Privacy policy

Version of 11 October 2026

1. Who processes your data

Vercane, publisher of Staff Flow (contact@staff-flow.cloud), is responsible for your account data.

For the information a company enters about its team (schedules, absences, names given…), the company is the controller and Vercane acts on its behalf, as a processor.

2. What data

Account: name, email address, photo, ID and language of your Google account; your Staff Flow number (SF-…) and the name you choose.

Companies: name, time zone, image, roles, sites and positions.

Schedule and requests: shifts, swaps, leave and unavailability (no medical reason is asked), change history.

Messaging: messages, mentions, translations requested.

Telegram (if you link it): chat ID and username.

Devices: notification token, platform and device language.

Billing: company name, owner name, amounts and periods. We never receive your bank card details.

Technical data: server logs (including IP address) and an action log, for security.

3. Why

To provide the service you use (performance of the contract): schedule, requests, messaging, notifications.

Security, abuse prevention and identity checks (legitimate interest).

Billing and accounting (legal obligation).

Your data is never sold and is not used for advertising.

4. Who has access

Members of your companies see what their role allows: the schedule, names, and your Telegram only if you choose to show it.

Our technical providers: OVHcloud (server hosting), Google (sign-in and Firebase Cloud Messaging notifications), Telegram (if you link it), and the payment provider when you pay.

Messages are translated on our own server: they are not sent to an outside translation service.

5. Where

The Staff Flow server is currently located in Australia (OVHcloud). For people in the European Union, this is a transfer of data outside the European Union.

6. How long

Account: as long as it exists. Deleted “as a ghost”, it is kept so you can come back; erased permanently, your personal data is erased at once and only an anonymous “Ghost” remains in company history.

Company: until it is deleted, at the latest 15 days after its subscription ends.

Invoices: 10 years (legal obligation).

Backups and technical logs: a limited time, for security and recovery after an incident.

7. Your rights

You can access and download your data (“My profile” → “Export my data”), correct it (name), and delete your account (“My profile” → “Delete my account”). You can also object to processing or ask for it to be restricted by writing to contact@staff-flow.cloud.

For data entered by a company, please contact the company first; we will help it reply.

You can complain to the data protection authority of your country (in Ukraine: the Ukrainian Parliament Commissioner for Human Rights; in France: the CNIL).

8. Security

Encrypted connections (HTTPS), role-based access, download links valid for a few minutes, Telegram verification to change Google account.

9. Storage on your device

The app keeps your session and a copy of the schedule on your device, to work offline. Neither the app nor the website uses advertising trackers or audience measurement.

10. Changes

This policy may change; significant changes are announced in the app.