Shift

Privacy Policy

Effective: May 25, 2026 · GDPR · CCPA · CPRA

Your privacy matters. This policy explains what data Shift collects, why we collect it, and the rights you have over it.

1. Introduction & Scope

Who we are

Shift, LLC ("Shift," "we," "us," or "our") operates the Shift mobile application and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use Shift.

This policy applies to all users of the Shift platform, including passengers, driver-partners, and visitors to our services, regardless of location. Where required by law, additional region-specific rights are described in the relevant sections below.

Applicability — GDPR (EEA/UK residents)

If you are located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR applies to our processing of your personal data. We process your data under the lawful bases described in Section 3 and you have the rights described in Section 6.

Applicability — CCPA (California residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the CPRA grants you specific rights regarding your personal information. See Section 6 for a full description of your CCPA rights, including the right to opt out of the sale or sharing of your personal information.

Shift does not sell your personal information to third parties for monetary consideration.

2. Information We Collect

Information you provide directly

Location information

We collect precise GPS location data when the app is in use. For drivers, we collect location in the background while you are online (status: active) to enable ride matching and navigation. For passengers, we collect location to identify your pickup point and show nearby drivers.

You may disable location access through your device settings, but doing so will prevent core features of Shift from functioning.

Ride and transaction data

Device and usage information

Information from third parties

3. How We Use Your Information

To provide the service (Contract performance — GDPR Art. 6(1)(b))

For safety and security (Legitimate interest — GDPR Art. 6(1)(f))

To improve our services (Legitimate interest — GDPR Art. 6(1)(f))

For marketing and communications (Consent — GDPR Art. 6(1)(a))

You can manage notification preferences in Menu → Settings at any time.

Legal compliance (Legal obligation — GDPR Art. 6(1)(c))

4. Sharing Your Information

Between passengers and drivers

When a ride is matched, we share limited profile information between the passenger and driver: first name, profile photo, rating, and vehicle details (make, model, color, plate). Phone numbers are never shared directly — all communication is routed through the app.

Service providers (sub-processors)

We share data with vendors who help us operate Shift. All sub-processors are bound by data processing agreements:

Legal and safety disclosures

We may disclose your information to law enforcement, government agencies, or courts when:

We will notify you of government data requests to the extent permitted by law.

Business transfers

In the event of a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred to the acquiring entity. We will provide notice via email or in-app notification before your information becomes subject to a different privacy policy.

We do not sell your personal information

Shift does not sell, rent, or trade your personal information to third parties for monetary consideration. We do not share personal information for cross-context behavioral advertising. This applies to all users, including California residents under the CCPA.

5. Data Retention

Retention periods by category

Account deletion

When you request account deletion, we begin the deletion process within 30 days. Some data may be retained longer where required by law (e.g., tax records, fraud investigation records). Anonymized and aggregated data derived from your account may be retained indefinitely as it can no longer identify you.

To delete your account, use the in-app path: Menu → Settings → Delete Account. Alternatively, submit a request via our Delete Account request page.

Driver data after deactivation

Driver-specific data (SSN reference, background check results, vehicle records) is retained for 5 years after deactivation to comply with TNC regulatory requirements in North Carolina and to defend against legal claims arising from rides completed during the active period.

6. Your Privacy Rights

Rights for all users

Regardless of where you live, you may:

GDPR rights (EEA and UK residents)

If you are in the EEA or UK, you have the following rights under GDPR:

To exercise any right, contact dpo@shift.app. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

CCPA rights (California residents)

If you are a California resident, you have the right to:

To submit a CCPA request, contact privacy@shift.app or use the in-app request form. We will verify your identity before responding. Authorized agents may submit requests on your behalf with written proof of authorization.

How to submit a data request

Email privacy@shift.app with subject line "Privacy Request" and include:

We will acknowledge your request within 10 business days and fulfill it within 45 days (extendable by an additional 45 days with notice for complex requests). We do not charge a fee for reasonable requests.

Shine the Light (California Civil Code § 1798.83)

California residents may request a list of third parties to whom we disclosed personal information for direct marketing purposes in the past year. Shift does not share personal information with third parties for their own direct marketing purposes, so no such list currently applies. To confirm or submit a request, contact privacy@shift.app.

7. Security

How we protect your data

Data breach response

In the event of a data breach affecting your personal information, we will:

To report a security vulnerability, email security@shift.app.

Your responsibility

You are responsible for maintaining the confidentiality of your account credentials. Do not share your password or grant account access to others. Shift will never ask for your password via email, phone, or in-app message. If you suspect your account has been compromised, contact us immediately at privacy@shift.app.

8. Children's Privacy

Shift is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account or provided personal information through Shift, please contact privacy@shift.app and we will delete the account and associated data within 30 days.

9. International Transfers

Cross-border data transfers

Shift is based in North Carolina, USA. If you use Shift from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country.

Safeguards for EEA/UK transfers

For transfers of personal data from the EEA or UK to the United States, we rely on:

You may request a copy of the applicable transfer mechanisms by contacting dpo@shift.app.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

For non-material changes (formatting, clarifications, typos), we will update the policy without prior notice. Continued use of Shift after the effective date of any change constitutes your acceptance of the revised policy.

Current version: May 25, 2026. Prior versions of this Privacy Policy are available upon request by emailing privacy@shift.app.

CCPA — Categories of Personal Information Collected

Contact

Privacy questions or data requests

General inquiries, CCPA requests, or GDPR rights: privacy@shift.app

EU/UK Data Protection Officer: dpo@shift.app

Security vulnerabilities: security@shift.app