Privacy Policy

Shyft SG is a business run by its founders in Singapore. We are in the middle of registering the company. Once that is done, the company will be called Shyft SG Pte Ltd, and we will update this page to say so. When this policy says "we" or "us", it means Shyft SG.

We run a marketplace for short-term shifts in Singapore. The work falls into four areas: hospitality, food and beverage, events and MICE (large meetings, conferences and exhibitions), and logistics.

This policy explains four things: what personal data we collect, why we collect it, who we give it to, and what you can ask us to do about it. It covers our website and our mobile app. We follow the Personal Data Protection Act 2012 of Singapore, which we call the PDPA in this policy.

This policy forms part of our Terms of Service and is binding. Where this policy and the Terms of Service describe the same thing differently, the Terms of Service govern.

If you read nothing else, read this.

• We ask for as little as we can.
• We do not ask for your NRIC or FIN. If we collected one from you before this policy took effect, we are deleting it, and we do not use it for anything.
• We do not track your location. There is no GPS in this platform.
• We do not handle your wages. Your employer pays you directly, or through a licensed payment or earned wage access provider that the employer chooses.
• When you apply for a shift, the employer sees your first name and last initial, your tier, your reliability score with your shift count and show-up percentage, your rating and how many reviews it is based on, your shifts completed, your badges, whether you are a Founding Worker, the work authorisation category you declared and, if you are under 18, that fact. They never see your date of birth or your exact age. They only get your contact details once they book you.
• We do not give your personal data to another company so that company can market to you.
• You can ask us for a copy of your data, ask us to fix it, or ask us to close your account.

The rest of this policy is the detail. Two parts matter most. Section 6 explains the score that affects how much work you are shown. Section 15 is for you if you are under 18. If anything is unclear, write to us and we will explain it.

If you are a worker

• Your name, your date of birth, and a profile photo if you choose to add one.
• Your email address and your mobile number.
• What lets you work in Singapore, and when it runs out. This is things like being a citizen, a permanent resident, or holding a pass. You tell us this yourself. We do not ask you to upload a document and we do not ask for an identification number. We use what you tell us to decide whether you may hold an account. Clause 3.3 of our Terms lists the pass types we do not accept, and an account opened on one of those will be closed.
• Your shift history on the platform: shifts you applied for, shifts you worked, hours, ratings employers gave you, cancellations, and no-shows.
• Your reliability score and your tier.
• Your points, streaks, shields and badges, and, if you turn it on, your place on the weekly leaderboard.
• Your voucher redemptions: which voucher you asked for and when, the code once it is issued to you, and the calendar month it counted against.

If you are an employer

• The name of your business, your Unique Entity Number, and your business address.
• The name, work email, and work phone number of the person who runs the account.
• What we gather when we review your account before you can post: your ACRA registration, your trading history, and confirmation of the premises where the work takes place.
• Your shift postings, your rosters, and the ratings you give workers.

If you join our waitlist

• Your email address, the referral link you arrived on, and who referred you.

Collected automatically

• How you use the platform: pages you open, features you use, actions you take.
• Basic device information: browser, operating system, and IP address.
• Cookies. Section 12 explains these.

What we do not collect

We do not collect your NRIC, your FIN, your work permit number, or a scan or photo of any identity document. If we collected an identification number from you before this policy took effect, we are deleting it.

We do not collect your bank details or your card details, and we never receive, hold or transmit your wages. We do record the rate the employer posted, the hours you were confirmed for, and two markers: one the employer sets when it sends payment, and one you set when you receive it. Those markers are a record for both of you. They are not proof of payment.

• To run your account. Creating it, signing you in, and keeping it secure.
• To match you with shifts. Showing you shifts you are eligible for, letting you apply, and showing employers who applied.
• To check employers before they can post. Every employer account is reviewed by a person. No employer is approved automatically.
• To apply young worker limits. Singapore's employment rules limit what work under-16s may do, how many hours, and at what times. We use your date of birth to apply the limits the platform can see: the minimum age, which kinds of work you may apply for, the length of a shift, and the ban on working between 11pm and 6am. The platform cannot see your school hours, your bookings elsewhere, or whether a break was given. Clause 12 of our Terms makes the employer responsible for those.
• To contact you. Shift confirmations, application updates, one-time passcodes, and service notices.
• To keep the platform honest. Preventing fraud, investigating no-shows and misuse, and enforcing our Terms of Service.
• To improve the platform. Understanding which parts of the service work and which do not.

There are a few things we do without asking your permission first. The PDPA allows this. Lawyers call it the Legitimate Interests Exception, and it sits in Part 3 of the First Schedule to the PDPA. Here is what we use it for:

• preventing and investigating fraud,
• investigating no-shows, late cancellations, and misuse of the platform, and
• protecting the accuracy of reliability scores.

We do this because we cannot ask someone for permission before we check whether they are cheating. We weighed the downside for you against the damage fraud does, and we think the checks are worth it. Only a small number of people inside Shyft SG can run them, and there are limits on what those people can see. Ask us any time and we will explain more.

Your reliability score is worked out automatically. Employers see it when they look at who applied. It also sets your tier.

Your tier is the level your account sits at. There are four: Member, Select, Elite and Ambassador. A higher tier can see a new shift earlier than other workers, where the employer has chosen to show reliable workers first and the shift was posted far enough ahead.

Because your score affects how much work you are shown, we want you to know exactly what goes into it. Three things do. In order of how much they matter:

1. Whether you turn up. This matters most by a wide margin. It is the share of confirmed shifts you appeared for. If you cancel more than 24 hours before the shift starts, it does not count against you.
2. How employers rated you on shifts you completed.
3. How often you cancel late, measured against the shifts you accepted.

Nothing else goes into it. We do not use your location, your punctuality, your age, your photo, or anything an employer wrote about you outside a rating.

A few shifts are a small sample, so we steady the score for new workers. Your show-up rate is blended with 5 notional shifts at the platform average, and your rating average is blended with 5 notional ratings at the platform average, before the three things above are weighted. Until the platform has 90 days of real data, the averages we use are a show-up rate of 95 per cent and a rating of 4.5 out of 5. After that we work them out from real platform data every 3 months and update this paragraph. The more shifts you complete, the less the notional figures matter.

Until you have 5 shift events, meaning completed shifts, no-shows and late cancellations taken together, your score is shown as Provisional, with that count next to it wherever it appears.

Your score uses your last 50 shift events: shifts you completed, no-shows and late cancellations. Cancelling more than 24 hours ahead is not a shift event and does not count. Until you have 50 events, all of them count. We also keep your lifetime count of shifts completed for as long as your account is open, and show it next to your score together with your show-up percentage across those 50 events.

Your score is shown to one decimal place and is not capped. We keep a log of every change to it, so we can show you what it was on any date. A recalculation that leaves the score and the figures behind it unchanged adds no entry, because there is nothing new to record.

A person, not a machine, has the final say. If you think a rating, a no-show mark or a late cancellation mark is wrong, dispute it in the app within 7 days of being told about it. A person at Shyft SG decides on the evidence. We aim to decide within 72 hours. That is a target, not a guarantee. While a dispute is open, the disputed shift is left out of your score.

Employers. When you apply for a shift, the employer sees your first name and last initial, your tier, your reliability score with your shift count and show-up percentage, your rating and how many reviews it is based on, your shifts completed, your badges, whether you are a Founding Worker, and the work authorisation category you declared at signup, such as citizen or permanent resident, Long Term Visit Pass with a Letter of Consent, or Student Pass. They do not see your surname, your date of birth, your age, your email address or your phone number at that stage.

If you are under 18, employers also see that you are under 18, because our Terms make them responsible for the limits that apply to young workers. They see that fact. They do not see your date of birth or your exact age.

Once you are booked, the employer also gets the contact details it needs to run the shift.

Other workers. If you turn on the weekly leaderboard in your settings, other signed-in workers who have turned it on themselves see your first name, the first letter of your last name and the points you earned that week. Employers do not see it. It is off unless you turn it on, and turning it off takes your name off every week, past and present.

Companies that run parts of the platform for us. We use outside companies to do a small number of jobs: hosting and databases, sending texts, sending emails, analytics, running our mailing list, and a spreadsheet service we use to track referrals. They may only use your data to do the job we hired them for, under a written agreement, and never for their own purposes.

Authorities. Where the law requires it, or in response to a valid court order or a lawful request from a regulator. We do not report a user to any authority as a penalty or a threat.

If the business changes hands. If Shyft SG is bought, merges, or transfers part of its business, your data may move with it. The buyer would be bound by this policy or one that protects you to the same standard.

We do not give your personal data to another company so that company can market to you.

Some of the companies that run parts of the platform for us store or process data outside Singapore. When that happens, we make them sign an agreement we can enforce. It requires them to protect your data as well as Singapore law requires us to.

We keep personal data only for as long as it is doing a job.

• While your account is open, we keep your profile and your shift history so the platform works.
• When you close your account, we delete your personal data within 90 days, or strip out everything that could point back to you. We keep something past 90 days only if we need it for an open matter, or if the law or our accounts require it.
• What lets you work in Singapore is deleted when your account closes or when it runs out, whichever comes first.
• Dispute records are kept in a log that cannot be edited or deleted. A log you can change is not worth keeping. Those records stay after your account closes.
• Weekly leaderboard records store which account held each place and the points. Your name appears in them only while you keep the board turned on.
• Voucher records are kept for as long as tax and company law require us to keep accounting records.
• Medical evidence you show us in a dispute is looked at, not kept. We record that it was sighted, the dates it covered, who at Shyft SG sighted it and when. We do not record a diagnosis and we do not keep a copy.
• Referral prize draw records are kept for the period set out in clause 16 of our Terms of Service, even if you close your account before then.
• Records of fees we charged an employer are kept for as long as tax and company law require us to keep accounting records.
• Our access logs record who inside Shyft SG looked at personal data. They also cannot be edited or deleted.

We are not the employer of anyone who works a shift booked here, so employment record-keeping duties do not apply to us. They apply to the employer.

We encrypt your data when it travels to us and while it is stored. We restrict access inside Shyft SG to the people who need it, and we log that access. We limit how many times anyone can hit our systems in a short space of time, so that attacks run by software fail before they get near a real account.

No system is completely secure, and we will not pretend ours is. Here is what we do when something goes wrong.

If personal data we hold is exposed or misused, we will assess what happened, take steps to limit the harm, and notify the Personal Data Protection Commission where the PDPA requires it. Where a breach is likely to cause you significant harm, we will tell you directly and explain in plain language what happened and what to do about it. If the person affected is under 18, we will also tell a parent or guardian where we have been given a way to reach one.

We use cookies that are needed to sign you in and keep your session running. You cannot turn these off and still use your account.

We use analytics tools to see which parts of the platform people use, so we can fix the parts that do not work. We do not use cookies to advertise to you, to follow you around other websites, or to build a picture of you for advertisers.

Singapore does not require a cookie consent banner, and we have not built one. You can block or delete cookies in your browser settings. If you block the essential ones, the platform will not be able to sign you in.

Service messages are part of the platform: one-time passcodes, shift confirmations, application updates, and notices about your account. You cannot opt out of these while your account is open, because they are how the platform works.

Marketing messages are different. We send these only if you asked for them. Every marketing email has an unsubscribe link, and we act on it within 10 business days. Every marketing text has a way to stop it. If you tell us to stop, we stop, and we will not start again unless you ask us to.

Before we send a marketing text to a Singapore number, we check the Do Not Call Registry. We skip that check only if you have given us clear, recorded permission to text you.

Push notifications are a convenience copy. When you turn them on in the Shyft app, your phone gives us a notification token, which is an address your device can be reached at. It is not your phone number and it does not identify you to anyone else. We use it only to deliver notifications you have asked for, and for nothing else: not to build a profile, not to work out where you are, and never to give to an advertiser.

We delete a notification token when you remove that device in the app, when you sign out of it, when your account is removed, or after 180 days without the device being seen. Nothing is sent to a deleted notification token.

You choose what we send. Notification settings in the app control which notifications reach your phone, including quiet hours. A small number of notices cannot be switched off there, because they tell you about something that has already happened to your account or start a window you have days to act inside; your phone's own notification switch still applies to all of them.

Notice under our Terms is given in the app and by email. A push notification is a copy of that, sent for convenience, so switching push off never costs you a notice you are entitled to.

On your device. Some of this lives on your phone and never reaches us.

Notification settings: your choices are saved to your account so they follow you between devices.

Widget and lock screen: the lock screen activity shows your next shift's time and role. The venue name is shown only if you turn on shift details on the lock screen. No pay figure and no contact person is ever shown there.

Calendar: if you turn this on, Shyft adds shifts you accept to your calendar. It cannot read your calendar, and it cannot change or remove an entry once added.

Face ID: if you turn this on, your phone checks your face or passcode before opening Shyft. The check happens on your device. We never receive your biometric data, and we could not read it if we tried.

Devices: you can see which devices are receiving notifications, and remove any of them, in the app's notification settings. Removing one deletes its notification token immediately.

We do not collect your location. The app does not ask for location permission.

You can ask us to:

• Give you a copy of the personal data we hold about you and tell you how it has been used or disclosed in the past year.
• Correct anything that is wrong or incomplete.
• Withdraw your consent to us using your data. Know what happens if you do. Almost everything we hold is what makes your account work. If you take back your consent for that, we cannot run your account, so we will close it. We will tell you this before we act, not after.

Write to us at the email address in Section 17. We will respond as quickly as we can and in any case within 30 days. If we cannot answer fully within 30 days, we will tell you within that time when we will. We may charge a reasonable fee for a copy of your data, and if we do, we will give you an estimate first and let you decide before we start.

Two things you may have seen in other privacy policies are not available here, and we would rather say so than let you find out later. Singapore's data portability right is not yet in force, so we do not offer a download of your data in a file format built for moving to another service. The PDPA also does not give you a right to have everything about you erased on demand. What you do have is the right to close your account, and Section 9 tells you exactly what happens to your data when you do.

You must be at least 13 to hold a worker account. We check this from your date of birth at signup.

If you are between 13 and 17, we have written this policy to be understood by you, not by a lawyer. Read Section 2 first. If any part of it does not make sense, tell us. We will explain it, and if the wording is the problem we will change it. A policy you cannot understand is not one you can agree to.

We recommend you talk to a parent or guardian before signing up. A parent or guardian can contact us on your behalf at any time to ask what we hold about you or to close your account.

Singapore's employment rules limit what work under-16s may do, how long, and at what times. Section 4 explains how we use your date of birth to apply the limits the platform can see, and which limits are the employer's responsibility instead.

The weekly leaderboard is off unless you turn it on. Section 7 explains what other workers see if you do, and clause 22 of our Terms is written so that you can read it yourself.

This matters for your data, so we will say it plainly.

We are not your employer. We are not an employment agency, and we do not hold a licence issued by the Ministry of Manpower under the Employment Agencies Act 1958. We do not handle wages. Every engagement is a direct contract between the employer and the worker, and we are not a party to it.

We are not a platform operator under the Platform Workers Act 2024. That Act covers delivery and ride-hail services only. Nothing on this platform gives you rights under that Act.

For any question about this policy, about your data, or to make a request under Section 14, write to our Data Protection Officer:

If you are not satisfied with how we have handled your request, you can complain to the Personal Data Protection Commission at pdpc.gov.sg.

We may update this policy. Because it forms part of our Terms of Service, changes to it follow clause 20 of the Terms. Until the platform opens for shifts on 4 January 2027, a change takes effect when it is published here. From 4 January 2027, we tell you about material changes by email or a prominent notice on the platform at least 14 days before they take effect. The date at the top of this page always tells you when it last changed.