.
• Deletion — request that we delete your information, subject to legal retention requirements.
• Export — receive your data in a machine-readable format.
• Opt out of marketing — although we do not currently send marketing email, you can unsubscribe from any communication at any time.

To exercise any of these rights, email support@myshiftgenius.com. We respond within 30 days.

6.1 California residents

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the rights described above plus the right to know what categories of personal information we collect and the right not to be discriminated against for exercising any of these rights. We do not sell or share personal information for cross-context behavioral advertising.

6.2 European and UK residents

Under the GDPR and UK GDPR, individuals in the European Economic Area, the United Kingdom, and Switzerland have the rights described above plus the right to lodge a complaint with a supervisory authority. Our legal basis for processing is the performance of a contract (operating the Service), our legitimate interests (security, fraud prevention, product improvement), or your consent (push notifications).

The Service is intended for use by businesses, not directly by children. Account owners and managers may add records for employees who are minors (typically aged 14–17 in the United States) so the Service can apply legally required labor restrictions to their schedules.

We do not knowingly collect personal information from anyone under the age of 13. If you believe we have inadvertently collected information from a child under 13, please contact support@myshiftgenius.com and we will delete it.

We protect your information using industry-standard practices: TLS encryption for all data in transit, encryption at rest in our database, role-based access controls, row-level security on multi-tenant data, and regular security reviews. Stripe handles all payment card data under PCI-DSS Level 1 certification.

No system is perfectly secure. If we become aware of a security incident affecting your information, we will notify affected users and applicable regulators as required by law.

MyShiftGenius is operated from the United States and our service providers are primarily located in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through an in-app notice at least 30 days before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was most recently revised.

Questions, concerns, or requests about this Privacy Policy or your personal information should be sent to:

MyShiftGenius
FranReal LLC
support@myshiftgenius.com