Last updated: May 2026 · For EU/EEA residents
Under the General Data Protection Regulation (GDPR), if you are in the EU or EEA, you have specific rights regarding your personal data. This page explains those rights and how to exercise them.
You have the right to request a copy of all personal data we hold about you. We will provide this within 30 days of your request.
If any data we hold about you is inaccurate or incomplete, you have the right to request correction. You can update most information directly in your account settings.
You can request that we delete all personal data we hold about you. This includes your account, projects, analytics data, and any other personal information. Note: Some data may be retained for legal compliance purposes.
You have the right to receive your data in a structured, machine-readable format (JSON) and transfer it to another service.
You can request that we stop processing your data in certain circumstances, such as when you contest its accuracy.
You have the right to object to processing of your data for marketing purposes. You can opt out of marketing emails at any time.
ShiftStackApp does not use fully automated decision-making that produces legal or significant effects on you.
| Data Type | Retention Period |
|---|---|
| Account data | Until account deletion + 30 days |
| Project files | Until deleted by user |
| Analytics data | 24 months |
| Support tickets | 3 years |
| Payment records | 7 years (legal requirement) |
| Server logs | 90 days |
We share data with the following sub-processors (all GDPR compliant):
To exercise any of your GDPR rights, contact our Data Protection Officer:
Email: [email protected]
Subject line: GDPR Request — [Your Right]
Response time: Within 30 days
Identity verification: We may ask you to verify your identity before processing your request
In the event of a personal data breach that risks your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and notify affected users without undue delay.
You have the right to lodge a complaint with your local data protection supervisory authority. In the UK this is the Information Commissioner's Office (ICO).