Privacy policy

How Northstar AI Solutions handles information in Shiftlog. Last updated October 8, 2026.

Who we are, and who the information belongs to

Shiftlog is a shift notes and shift tracking service operated by Northstar AI Solutions. Organizations subscribe and their staff use it at work.

The notes belong to the organization, not to us. Your employer decides who may read and write them, and an administrator at your organization can see what you post. We process that content to run the service for them. If you want a note changed or removed, ask your administrator first; we will act on their instruction.

What we collect

• Account details. Your work email address, your display name, your role, and which organization and groups you belong to. Accounts are created by your administrator or by us at their request; we do not sign people up from the public.
• What you write. Notes, comments, edits, attachments, and the follow-ups and reminders attached to them. We keep a revision history of notes, so an earlier version of something you edited continues to exist.
• Use of the service. Sign-in and sign-out events, session activity used to time out idle sessions, which notes an account has opened, and an audit log of administrative actions such as adding or disabling a user.
• Questions you ask the AI. The text of the question and which notes were used to answer it.
• Technical records. Ordinary server and security logs, including IP address, browser user agent, and the time of each request.
• Historical records you ask us to import, if your organization buys an import of notes from a previous system.

We do not use advertising or analytics trackers, we run no third-party tracking scripts, and we do not sell personal information or share it for cross-context behavioral advertising. We do not ask for or store payment card numbers; Stripe handles those directly.

Why we use it

To provide the service: to show your team their notes, to let people find past notes, to send the daily digest and the reminders your organization has enabled, to keep accounts secure, to bill your organization, and to answer your support requests. We also use aggregate, non-identifying measures of reliability and performance to keep the service working.

We do not use your notes to train AI models, and our providers are contractually barred from using data submitted through their APIs to train theirs.

Who else processes it

We use a small number of service providers, each only for the purpose listed. They act on our instructions and may not use the information for their own purposes.

• Supabase hosts the database and the authentication system. Your notes and account records live there.
• Vercel hosts and serves the application.
• OpenAI provides the AI features. When you ask a question, the question and the relevant passages of the notes it is answering from are sent to be processed. Notes are also converted into numerical representations for search.
• Resend delivers our email, including digests, reminders, and password resets.
• Stripe handles billing and payments.

All of them process information in the United States. We add providers only where we need them, and we will update this page before a new one handles your content.

How long we keep it

Notes and their revision history are kept for as long as your organization keeps its account, because the point of the service is a durable record. Security and audit logs are kept while they remain useful for investigating access and abuse. When an account is closed we delete or return the organization’s content within 30 days of the request, except where we are required to keep records for tax or legal reasons, such as invoices.

How it is protected

Access requires a password over an encrypted connection. Information is encrypted in transit and at rest. Accounts can only see their own organization’s notes, enforced in the database itself rather than only in the application. Sessions sign out automatically after a period of inactivity. Membership is re-checked on every request, so disabling an account takes effect immediately rather than at their next sign-in.

No system is perfect. If we discover a breach affecting your information, we will tell the affected organization promptly and describe what happened and what we are doing about it.

Your choices

You may ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live you may also have the right to object to certain processing, to ask us to restrict it, or to appeal a decision we make about your request. We do not charge for this and we do not treat anyone differently for asking.

Write to j@covenantsystems.ai from the address on your account. We answer within 30 days. Because the notes belong to your employer, requests to delete work content are referred to them, and we will tell you when we do that and who to contact.

You can stop the digest and reminder emails without losing your account: ask your administrator or email us.

Children

Shiftlog is a workplace tool. It is not intended for anyone under 16, and we do not knowingly collect information from children.

Changes

If we change this policy in a way that materially affects how we handle your information, we will update the date at the top of this page and tell the administrator at your organization before the change takes effect.

Contact

Northstar AI Solutions, j@covenantsystems.ai. For anything else, including help with your account, see customer support.