1. Who we are
AfikShift ("we", "us") is operated by THE MHM NEXUS LTD, a company registered in England and Wales (company number 16762622), registered office: Enterprise Centre, Cranborne Road, Potters Bar, England, EN6 3DQ. THE MHM NEXUS LTD is the data controller for your personal data. Contact: contactus@afikshift.com.
AfikShift is an independent shift and earnings tracker. It is not owned, operated or endorsed by any employer, government department or public body, and it is not a payroll system.
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address, professional category, currency, default hourly rate, tax estimate percentage, notification preferences | Your account and earnings estimates | Contract |
| Password (stored only as a one-way hash) | Signing in | Contract |
| Shift records: shift type, templates, date, times, breaks, location, status, hourly rate | The shift manager, calendar and earnings | Contract |
| Payment records: amount, date, optional note | Payment tracking | Contract |
| Subscription status and purchase records from the app store | Providing AfikShift Pro | Contract |
| Referral codes and referral history | Referral rewards and fraud prevention | Legitimate interests |
| Security data: hashed session tokens, hashed one-time codes, failed sign-in counters | Protecting your account | Legitimate interests |
| Technical data: IP address and request details in server logs | Security and fault-finding | Legitimate interests |
We do not use advertising, analytics or tracking tools, and we do not sell your data or share it for marketing. This website does not use cookies.
3. Other people's information
Please do not enter other people's names, identification numbers or confidential workplace records in free-text fields such as location or payment notes.
4. How your data is protected
- On your phone, shift and payment records are encrypted, with the key held in the phone's secure keystore.
- Data travels between the app and our servers over HTTPS (TLS). Emergent states that its platform provides AES-256 encryption at rest and automatic encryption-key rotation.
- Before public launch, AfikShift is being tested in a preview environment with a local test MongoDB database. Emergent has confirmed that on first production deployment, preview data is migrated to a managed MongoDB Atlas database, after which preview and production databases are separate. Emergent reports that the production database has automatic hourly and daily backups retained for seven days, weekly backups retained for four weeks, monthly backups retained for twelve months, yearly backups retained for one year, and a continuous seven-day point-in-time recovery window. These production arrangements are not active for the preview database. AfikShift’s separate application-level encrypted backup script is not scheduled. We have not independently tested restoration.
- Fingerprint and face unlock are handled entirely by your phone. We never receive biometric data.
5. Who we share data with
We use service providers who process data on our instructions:
- Backend hosting: Emergent platform. The current preview environment uses local MongoDB. Emergent has confirmed that the first production deployment migrates preview data to managed MongoDB Atlas. Emergent states that its standard platform currently processes and stores data in the United States and India. UK or EU regional hosting and data-residency control require a separately arranged Enterprise option. AfikShift’s precise future production region is not yet confirmed.
- Transactional email (verification, password reset, account deletion): Emergent email service; the underlying delivery provider and processing location are not yet confirmed by the provider.
- Business email: Zoho Mail (for messages you send to contactus@afikshift.com)
- App store and payment provider for subscriptions, when paid subscriptions become available through the relevant store (such as Aptoide or Google Play), under that store’s own privacy policy.
Emergent has informed us that data-processing and international-transfer arrangements for the production services require further written clarification. We will verify appropriate contractual protections before enabling public accounts. The applicable processor terms, subprocessors and safeguards for transfers from the UK remain not yet confirmed by the provider; we are seeking written clarification before enabling public accounts. See Emergent’s DPA information and subprocessor information.
6. How long we keep data
- Account, shift and payment data: until you delete it or delete your account.
- Deleted shifts: kept in Recently Deleted for 90 days, then permanently removed.
- Sign-in sessions: up to 30 days; access tokens expire after 15 minutes.
- One-time codes and failed sign-in counters: approximately 15 minutes.
- Deleted-account audit record (internal identifier, hashed email and date): 65 days.
- Administrative action log: 365 days; store payment notifications: 90 days.
- IP addresses are used for security and rate limiting; short-lived failed sign-in counters expire after 15 minutes. Infrastructure request logs may retain IP addresses for a different period.
- Emergent application logs: 7 days under its standard documentation, or 30 days for Pro and Enterprise plans; the applicable AfikShift plan and retention should be verified. Server access and other infrastructure log retention: not yet confirmed by the provider.
- Subscription records in the application are deleted when an account is deleted. Any separate statutory accounting records and their retention are subject to applicable statutory accounting requirements.
7. Your rights
Under UK data protection law you can ask to access, correct, export, restrict or delete your personal data, and object to processing based on legitimate interests. You can request access to or a copy of your personal data by contacting us. The app provides a self-service JSON export once every seven days on all plans; for an additional export within that period, contact us by email. Pro also offers CSV and PDF reports. You can delete your account in the app or request assistance by emailing us. We normally respond to rights requests within one month, subject to applicable law.
You can complain to the Information Commissioner's Office (ico.org.uk), but please contact us first so we can try to help.
8. Children
AfikShift is intended for working adults and is not directed at children under 16.
9. Changes
We will update this page and the date above if this policy changes, and tell you in the app about significant changes.