Privacy Policy

1. Introduction

Helm Shift ("we," "us," or "our") is a software platform built for independent restaurants. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using Helm Shift, you agree to the practices described here.

We are based in Nova Scotia, Canada, and we operate in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

2. Information we collect

Information you provide

• Account information: Restaurant name, owner name, email address, phone number, and login credentials when you create an account.
• Operational data: Information you input into the platform, including staff names and roles, schedules, shift notes, menus and recipes, and the daily sales figure a manager enters at close.
• Staff employment details you enter: Each team member's hourly wage rate, target weekly hours, and an optional 1–5 skill rating set by a manager. The wage rate is used to calculate labour costs and to produce the payroll-hours export; the skill rating is used to weight who is suggested for a shift. Helm Shift does not run payroll and never collects Social Insurance Numbers or banking details.
• Staff-provided data (staff phone view, a mobile-friendly web link, no app install): Availability windows, time-off requests, sick-call events, shift swap/drop requests, voice notes, photos submitted with an issue report, optional opt-in contact-sharing flags, and device push-notification subscriptions.
• Messages: the content of messages sent through Helm Shift between managers and staff and in group conversations, together with who sent each one and when. Messages are visible to the people in the conversation and to the restaurant's managers, and they can be produced to the restaurant that owns the account. Helm Shift staff do not read them except where it is necessary to investigate a support request, a security incident, or a report of misuse, or where the law requires it.
• Hours worked, where your restaurant turns clocking in on: The time a staff member clocks in and out, the times they start and end a break, which method confirmed the punch (the code posted in the restaurant, or a proximity check where the restaurant has enabled one), and any correction a manager records afterwards together with the reason they give for it. Clocking in is off until a restaurant chooses to use it. A punch records a time and nothing else: we do not record where a staff member is. Where a restaurant enables the proximity option, the device's position is used to answer "close enough to the restaurant?" and is discarded without being written down; only the answer is kept.
• Performance and cover records a manager creates: A manager can record a note about how a particular shift went for a particular person, choose a category for it (punctuality, reliability, teamwork and so on), and set how much it should count. They can also record a "strike" where somebody did not turn up for a shift they had accepted. Helm Shift combines these with facts the system already holds, such as how often the person picks up open shifts and whether they clocked in late, into a single cover readiness score out of 100, which managers see when they are deciding who to ask to cover a shift. The text of a manager's note is visible only to the restaurant's owners and full managers. The staff member it is about is always shown the date, the category and the number of points it moved their score by, is never shown the text, and can record that they believe it is wrong (see "Your rights" below). The score is shown to the person it describes.
• Communications: Messages, feedback, or questions you send us via email, chat, or other channels.

Information collected automatically

• Usage data: Log files, IP address, browser type, pages visited, and time spent in the application.
• Operational metrics: A "pickup score" tracking how often a staff member has voluntarily picked up an open shift. This is visible to the employee on their own profile and used by managers when proposing replacements for sick calls.
• Cookies: Small data files stored on your device to keep you signed in and remember your preferences.

Information we do not collect

We do not collect Social Insurance Numbers (SINs), employee banking information, biometric identifiers, or any data not necessary to deliver the service. We do not process payroll, tax filings, or any financial transactions on your behalf. We do not record a medical reason when a staff member calls in sick, only the fact and time of the call. We do not store the location of any staff member, at work or away from it, and we do not track anyone's position over time.

3. How we use information

• To provide and operate the Helm Shift platform.
• To generate AI-powered insights and recommendations relevant to your restaurant operations.
• To communicate with you about updates, changes, or support requests.
• To improve the platform based on aggregated usage patterns.
• To comply with legal obligations.

4. AI processing

Helm Shift uses a third-party AI service to power forecasting, the AI assistant, photo/voice interpretation, and replacement-suggestion features. Our current provider is Anthropic (Claude API). When you use these features, the relevant operational data is sent to the AI provider for processing. Specifically: for schedule generation we send each team member's name, their manager-set skill rating, their available days, their target weekly hours and the dates of their approved time off; for the AI assistant we send the question together with the restaurant's own operating figures and the same staffing details; and for photo and voice interpretation we send the image or the note itself. We do not send individual wage rates, phone numbers or email addresses to the AI provider, and labour cost is aggregated before it leaves our systems. The provider's data handling is governed by its own privacy policy and commercial terms, under which it does not retain Helm Shift customer data for training purposes.

When you record a voice note, your browser may convert the speech to text using its own built-in speech recognition before the note is saved. On some browsers (for example Google Chrome) that conversion is performed by the browser maker's speech service rather than by Helm Shift, and it is governed by that browser maker's privacy policy. The audio recording and the resulting text are then handled by Helm Shift as described above. If you prefer not to use browser speech recognition, you can type your note instead.

AI output is a suggestion, never an automated decision.

No decision about a person is made automatically, including the ones that are not AI. The cover readiness score described in section 2 is ordinary arithmetic rather than AI: a weighted sum of facts the system holds and the notes a manager has recorded. It orders a list of suggestions and nothing more. A person is only offered a shift, assigned to one, or passed over when a manager acts, and a manager can ask anyone regardless of where the score places them. No part of Helm Shift changes somebody's schedule, pay or standing on its own, and the score is never used to end an engagement.

We do not send sensitive personal information (such as government identifiers or financial data) to any AI service.

5. Data storage and security

Helm Shift is hosted on Cloudflare (Pages and Workers) with the database and authenticated storage operated by Supabase. Application data is encrypted in transit (HTTPS / TLS) and at rest. Voice notes and photo uploads from the staff phone view are stored in a private Supabase Storage bucket accessible only to members of the relevant restaurant.

Both Cloudflare and Supabase maintain SOC 2 Type II certifications. While we use reasonable administrative, technical, and physical safeguards, no system is 100% secure. We cannot guarantee absolute security and you use the service at your own risk.

Breach notification. If we become aware of a personal-information breach that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada (and, where applicable, the Commission d'accès à l'information du Québec) as required by law, generally within 72 hours of confirming the incident.

6. Data sharing

We do not sell your data. We share information only in these circumstances:

• Service providers: With the third party providers we use to deliver Helm Shift, including Cloudflare (hosting), Supabase (database, authentication and file storage), Anthropic (AI features), Resend (transactional email), and Stripe (payments). Each is bound by its own privacy obligations and by our agreements with them. Every provider that processes customer data is listed, with its purpose and location, on our subprocessors page, which we keep current.
• Legal compliance: When required by law, court order, or to protect our rights and the safety of users.
• Business changes: If Helm Shift is acquired, merged, or otherwise transferred, your data may be transferred as part of that transaction. You will be notified.

7. Your rights

Under PIPEDA and applicable laws, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your account and associated data.
• Withdraw consent for our use of your information at any time.
• Lodge a complaint with the Office of the Privacy Commissioner of Canada.

To exercise any of these rights, email us at tmacdougall@helmai.ca.

Two of these you can exercise inside the product, without asking anyone. On your own profile page you can see your cover readiness score, every factor that is moving it, and every manager note that has changed it, with its date, its category and the points. If you think one is wrong, there is a button on it: what you write goes to your restaurant's managers, who are asked to look at it and reply, and you see their reply in the same place. Recording an objection does not change the note or your score on its own, and raising it again reopens it if you are not satisfied with the answer. Helm Shift stores the objection and the reply; the decision belongs to your employer, who is the one that holds the record.

8. Data retention

We keep each kind of record for a stated period, and then we delete it. Where employment standards legislation sets a minimum period for a record, that minimum governs: we keep the record for at least that long, and a shorter setting or an earlier cancellation does not override it.

• Hours worked: clock-in and clock-out times, breaks, the method that confirmed each punch, and any correction a manager records with its reason: kept for 36 months from the date of the shift, then deleted, record by record. This is a legal minimum and not a preference. Nova Scotia's Labour Standards Code requires a record of hours worked to be kept for at least 36 months after the work has been performed, and Ontario's Employment Standards Act, 2000 requires three years. The duty is the restaurant's; our job is to make sure the record still exists when an inspector asks for it. There is no setting that shortens this period.
• Availability and shift history: kept for 36 months from the date of the shift, then deleted, so that the schedule a person worked and the hours recorded against it age out together.
• Photos and voice notes submitted with an issue report: deleted 90 days after the related report is marked resolved.
• Messages: kept for 24 months from the date sent, then deleted.
• Sick-call records: kept for 24 months for scheduling-pattern analysis, then deleted.
• Manager notes about a shift, and the objections raised against them: kept for 24 months from the date the note is about, then deleted. A judgement about how one shift went is not a payroll record, so it ages out sooner than the hours it sits beside. Deleting a note deletes any objection recorded against it, and deleting a person's record deletes the notes about them.
• Strikes: kept while the restaurant keeps them open and cleared by a manager at any time; they are removed with the staff member's record when that record is deleted.
• Account closure: when a subscription ends, the account becomes read‑only for 30 days so that you can export everything, including the full hours record for any date range. After that window we delete or anonymize your personal data within 90 days, with one exception: records of hours worked are kept to the end of their 36‑month period as described above, because they are your statutory record and destroying them early would leave you unable to answer an inspection. They are deleted as soon as that period ends. You may ask us in writing to delete them sooner, and we will do so only where the law allows it and after telling you in plain terms what you would be giving up.
• Backups: our dated backups are pruned on a 90‑day cycle, so a deleted record is gone from backups within 90 days of its deletion.

If you want a written confirmation of deletion, with the date, email privacy@helmai.ca and we will send one.

A staff member can see their own recorded hours in the Service and can flag an entry they believe is wrong. Corrections are made by their manager, and the correction is recorded with the reason given.

9. Staff under 18

Helm Shift is a business tool. Accounts are created by the restaurant that subscribes to the Service, not by individuals signing up for themselves.

Restaurants lawfully employ people under 18, and those staff members may be given access to the staff portal by their employer. Where that happens we process their information, including name, role, contact details, availability, scheduled and worked shifts, time off requests and sick call records, on the instruction of their employer and for the same purposes as for any other staff member. The limits set out in section 2 apply equally: we do not collect Social Insurance Numbers, banking details, payroll information, biometrics, or medical reasons for absence.

We do not market Helm Shift to anyone under 18, and outside this employment context we do not knowingly collect information from anyone under 18.

The employer is responsible for giving its staff, including staff under 18, appropriate notice of the tools it uses and for obtaining any consent required by law. A staff member, parent or guardian who wants to see or correct information held about them should contact their employer, or contact us using the details in section 12 and we will work with the employer to respond.

10. International users

Helm Shift is operated from Canada. If you access the service from outside Canada, you understand that your information may be transferred to, stored in, and processed in Canada or other countries where our service providers operate. Service providers based outside Canada are bound by contractual safeguards (Data Processing Agreements and, where applicable, EU Standard Contractual Clauses) requiring protection equivalent to Canadian law.

10a. Quebec residents (Law 25)

If you are located in Quebec, you have additional rights under An Act respecting the protection of personal information in the private sector (Law 25), including the right to data portability and the right to be informed before your personal information is used to render an automated decision. Helm Shift does not currently use any system to render decisions about you in a fully automated way. Our Privacy Officer for Quebec inquiries is the same as listed above and may be reached at privacy@helmai.ca.

10b. Commercial email (CASL)

Helm Shift sends marketing email only to recipients who have given express or implied consent under Canada's Anti-Spam Legislation. Every commercial email from Helm Shift identifies the sender, identifies us as the sender, and provides a one-click unsubscribe link. Service emails directly related to your account (e.g. billing receipts, security notices) are sent regardless of marketing-email preferences.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date and, for material changes, notify you by email or through the platform.

12. Contact us

For any questions about this Privacy Policy or how Helm Shift handles your information:

Tyler MacDougall, Founder
Email: tmacdougall@helmai.ca
Helm Shift, Halifax, Nova Scotia, Canada