Privacy Policy

Your name and email address, your sign-in identity and second-factor enrollment, the workspace you belong to and your role in it. Admins give us the email addresses of the people they invite.

Records of what members and API keys do: deploys, runs, changes to triggers, secrets and connections, and support views of your workspace. Sessions are stored as a hash of the session token, and API keys as a hash of the key.

IP addresses and request details, used for rate limiting and security and kept in short-lived operational logs.

For paid plans: your plan, billing period, usage and the identifiers our payment processor gives us. Card details and billing addresses are collected and held by the payment processor; we never see or store full card numbers.

What you send when you email us.

Signing you in, running your workflows, showing your workspace's runs, logs and usage, and enforcing plan limits. This is necessary to perform our contract with you.

Detecting and stopping abuse, such as attacks on other services sent from workflows, and protecting accounts. Automated checks run every hour. This is our legitimate interest, and yours.

Charging for paid plans and keeping the records tax and accounting law requires.

Service, security and billing notices, and answers when you contact us. We don't send marketing email without your consent.

Measuring performance, such as how long runs take to start, in aggregate.

We don't sell or share personal information for advertising, and this site loads no third-party trackers.

Cloud hosting and compute, which runs the service and stores workspace data; identity and sign-in; storage for run logs and telemetry; payment processing; and email delivery. Each may use the information only to provide its service to us. For the named list, email privacy@shiftlabs.org.

Support staff can open a read-only view of a workspace to help or to investigate abuse. Webhook payloads stay out of that view, and every view is recorded in the workspace's audit log.

We disclose information when the law requires it, or to protect the rights, property or safety of our users, the public or us.

If shiftlabs is sold or merged, information may transfer to the new owner, who must honor this policy.

Workspace data is processed and stored in the United States. Runs execute in US regions only.

14 days, then erased. Re-running an older run is refused.

14 days.

30 days.

90 days.

Until sign-out, 30 days, or 7 days without use, whichever comes first.

Up to 7 days.

As long as the workspace exists. We keep the current version of each workflow and up to 50 earlier ones.

Deleting a workspace erases its workflows, runs, secrets, vars, connections, triggers, API keys, sessions and audit log. Telemetry already recorded, and the run history the workflow engine keeps, expire within 30 days.

As long as tax and accounting law requires.

Webhook payloads, logs and other content your workflows handle may contain personal information about other people. We process it only on your instructions, to run your workflows. For that information you decide what is collected and why, and we act as your service provider (a "processor" under the GDPR).

If someone asks us about their data in your workspace, we refer them to you, and help you respond where we reasonably can. Enterprise customers can sign a data processing agreement.

Sets no cookies. Your browser stores your light or dark theme and code language choice locally; it never reaches us.

A session cookie that keeps you signed in, and a short-lived cookie that protects the sign-in step for 10 minutes. Both are strictly necessary. The theme choice is stored locally in your browser.

Our identity provider runs the sign-in pages and sets the cookies they need to work.

Depending on where you live, you can ask to access, correct, delete or export your personal information, or object to or restrict how we use it. Where we rely on consent, you can withdraw it at any time.

Email privacy@shiftlabs.org. We verify the request comes from you, then answer within 30 days. We won't treat you differently for exercising these rights.

We don't sell or share personal information as the CCPA defines those terms, and we don't use sensitive personal information for anything beyond providing the service.

If you are in the EU, UK or another region with a data protection authority, you can complain to it. We'd like the chance to fix the problem first.

shiftlabs is for business use and isn't directed to anyone under 18. We don't knowingly collect information from children.

Secrets are encrypted with a key held per workspace, all traffic uses HTTPS, and every member signs in with a second factor. The security model has the details.

If we change this policy in a material way, we tell you by email or in the dashboard before the change takes effect, and update the date at the top.

Xiong Enterprises, LLC, Michigan, United States. privacy@shiftlabs.org.