Privacy Policy
Effective date: October 21, 2026. Replaces the Privacy Policy dated July 15, 2026.
1. Our policy
Mert Balcı, Nispetiye Mahallesi Petrol Sitesi Sokak 24. Blok 1AI Daire 6, Beşiktaş, İstanbul, Türkiye, trading as HuddleShift (HuddleShift, we, us, our), is committed to protecting your privacy. This Privacy Policy explains how we process personal data when you use the HuddleShift mobile apps, web app and website (the Services).
We are the data controller for personal data of account holders, managers and website visitors. When a business enters its employees' data into its HuddleShift workspace, that business is the data controller and we process the data on its behalf as data processor.
By accessing the Services, you acknowledge that you have read this Privacy Policy. Contact: support@huddleshift.com.
2. Changes to this policy
We may change this Privacy Policy from time to time. We will post the revised version in the Services and on this page, and notify managers of material changes by email or in the app. Your continued use of the Services after the effective date means you accept the updated policy.
3. Information we collect
We collect personal data directly from you, from the business that invites you, and automatically when you use the Services.
| Category | Data |
|---|---|
| Identity | Name, surname; optionally, date of birth |
| Contact | Email address; optionally, phone number |
| Visual records | Optionally, a profile photo |
| Business and professional life | The business you own or represent, your role, position and department |
| Workspace and shift data | Shifts, availability, leave requests, shift swaps, clock-in/out times, team messages and announcements |
| Location | GPS location at the moment of clock-in and clock-out, to verify attendance |
| Uploaded files and AI inputs | Schedule photos and prompts you send to the HuddleShift AI Scheduler and Hadger AI Assistant, and the outputs generated |
| Transaction | Plan, purchase and subscription records, billing country. Payment card details are collected by Paddle, Apple or Google, never stored by us |
| Device and usage | Device type, operating system, app version, IP address, crash logs, in-app events, advertising identifiers where permitted |
| Communications | Feedback, suggestions and support messages |
Your date of birth, phone number and photo are entirely optional and are collected only if you choose to share them.
4. How we use your information
We process personal data only as reasonably necessary and proportionate to:
- conduct and manage memberships and create business accounts and workspaces;
- provide scheduling, time tracking, GPS-verified attendance, leave and swap management and team communication;
- generate schedules and answers through our AI features;
- process subscriptions and fulfil legal, tax and accounting obligations;
- ensure the security of the Services and prevent fraud and abuse;
- receive suggestions and feedback and improve the Services;
- measure the effectiveness of our advertising, where you have consented.
5. Legal basis for processing
We process personal data under Law No. 6698 on the Protection of Personal Data (PDPL) and, where it applies, the EU and UK General Data Protection Regulation (GDPR):
- Contractual necessity (PDPL Art. 5/2-c; GDPR Art. 6(1)(b)): to provide the Services, manage memberships and business accounts, and process subscriptions.
- Legal obligation (PDPL Art. 5/2-ç; GDPR Art. 6(1)(c)): to keep transaction records and respond to authorities.
- Legitimate interests (PDPL Art. 5/2-f; GDPR Art. 6(1)(f)): to secure the Services, prevent fraud, analyse usage and handle feedback, without overriding your fundamental rights and freedoms.
- Explicit consent (PDPL Art. 5/1; GDPR Art. 6(1)(a)): for advertising and analytics cookies and identifiers, and for any other processing where the law requires consent. You may withdraw consent at any time.
For employee data, the employer business is responsible for having a valid legal basis, including for GPS-verified clock-in.
6. How we share your information
We share personal data only as needed for the purposes above:
- Paddle.com — our online reseller and Merchant of Record for purchases on our website. Paddle receives the data needed to process payments, calculate and remit taxes, prevent fraud and handle refunds, and processes it under Paddle's Privacy Notice.
- Apple and Google — for app distribution and in-app purchases.
- Service providers acting as data processors — cloud hosting, database and platform providers (SaaS and PaaS), subscription management (RevenueCat), AI model providers that power our AI features, email and push-notification delivery, analytics and crash reporting, and advertising measurement (such as Meta). They process data only on our instructions under contract.
- Professional advisers — lawyers, accountants and auditors, under confidentiality.
- Public institutions and judicial authorities — where we are legally obliged to disclose data, for legal reporting, audits and disputes (PDPL Art. 5/2-ç and 8/2-a).
We do not sell your personal data.
7. International transfers
Most of our service providers store or process data outside Türkiye, including in the European Union and the United States. Under Article 9 of the PDPL, we transfer personal data abroad on the basis of an adequacy decision where one exists, or appropriate safeguards such as standard contracts approved by the Personal Data Protection Authority and notified to it as required by law. Incidental transfers may rely on another condition in Article 9, including your explicit consent. For users in the EEA and UK, we rely on adequacy decisions or the Standard Contractual Clauses.
8. How we protect your information
We implement and maintain the technical and administrative measures needed for an appropriate level of security, including encryption in transit, access controls and regular backups, to prevent unlawful processing, block unauthorised access and keep your data safely stored. We will notify affected users and authorities of a data breach where the law requires.
9. Data retention and disposal
We keep personal data only as long as needed for the purposes in this policy, taking into account legal obligations, potential disputes and business requirements. Account and workspace data is deleted within 90 days after an account is deleted, except backups that expire on their regular cycle. Transaction records are kept as long as tax and commercial law requires. When the retention period ends or the purpose ceases, data is securely deleted, destroyed or anonymised under our data retention and disposal policy.
10. Your rights
Under Article 11 of the PDPL, you may apply to us at any time to:
- learn whether your personal data is processed and request information about it;
- learn the purpose of processing and whether data is used accordingly;
- know the third parties in Türkiye or abroad to whom your data is transferred;
- request rectification of incomplete or inaccurate data;
- request erasure or destruction under Article 7 of the PDPL;
- request that rectification, erasure or destruction be notified to recipients;
- object to a result against you arising solely from automated analysis;
- claim compensation for damage caused by unlawful processing.
If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent at any time. You may complain to the Turkish Personal Data Protection Authority, your local EU data protection authority or the UK Information Commissioner's Office.
If you are an employee of a business using HuddleShift, contact your employer first; we will help them respond.
11. How to apply
You can submit your request with the information required by the Communiqué on the Procedures and Principles of Application to the Data Controller (name, surname, signature for written requests, Turkish ID or passport number, address, email, phone and the subject of your request):
- In writing: via a notary public, registered mail with return receipt, or hand delivery with wet signature to Nispetiye Mahallesi Petrol Sitesi Sokak 24. Blok 1AI Daire 6, Beşiktaş, İstanbul, Türkiye;
- Electronically: by email to support@huddleshift.com from the email address registered in our system.
We resolve requests free of charge within 30 days at the latest.
12. Cookies
Our website uses essential cookies to work, and analytics or advertising cookies only with your consent where required. You can change your choices through the cookie banner or your browser settings.
13. Children
The Services are intended for businesses and their staff. They are not directed at children under 16, and manager accounts require users to be 18 or older.
14. Explicit consent
Where we ask for your explicit consent, for example for advertising and analytics identifiers or an incidental transfer abroad, we do so with a separate, unticked checkbox or in-app prompt. Refusing consent does not prevent you from using the core Services. You may withdraw consent at any time by emailing support@huddleshift.com or changing your settings.