Privacy Policy

Last updated: 12 October 2026

1. Who we are

Shift is made by Sambal Digital, Fijnaart, the Netherlands. We are responsible (the "controller") for the personal data described in this policy. Questions? Email info@sambal.digital.

This policy covers the Shift Android app, the web app at shift.sambal.digital and the website at sambal.digital/shift.

2. What we collect

Data	What and why
Your Google account	Your Google account id, name, email address and the link to your profile picture. We get these from Google when you sign in, and use them to create your account and recognise you.
Your cars	Make, model, year, odometer readings, service intervals and any photo you upload. Needed to show what maintenance is due.
Maintenance history	The service records you log: date, odometer, parts and the notes you add.
Marketplace profiles	Car profiles (make, model, service intervals, photo) that you choose to share with other users, and how often they are used.
Sign-in sessions	A securely hashed sign-in token with the time it was created and last used, so you stay signed in. A session expires after 30 days without use.
Transfer codes	When you hand over a car, a one-time code linked to that car. It is deleted automatically after 15 minutes.
Technical logs	Our servers keep standard logs, such as the IP address and time of a request and any errors, to keep Shift secure and working. Logs are kept only for a limited period.

On your device, the app stores your sign-in token so you don't have to sign in every time: in secure storage on Android, and in the browser's storage for the web app. We don't use cookies for tracking.

3. Why we may use it

• To provide Shift to you (performance of our agreement with you): your account, cars, history, photos, marketplace profiles and sessions.
• To keep Shift secure and working (our legitimate interest): technical logs, and enforcing our Terms of Use.
• To meet legal obligations, if a law requires us to keep or hand over data.

We don't use your data for advertising or profiling, and we don't make automated decisions about you.

4. Who can see your data

We don't sell, rent or share your personal data. Only in the situations below does anyone other than you see some of it:

• Google, when you sign in. You sign in with your Google account, so Google knows that you use Shift. We don't send your cars or maintenance history to Google. Google's own privacy policy applies to your Google account.
• Other Shift users, only when you choose to. Car profiles you share on the marketplace are visible to every Shift user, without your name. When you transfer a car, the new owner sees your name, the car and its full maintenance history before accepting it.
• Authorities, only if Dutch or EU law requires us to.

Shift runs on servers managed by Sambal Digital. Your car photos are stored in our own file storage, not with a third-party cloud provider.

5. How long we keep it

• Your account data, cars and history are kept for as long as you have an account.
• When you delete a car, its maintenance history, photo and any open transfer code are deleted too.
• When you transfer a car, it and its history move to the new owner's account.
• Sessions are deleted 30 days after their last use; transfer codes after 15 minutes.
• When your account is deleted, by you or by us, we delete your account, cars, history and photos. Marketplace profiles you shared can stay available without any link to you, because other users' cars rely on them.

6. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it;
• have incorrect data corrected;
• have your data deleted;
• restrict or object to how we use it;
• receive your data in a portable format.

To use any of these rights, including deleting your account, email info@sambal.digital from the email address of your Google account. We respond within one month. You can also file a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.

7. Security

All traffic to Shift is encrypted (HTTPS). Sign-in tokens are stored hashed, so a copy of our database can't be used to sign in as you. Only the people who build and run Shift have access to the servers.

8. Children

Shift is not meant for children under 16. We don't knowingly collect data from them.

9. Changes

If we change this policy, we update the date at the top. For important changes we let you know in the app or by email before they take effect.