TableShifts and TableWork privacy notice

Consumer release — 17 October 2026.

Who is responsible

KINETIK SOFT SRL, CUI 55334121, registration J2026047284009, Str. Naum Râmniceanu 2–4, bloc 5, ap. 4, Sector 1, București, 011617, Romania, is responsible for its account administration, subscription billing, security, support and legal obligations. Contact office@tableshifts.com or +40733220880 for privacy questions. This is our privacy contact, not a representation that a statutory data protection officer has been appointed.

For information processed on a business workspace's documented instructions, that organisation normally determines the purposes and lawful basis, and we act under its data-processing agreement. Contact the relevant organisation or workspace administrator about its records; we assist with routing and lawful requests. A purely personal/household user is not automatically a controller.

Information and reasons for processing

We use identity/contact details, authentication and account permissions, chosen product and capacity, and content you provide to deliver the service and take steps you request before a contract. Required fields are necessary to provide the relevant account, payment or service; without them that operation may not be possible. Optional fields remain optional.

Billing uses your lawful billing identity/address, payment references, amounts, invoices, accepted terms and separate consent evidence for contractual and accounting/legal duties. Consumers are not required to invent a company tax ID or provide a CNP merely to purchase. Revolut handles card details; our contract records do not store the full card number or CVV.

For invited users and business representatives, administering access and the organisation's service may rely on our legitimate interests rather than a contract with the individual. Security and limited operational records support our legitimate interests in preventing abuse, investigating errors and defending the service, alongside applicable legal duties. We restrict access and avoid unnecessary content in operational logs. Support and legal requests are processed to answer you, fulfil duties or establish/exercise/defend legal claims.

Workspace information may include names, roles, schedules, attendance, leave, projects, tasks, notes, files and communications, according to the features used. An employer must establish its own lawful basis and conditions for sensitive workforce information. Do not send unnecessary medical details. Information comes from you, authorised workspace users/administrators, service interactions and the relevant payment/invoice providers. We provide required information when obtaining data indirectly.

Essential browser storage supports login, session security and preferences. Optional push notifications involve permission and the browser's push service. An enabled calendar connection shares the selected records with its provider. Required contract/service messages are separate from optional marketing; this notice does not obtain marketing or non-essential tracking consent.

Recipients and international processing

Authorised personnel and service providers receive information needed for their role: Supabase Pte. Ltd for database, authentication and storage; Vercel Inc. for hosting and server requests; Plus Five Five, Inc. (Resend) for transactional email, including authentication, service notifications, contracts and withdrawal confirmations; Revolut Bank UAB and its relevant branch for payments; and Oblio Software SRL for invoicing. Email delivery includes the recipient and message content. Payment providers may act independently for fraud prevention, regulatory duties and their own customer services as well as carrying out instructed processing.

All transactional emails use Resend with open and click tracking disabled. Delivery and failure events remain necessary operational records. Replies and support correspondence to office@tableshifts.com are received through Apple iCloud Mail. This does not give Resend access to that mailbox.

The primary Supabase project is in Frankfurt, Germany. Hosting, support and provider operations can involve processing outside the EEA; the database region does not make the whole service EU-only. Where required, the applicable provider processing agreements use EU standard contractual clauses or another valid Chapter V mechanism, with the safeguards required for the transfer. Ask our privacy contact for information or a copy of the relevant safeguards, with necessary confidential details protected.

Resend sends our messages from Ireland but stores email and log data in the United States. Its processing agreement incorporates EU standard contractual clauses for those transfers; selecting an EU sending region does not provide EU-only storage.

We disclose records to authorities when legally required and to professional advisers where necessary under appropriate confidentiality. Your organisation and authorised collaborators can see data within their permissions. A recipient's own mailbox or independent statutory records have their own retention rules.

Backblaze, Inc. stores encrypted recovery copies of uploaded workspace files in its EU Central region (Amsterdam). File contents and filenames are encrypted before upload; the private recovery key is held separately by KINETIK SOFT. Account and support operations may involve processing outside the EEA under the applicable processing agreement and transfer safeguards. These copies have a seven-day retention target with daily expiry processing, which can delay physical deletion. They are isolated from routine use; completed erasures are reapplied before recovered data becomes accessible. These file copies supplement the separate database backups and do not extend ordinary active-data retention.

Retention

Account/workspace content remains while needed for an active, trial, free or individually agreed service, subject to valid deletion instructions. Closing one paid product does not erase shared content still needed by another active service. After confirmed closure of the whole workspace we allow 30 days for export and remove or irreversibly anonymise ordinary active content within a further 90 days. Erasure requests and mandatory retrieval rights are assessed independently; those ordinary periods are not a reason to delay a valid shorter deadline.

Necessary accounting documents and supporting contract/payment evidence are ordinarily kept for five years calculated from 1 July of the year following the financial year in which they were prepared. We retain only what the applicable duty requires. This is not a blanket rule for all workspace or workforce content. Specific proceedings or legal requirements may justify longer retention of the affected records, with restricted use and periodic review.

Routine support correspondence is kept for up to three years after resolution, with unnecessary attachments removed earlier. Application security/access logs are kept for up to 12 months unless specific incident or claim evidence remains necessary. Retention and erasure are controlled processes; they are not triggered by simply cancelling renewal. Holds are reviewed at least every six months.

Resend retains email content and delivery logs for 30 days under its standard retention policy. Disabling engagement tracking does not disable message storage. Our Brevo account is configured to expire other transactional logs after one month. The app separately keeps the accepted contract/receipt as evidence. Support mailbox records follow the support/hold rules above. Supabase's ordinary database backup cycle is seven days; recovery copies are isolated from routine use and completed erasures must be reapplied before restored records become accessible. Database recovery copies do not contain Storage file objects. Legally retained records and authorised exports are assessed separately, rather than being labelled routine backups.

Rights and human review

Subject to applicable conditions, you can request access, correction, erasure, restriction, portability and objection to legitimate-interest processing. You can withdraw consent where it is used and object to direct marketing. Contact office@tableshifts.com. We normally respond within one month; if a lawful extension is needed, we explain it within that month. Identity checks are proportionate and requests are normally free.

You may complain directly to Romania's ANSPDCP or another competent supervisory authority and seek judicial remedies. You need not contact us first. Contractual withdrawal and GDPR erasure are distinct rights.

Payment verification, renewal status and configured capacity determine access automatically. We do not use this flow to assess creditworthiness. You may challenge an incorrect billing/access result and request human review through support. Necessary security protections remain while a disputed result is investigated; statutory rights are preserved.

The purchasing flow is for adults able to contract. Children's use requires appropriate safeguards and is not authorised without limits by this notice. We explain material changes as required before applying them; a notice update does not replace consent where a new purpose needs it.