Privacy Policy
This policy explains how MixCommerce ("MixCommerce", "we", "us") handles personal data in MixStaff, a workforce time, attendance and team management product. It should be read with the MixCommerce Privacy Policy published at mixcommerce.co and with our GDPR Policy.
1. Who is responsible for which data
MixStaff is a tool that an organization (your employer, the "Customer") chooses to use. For the data about employees, contractors and other people that the Customer places in MixStaff or collects through it, the Customer decides why and how the data is processed. The Customer is the controller of that data and MixCommerce acts as its processor, handling the data on the Customer's documented instructions.
This means the Customer, not MixCommerce, decides which features to switch on, what to collect, who may see it, how long to keep it and on what legal basis. The Customer is also responsible for informing its people, for any consultation required by local employment law and for answering requests from them. If you are an employee and have a question about your data, contact your employer first.
MixCommerce is the controller only for limited data it needs to run its own business: account and billing contact details of Customer administrators, enquiries sent to us, and website and security data about visitors and sign-ins.
2. Data that MixStaff can process
What is actually collected depends on the settings the Customer chooses. Optional monitoring features are off by default.
| Category | Examples |
|---|---|
| Account data | Name, work email, role, job title, timezone, password hash, two-factor settings, profile photo |
| Time and attendance | Clock in and out, breaks, timers, timesheets, leave requests, schedules |
| Activity data (optional) | Intervals of active or idle time and counts of input events. MixStaff does not record what is typed |
| Application and website usage (optional) | Application names and website domains with durations |
| Screenshots (optional) | Images captured while a timer runs, if the Customer enables them |
| Location (optional) | Position at clock in or out, only if enabled by the Customer and accepted by the person |
| Device and security data | Device name and platform, API key hashes, IP address, audit log entries |
| Communications | In-app notifications and operational emails |
MixStaff does not collect keystroke content, passwords, clipboard contents, form values, audio or webcam images.
3. How data is used
Data is used to provide the features the Customer has configured: tracking and approving time, managing attendance and leave, producing reports, sending notifications, securing accounts and operating the service. MixCommerce does not sell personal data, does not use Customer data for advertising and does not use it to build profiles for its own purposes.
4. Customer controls
The Customer can configure the following in MixStaff:
- which monitoring features are enabled, and the purpose and legal basis it records for each;
- who can view identifiable data, by role and team;
- retention periods for activity data, screenshots, audit logs, notifications and other records;
- privacy notices shown to its people, and a request workflow for access, correction, deletion, restriction and objection;
- export and deletion of data about a person, and a record of incidents, vendors and impact assessments.
Because the Customer decides what to collect and for how long, the Customer is responsible for those decisions and for keeping them lawful in the places where it operates.
5. Products, services and APIs we use
MixStaff relies on the following third-party services. Which ones apply to a given deployment depends on its configuration. Each provider acts under its own terms and privacy notice.
| Service | Purpose | More information |
|---|---|---|
| MongoDB | Application database software. Hosting location depends on the deployment | MongoDB Privacy Policy |
| Cloudflare R2 | Private object storage for screenshots, photos and exports (S3 compatible API) | Cloudflare Privacy Policy |
| Paddle | Subscription billing and payments, acting as merchant of record | Paddle Privacy Policy |
| Google reCAPTCHA | Abuse protection on sign in and registration pages, when enabled | Google Privacy Policy and Terms |
| Google Sign-In (OAuth 2.0) | Optional single sign-on. Email, name and profile picture are read at sign-in | Google Privacy Policy |
| Microsoft identity platform | Optional single sign-on. Email, name and profile information are read at sign-in | Microsoft Privacy Statement |
| SMTP email provider | Delivery of account and notification emails, using a provider chosen by the operator | Provider notice applies |
| Slack | Optional integration that posts selected events to a channel chosen by the Customer | Slack Privacy Policy |
| Atlassian Jira | Optional integration for projects and tasks configured by the Customer | Atlassian Privacy Policy |
| Webhooks and API | Events sent to endpoints, and API access granted by keys, that the Customer configures | The Customer is responsible for the receiving system |
We do not use third-party advertising or analytics trackers in MixStaff.
6. Cookies and local storage
MixStaff uses a session cookie to keep you signed in and to protect forms against forgery. It also stores interface preferences, such as which menu groups are collapsed, in your browser. These are necessary for the service and are not used for tracking. Where reCAPTCHA is enabled, Google may set its own cookies on sign in pages. The privacy request form does not use Google or any third party: it runs a short proof of work check on your device and our own server, which sets no cookies and shares no data.
7. Retention
Retention periods for Customer data are set by the Customer in MixStaff. When a Customer ends its subscription, we delete or return its data as described in the Terms of Service. Backups are overwritten on the operator's backup schedule. Our own business records are kept as long as needed for the purposes described above and to meet legal obligations.
8. Security
We apply technical and organizational measures that include tenant separation, role based access, hashed passwords, optional two-factor authentication, encrypted connections, signed short-lived links for private files and audit logging. No system is completely secure. Customers should also apply their own access policies and keep credentials confidential.
9. International transfers
Data may be processed in countries other than where you live, depending on the hosting and providers used. Where personal data from the European Economic Area or the United Kingdom is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses. Details are available on request.
10. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. For data processed in MixStaff on behalf of an employer, please contact your employer, who will respond or instruct us. For data for which we are the controller, write to support@mixcommerce.co. You may also complain to your data protection authority.
11. Changes
We may update this policy and will publish the new version here with its date. Where a change is material we will notify Customer administrators.