ExpoShift — Privacy Policy

ExpoShift Privacy Policy

Last Updated: June 9, 2026 Effective Date: July 1, 2026

ExpoShift collects the information needed to run your restaurant scheduling and team management — account details, employee information you enter, and basic technical/usage data. We use it to operate the service, not to sell to advertisers. You own your data. You can request deletion. We take security seriously. We do not sell personal information, and we do not use third-party advertising trackers.

1. Who We Are

ExpoShift is operated by ExpoShift LLC, a Wyoming limited liability company (“ExpoShift,” “we,” “us,” or “our”). ExpoShift operates the ExpoShift restaurant staff management platform, accessible at exposhift.com (marketing site), exposhift.app (web application), and via our mobile applications.

For purposes of applicable data protection law:

ExpoShift is a data processor with respect to employee information that business customers (restaurant operators) input on behalf of their employees.
ExpoShift is a data controller with respect to account information provided by the business operators who subscribe to the Service.

Contact: For privacy questions, contact us at privacy@exposhift.com.

2. Information We Collect

2.1 Information You Provide Directly

Account Information (Business Operators) - Business name, address, and contact information - Account owner name and email address - Payment information, when subscription billing is active (processed by our payment processor — we do not store full card numbers). Payment information is not collected during the no-cost beta or free trial. - Restaurant details entered during setup (positions, location names, operating preferences)

Authentication Information - Username, login credentials, password hashes (passwords themselves are not stored in plain text), account identifiers, and account preferences. Information received from third-party authentication providers if you choose to sign in through those services.

Employee Information (Entered by Business Operators) - Employee names, email addresses, and phone numbers - Job titles and assigned positions (e.g., Server, Line Cook, Bartender) - Availability preferences and scheduling constraints - Certification records and expiration dates - Work schedule history

Employee records entered by a restaurant operator may, depending on that restaurant’s workforce, describe individuals who are minors. See Section 10 (Minors and Employee Records).

In-App Communications - Messages sent through the ExpoShift chat and direct messaging features - Team announcements and updates posted by managers - Poll responses submitted by team members

Staff Self-Service Information - Availability submissions entered directly by employees - Profile information employees enter themselves

2.2 Information Collected Automatically

The following information may be collected automatically by us or through third parties:

Technical and Log Data When you access the Service, our hosting and infrastructure providers automatically generate standard server logs. These may include your IP address, browser type, device type and operating system, the pages or screens accessed, and the time and date of access. This data is generated at the infrastructure level (see Section 4) and is used for security, troubleshooting, and maintaining the Service.

ExpoShift does not run third-party behavioral analytics or advertising trackers within the Service. We do not build advertising profiles, and we do not track you across other websites or apps.

Browser Storage The Service uses your browser’s local storage to keep you signed in and to remember in-app preferences. See Section 9 (Cookies and Browser Storage) for details.

Usage Information. Usage information may be collected via features used within the Service, user actions and interaction events, session activity, error reports and performance information, referring URLs and app version information

Device Information. Device information may be collected via device identifiers, mobile device model, operating system version, browser settings, and language preferences.

Push Notification Information such asdevice tokens and notification preferences used to deliver application notifications.

Customer Support Information, such as, information provided in support requests, feedback submissions, bug reports, or communications with ExpoShift.

Employee Information. ExpoShift generally receives employee information from restaurant operators acting as our customers. Restaurant operators are responsible for ensuring they have appropriate rights and permissions to provide employee information to the Service.

2.3 Information from Third Parties

When subscription billing is active, we receive limited information from our payment processor (e.g., payment confirmation, billing status) necessary to operate the Service. If ExpoShift is distributed through the Apple App Store or Google Play, we may receive limited information from those platforms necessary to deliver and support the app.

3. How We Use Your Information

We use the information we collect to:

Provide the Service: Operate, maintain, and improve the ExpoShift platform
Account Management: Create and manage accounts, authenticate users, and provide customer support
Scheduling and Communication: Enable scheduling functionality, team messaging, availability management, and certification tracking
Billing: Process subscription payments, send invoices, and manage subscription status (when billing is active)
Notifications: Send service-related communications including schedule updates, shift notifications, and account alerts
Safety and Security: Detect, investigate, and prevent fraudulent activity, abuse, and other unauthorized or illegal activity
Legal Compliance: Comply with applicable laws, regulations, and legal obligations
Service Improvement: Understand how the Service is used so we can improve it, using aggregated or de-identified data where practicable

ExpoShift does not use personal information to create advertising profiles or track users across third-party websites or services for behavioral advertising purposes. ExpoShift does not sell personal information as the term "sell" is traditionally understood and does not disclose personal information to third parties for their independent marketing purposes.

ExpoShift does not sell personal information to third parties for monetary consideration and does not disclose personal information to third parties for their independent marketing purposes.We share information only in the following circumstances:

Service Providers (Sub-processors) We use the following third-party service providers to support and operate the Service. These providers are authorized to access information only as reasonably necessary to perform services on our behalf and are subject to contractual obligations designed to protect the information they process. We may also engage additional providers that support functions such as hosting, security monitoring, communications delivery, customer support, analytics, storage, or infrastructure operations. We will update this Privacy Policy as required when material changes occur.

Google Firebase / Google Cloud — database (Cloud Firestore), user authentication, and supporting cloud infrastructure. Employee records, schedules, messages, and account data are stored here.
Netlify — hosting of the ExpoShift web application.
jsDelivr (CDN) — delivery of static interface assets (icon fonts and stylesheets). The CDN may receive your IP address when these assets load.
Payment processor — when subscription billing is active, a third-party payment processor handles subscription payments. ExpoShift does not store full payment card numbers.

Business Operators and Their Staff Information within an ExpoShift account may be accessible to the applicable Account Owner and users authorized by the Account Owner based on role permissions established within the account. Administrators and Managers may be able to view employee schedules, availability, contact information, certifications, communications, and other information associated with employee use of the Service, depending on the permissions configured.

The Account Owner is responsible for determining user roles, permissions, and access rights within its account and for its own use of information available through the Service. ExpoShift does not control or monitor how Account Owners use information made available to them through the Service.

Legal Requirements We may disclose information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of ExpoShift, our users, or the public.

Business Transfers If ExpoShift is involved in a merger, acquisition, financing transaction, asset sale, restructuring, bankruptcy, or other corporate transaction, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

Affiliates and Corporate Transactions We may share information among entities under common ownership or control for purposes consistent with this Privacy Policy.

With Your Consent We may share information for other purposes with your explicit consent.

5. Employee Data — Special Considerations

ExpoShift provides workforce scheduling and communication tools to restaurant operators and processes certain employee information in connection with providing the Service. ExpoShift stores personal information about employees on behalf of the restaurants that subscribe to our Service. If you are an employee whose information has been entered into ExpoShift by your employer:

Your employer (the restaurant operator) controls your account and data within ExpoShift
ExpoShift processes your information as a service to your employer, not on our own behalf
For questions about how your employer uses your information in ExpoShift, contact your employer directly
For requests to delete your information from ExpoShift’s systems (e.g., following employment termination), contact your employer, who can remove your profile, or contact us at privacy@exposhift.com
ExpoShift may assist employers with responding to data-related requests where appropriate and may retain certain information where necessary for legal compliance, security purposes, dispute resolution, fraud prevention, recordkeeping, backup systems, or enforcement of our agreements
You may also be able to delete your own account directly in the app (My Information → Delete my account). This removes your sign-in and erases your personal information; an anonymized record of your past schedule and work history may be retained by your employer as part of their business records

6. Data Retention

We retain personal information for as long as reasonably necessary to provide the Service, maintain customer accounts, comply with legal obligations, resolve disputes, enforce our agreements, maintain security, and support legitimate business operations.

Employee information associated with a customer account is generally retained while the applicable customer account remains active and for a limited period thereafter to support account administration, recovery, troubleshooting, and legal or operational needs.

When an account owner deletes a restaurant's ExpoShift account, the account is locked immediately and its data — including employee information — is scheduled for permanent deletion after a limited recovery period (currently 30 days), during which the owner can reverse the deletion. After that period, the data is permanently deleted, except for the limited records described in this section.

When an individual staff member deletes their own account, we remove their login and personal identifiers (such as name, contact details, emergency contact, date of birth, and certification records). An anonymized record sufficient to preserve the employer's scheduling and operating history may be retained.

Certain information may be retained for longer periods where required or permitted by law, including billing records, security logs, audit records, backup systems, fraud prevention records, and information subject to legal obligations or dispute resolution requirements.

When information is no longer reasonably necessary for these purposes, we will take reasonable steps to delete, de-identify, or securely dispose of it.

7. Your Rights and Choices

Depending on your location and applicable law, you may have certain rights regarding your personal information. These rights may be subject to legal limitations, verification requirements, and exceptions. Rights that may be available include:

• Access: Request information regarding the personal information we maintain about you

• Correction: Request correction of inaccurate or incomplete personal information

• Deletion: Request deletion of personal information, subject to legal, operational, security, and other permitted exceptions

• Data Portability: Request a copy of certain information in a portable format where required by applicable law

• Restriction or Objection: Request limitations on certain processing activities where applicable law provides such rights

• Withdrawal of Consent: Where processing is based on consent, withdraw that consent where permitted by law

If you are an employee whose information was provided through an employer's ExpoShift account, your employer may control certain information within the Service. In many cases, requests relating to employee information should first be directed to your employer.

California Residents (CCPA/CPRA)

California residents may have additional rights under applicable California privacy laws, including:

• The right to know what categories of personal information we collect, use, disclose, and process

• The right to request deletion of personal information, subject to exceptions

• The right to request correction of inaccurate personal information

• The right to opt out of the sale or sharing of personal information under applicable law

• The right to limit the use of certain sensitive personal information where applicable

• The right not to be discriminated against for exercising privacy rights

ExpoShift does not sell personal information for monetary consideration and does not share personal information for cross-context behavioral advertising purposes.

International Users

ExpoShift is intended primarily for users located in the United States and is not specifically directed toward individuals located outside the United States.

If you access or use the Service from outside the United States, including from the European Union, European Economic Area, or United Kingdom, you may have rights under applicable local privacy laws. To the extent such laws apply, we will consider and respond to requests as required by applicable law.

To exercise privacy rights or submit a request, contact us at privacy@exposhift.com.

8. Data Security

ExpoShift implements reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, misuse, and destruction.

Our security measures may include, as appropriate:

• Encryption of information during transmission and, where applicable, at rest

• Access controls and authentication measures designed to limit access to authorized users and personnel

• Logical separation of customer account data

• Security monitoring, logging, and system maintenance practices

• Measures intended to detect, investigate, and respond to security incidents

Although we take reasonable steps to protect information, no method of transmitting information over the Internet or storing electronic information can be guaranteed to be completely secure. As a result, we cannot guarantee absolute security.

If we become aware of a security incident involving personal information, we may investigate and take appropriate steps to contain and address the issue. Where required by applicable law, we will provide notifications to affected individuals, customers, or governmental authorities.

9. Cookies and Browser Storage

ExpoShift uses limited browser based storage, including cookies, localStorage, and sessionStorage, to operate the Service. We do not use third-party advertising cookies, and we do not use cross-site tracking technologies.

Authentication / session storage: The Service stores sign-in session data in your browser (via the authentication provider) so you stay logged in. This is essential for the Service to function.
Preference storage: The Service stores certain in-app preferences (such as layout and display settings) in your browser so they persist between sessions.

Clearing your browser storage will sign you out and reset saved preferences.

• Device‑level control — You may clear your browser’s cookies or storage at any time. Doing so will sign you out of the Service and reset saved preferences.

• No advertising or cross‑site tracking — We do not use advertising cookies, third‑party trackers, or technologies that follow you across other websites or apps.

• Data retention — Browser‑stored data remains only on your device and persists until it expires or you delete it through your browser settings.

10. Minors and Employee Records

Account Eligibility. The ExpoShift Service is intended for use by business operators and is not directed to children under the age of 13. Individuals creating and managing Operator accounts (including Owner, Administrator, and Manager roles) must be at least 18 years of age.

Employee and Workforce Information. ExpoShift is a workforce management tool used by employers, including restaurants that may lawfully employ minors under applicable labor laws. As a result, employer customers may input and manage employee information within the Service, which may include information about employees who are minors.

This information may include, as determined by the employer:

Name, contact information, job title, and employment role
Work schedules, availability, and time-off requests
Certifications and related employment records
Communications and operational messages within the Service

Employers are responsible for ensuring that any employee information they provide to ExpoShift is collected and used in compliance with applicable laws, including youth employment, child labor, education, and privacy laws, and for obtaining any required parental or guardian consents where applicable.

Staff Access. Employers may provide individual employee access to ExpoShift in order to allow employees to view schedules, submit availability, and participate in workplace communications. Such access is created and controlled by the employer and is not directly provided by ExpoShift to individual employees. Age requirements for employee access are determined by the employer and applicable law.

If you believe a minor’s information has been entered into ExpoShift improperly, contact the restaurant operator that controls the account, or contact us at privacy@exposhift.com.

Role of ExpoShift. ExpoShift processes employee information solely to provide and support the Service on behalf of the applicable employer customer and to facilitate workforce management functionality, security, and operational purposes.

11. Links to Third-Party Sites

The Service may contain links to third-party websites or services or may integrate with third-party services that are not operated or controlled by ExpoShift. These third-party services may include, for example, payment processors, authentication providers, infrastructure providers, or other tools that are used in connection with providing the Service. ExpoShift does not control and is not responsible for the content, privacy practices, or security of any third-party websites or services. This Privacy Policy does not apply to those third party websites or services. We encourage you to review the privacy policies of any third-party sites you visit. Your interactions with third-party services are solely between you and the applicable third party, and are subject to that third party’s terms and policies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by email or through a prominent notice in the Service, and will update the “Last Updated” date at the top of this policy. Your continued use of the Service after the effective date of the updated policy constitutes acceptance of the changes.

13. Contact Us

For privacy questions, requests, or concerns:

ExpoShift Privacy Email: privacy@exposhift.com Website: exposhift.com/privacy

For data deletion requests or to exercise your rights, please email privacy@exposhift.com with the subject line “Privacy Request” and include your account email address.