Data Retention Policy

1. Purpose

This policy describes what data Shift Copilot retains, for how long, where it is stored, and how it is deleted. It applies to all data processed by Shift Copilot on behalf of customers.

2. Retention Schedule

Data Type	Retention Period	Basis
Shift Handover Reports	24 months from date of creation	Supports handover record-keeping obligations under the WHS (Mines) Regulations 2022 (WA) and equivalent state/territory mining frameworks
Attached Photos	24 months from date of upload	Forms part of the handover record
User Account Data	Duration of active subscription + 30 days post-termination	Required for service delivery; deleted promptly on termination
Session Tokens	14 days from creation or logout	Security — expired tokens are purged automatically
Invitation Records	90 days from creation	Administrative record of access grants
Logged-out Demo Activity	Up to 90 days	Entered supervisor name, entered site, tool, timestamp and note length only; retained for product testing and misuse monitoring. Demo notes and generated report content are not stored.
Email Logs	90 days	Support and troubleshooting
Application Logs	30 days	Security monitoring and error resolution

3. Where Data Is Stored

Shift Copilot stores data using the following infrastructure:

• Handover reports and user data: Neon Postgres database, hosted in Australia (AWS Sydney, ap-southeast-2 region)
• Attached photos: Vercel Blob storage, served via global CDN
• Application hosting: Vercel, global CDN with primary US infrastructure

Handover reports and user data are stored in Australia (Neon, AWS Sydney). Shift notes are sent to Anthropic's US-based API for report generation. Under Anthropic's standard commercial API terms, inputs and outputs may be retained for up to 30 days unless separate retention terms have been agreed. Customers requiring AI processing to remain fully on-shore should contact us; on-shore AI processing via AWS Bedrock (Sydney) is on our development roadmap.

4. Data Ownership

All shift handover data belongs to the Customer. Shift Copilot does not use Customer data for any purpose other than service delivery. Customer data is never sold, shared with third parties for commercial purposes, or used to train AI models beyond what is required to generate the Customer's own reports.

5. Deletion Process

Deletion is currently carried out manually by the Shift Copilot team in response to a request or on termination, rather than by an automated lifecycle job; automated scheduled deletion is on our roadmap. On termination of a subscription, or on a verified deletion request:

• User accounts are deleted within 30 days
• Active session tokens expire after 14 days and are revoked as part of account closure
• Handover reports are, by default, retained for the remainder of the 24-month audit-support period and then deleted; a Customer may request earlier deletion (see below)
• The Customer may request early deletion of all data by emailing jordan.deboer807@gmail.com; we action verified requests within 30 days, except where a record must be retained to meet a legal or regulatory obligation
• Deletion certificates are available on request

6. Data Export

Customers may request an export of their handover report data at any time during their subscription. Exports are provided in PDF format within 5 business days of request. Contact jordan.deboer807@gmail.com to request a data export.

7. Regulatory Compliance

The 24-month retention period for handover reports is set to support record-keeping obligations and review processes connected to:

• Regulation 630, Work Health and Safety (Mines) Regulations 2022 (WA)
• Equivalent provisions under NSW, QLD, SA, NT, VIC, and TAS mining regulations

Customers are responsible for ensuring their use of Shift Copilot meets any additional retention requirements applicable to their specific jurisdiction or operation.

8. Changes to This Policy

Shift Copilot may update this policy with 30 days notice to active customers. The current version is always available at shiftcopilot.com.au/legal/data-retention-policy.

9. Contact

For questions about data retention or to request deletion or export: jordan.deboer807@gmail.com