Privacy notice

Privacy, without the fine-print fog.

shyfts.work is a workplace learning platform. That means we hold information about people who are learning, mentoring, and running programmes. This notice explains what we hold, why we hold it, and what you can ask us to do about it — in plain language.

Effective date: 17 August 2026
Applies to: shyfts.work and related services
Reading time: About 6 minutes

A reading note: section 01 is a genuine summary of everything that follows. The rest adds detail — it does not add surprises.

The short version

We collect what we need to run apprenticeships and assessments, we do not sell it, and you can ask to see, correct, or delete your information at any time.

Your employer or learning provider decides who is invited onto the platform and what programmes you take part in.
Assessments, case studies, and recall training records are visible to your mentor and the administrators of your organisation — not to other organisations.
We use a small number of trusted providers (hosting, email delivery, AI assistance) to operate the service.
We do not sell personal information or use it for advertising.

Information we may collect

We only collect information that supports the learning relationship between a mentee, a mentor, and the organisation running the programme.

Account details: name, work email, role, organisation, and authentication data such as password hashes and sign-in timestamps.
Programme content: self-assessments against SFIA 9 and the RISE 2.0 Compass, case studies, mentor feedback, outcomes, and recall training records.
Requests and enquiries: information you submit through access request or contact forms, including phone number and country when you provide them.
Uploaded material: documents you attach to a submission or pre-assessment.
Technical information: log data, device and browser information, and security events such as failed authorisation attempts.

We do not ask for sensitive categories of personal information, and we ask that you do not include them in free-text fields or uploads.

How information is used

To provide the platform: accounts, invitations, assessments, case studies, and recall training.
To support mentoring: showing mentors the assessment history and progress of the mentees assigned to them.
To generate assistance: drafting case study suggestions and provisional certification feedback using an AI model. A human always reviews and decides.
To communicate: invitations, notifications, and replies to enquiries you send us.
To keep the service safe: monitoring for suspicious activity, abuse of request forms, and failed authorisation checks.
To improve the service: understanding which parts of the platform are used, in aggregate.

Information you provide is never used to train third-party foundation models on your behalf.

When information is shared

Information is shared only in these situations:

Within your organisation: with your mentor and the administrators who manage your programme.
With service providers: hosting, database, email delivery, and AI processing partners who act on our instructions under contract.
For legal reasons: when we are required to by law, or to protect the rights and safety of people using the platform.
On a change of control: if the business is transferred, information moves with it under the same commitments.

Organisations are isolated from one another. A mentor, administrator, or mentee in one organisation cannot see the records of another.

Your choices and rights

Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal information, and to object to certain processing.

Ask us for a copy of the information we hold about you.
Ask us to correct anything inaccurate, or to delete information we no longer need.
Ask your organisation's administrator to remove your account from a programme.
Opt out of non-essential email at any time; service and security messages will continue while your account is active.

Where your employer or learning provider is the controller of programme records, we may direct your request to them and support them in answering it.

Retention and security

We keep programme records for as long as your organisation maintains its account, and then for a limited period required for legal and audit purposes.
Access is controlled by role, and enforced at the database level so that records are only readable by the people entitled to see them.
Data is encrypted in transit, and passwords are stored using one-way hashing.
Security events — including unusual request volumes and failed authorisation checks — are logged and reviewed.
No system is perfect. If a breach affects you, we will notify you and the relevant authority as required by law.

Updates to this notice

We update this notice when the platform changes or when the law requires it. The effective date at the top always reflects the current version. If a change materially affects how we handle your information, we will tell account holders directly before it takes effect.

Questions about this notice can be sent to hello@shyfts.work.