Legal
Privacy Policy
This Privacy Policy explains how ShiftFill (“ShiftFill”, “we”, “us” or “our”) handles personal information through our website, manager application, Deputy integration and support channels.
Where the Privacy Act 1988 (Cth), the Australian Privacy Principles or another privacy law applies to us, we will handle personal information in accordance with that law. Organisations using ShiftFill remain responsible for their own workforce, employment and privacy obligations.
What we collect
Depending on how ShiftFill is used, we may collect and hold:
- Account and organisation details: manager name, work email, email-verification status, workspace membership and role, invitations, Deputy organisation and connection details, and account activity.
- Workforce and roster data: team member name, work email, Deputy identifier, role, location, availability, leave, training or qualification status, rostered hours, open shifts and assignments.
- ShiftFill activity: open-shift settings, results of staff checks, offer status, responses, manager actions, preview activity and history records.
- Billing information: selected plan, monthly fill allowance and usage, Stripe customer and subscription identifiers, subscription status and billing period. Payment card details are collected and handled by Stripe; ShiftFill does not store complete card numbers.
- Technical information: sign-in and security information, IP address, browser or device details, system logs, errors and records of connected services communicating with ShiftFill.
- Enquiry information: name, email address, organisation and message submitted through our contact form.
Please do not provide health records, identity documents or other sensitive information unless it is necessary, lawful and authorised for ShiftFill.
How we collect information
We collect information directly from users, from an organisation’s authorised administrators, from Deputy after an authorised connection, and automatically when our website, manager service or connected services communicate with ShiftFill. If required information is not provided, some features may not work.
Why we use it
We use personal information where reasonably necessary to:
- connect and maintain an authorised Deputy integration;
- find shifts that are Open and Published and check current availability, training, existing shifts, rest and rostered hours;
- preview or carry out an authorised open-shift follow-up process and record what happened;
- authenticate users, secure ShiftFill, investigate errors and prevent abuse;
- measure successful fills, apply free or paid allowances, administer subscriptions and send usage or payment notices;
- provide support, respond to enquiries and administer customer relationships; and
- meet legal obligations and enforce our agreements.
Workforce data
We generally handle workforce data for an organisation that connected its Deputy account. It decides which records and rules are used and is responsible for giving required privacy notices, obtaining any required authority, keeping Deputy records accurate and using ShiftFill lawfully.
Team members should usually ask their employer or engaging organisation to correct a workforce record. We will reasonably assist that organisation with an access, correction or deletion request where applicable.
Who we disclose information to
We may disclose information only where reasonably necessary to:
- a customer and its authorised users;
- Deputy, where needed to maintain an integration or carry out an authorised action;
- providers that support application hosting, database hosting, website hosting, payment processing, security, bot protection, logging, support and email delivery;
- professional advisers, insurers or a prospective purchaser of our business under appropriate confidentiality controls; or
- regulators, courts, law enforcement or other parties where required or authorised by law, or where reasonably necessary to protect rights, safety or security.
Our website and public account registration use Cloudflare Turnstile to reduce abuse. We use Resend to deliver enquiries and account, invitation or usage emails, and Stripe to provide checkout, subscription and billing-management services. ShiftFill does not sell personal information or use workforce data for targeted advertising.
Overseas processing
Some service providers operate global infrastructure, so personal information may be processed or stored outside Australia, including in the United States and other countries where those providers operate. Location can vary with provider configuration. Where applicable, we take reasonable steps required by law in relation to overseas disclosures.
Cookies and similar technology
Our manager service uses cookies that are necessary for secure sign-in, workspace selection and Deputy connection. Cloudflare Turnstile may use technical signals or cookies to distinguish legitimate users from abuse. Our public website does not currently use advertising cookies.
Security
We use reasonable technical and organisational safeguards appropriate to information we handle. These include access controls, encrypted storage of Deputy connection credentials, protected settings, secure sign-in controls, checks on information sent to ShiftFill and limits designed to prevent abuse. No internet service can be guaranteed completely secure.
Retention and deletion
We retain information only for as long as reasonably necessary to provide ShiftFill, maintain security and audit records, resolve disputes and comply with law. When information is no longer required, we take reasonable steps to delete or de-identify it, subject to lawful retention requirements and normal backup cycles.
Stopping a Deputy connection prevents future authorised access once it is disabled, but does not necessarily delete existing account, audit or legal records. A customer can request account closure or deletion through our contact form.
Access, correction and complaints
You may ask to access or correct personal information we hold about you, or make a privacy complaint, through our contact form. We may need to verify your identity and, for workforce data, coordinate with a relevant customer organisation. We will consider your request and respond within a reasonable time in accordance with applicable law.
Data incidents
We assess suspected data incidents and, where required by applicable law, notify affected individuals and regulators.
Changes to this policy
We may update this policy when our service or legal obligations change. A revised version will be published here with a new “Last updated” date. We will provide additional notice where a change is material and applicable law requires it.
Contact
Privacy questions and requests can be sent through our contact form.