Privacy Policy
Last updated 4 August 2026.
The short version. Delegyn Shift stores who works where and when. It stores nothing about the people your agency supports — no names, no diagnoses, no support plans, no service notes. There is nowhere in the product to enter that information, which is a deliberate design decision and not a setting you can change.
Who this covers
Delegyn Shift is workforce scheduling software for providers supporting people with intellectual and developmental disabilities. This policy describes what we collect from the agencies who subscribe and from the staff members those agencies invite.
The service is operated by BrightBench LLC, a Nebraska limited liability company. “We”, “us” and “our” below mean BrightBench LLC.
Your agency decides what goes into the product and who may see it. In data-protection terms your agency is the controller of its staff information and we process it on your behalf.
What we store
| Information | Why |
|---|---|
| Agency name, time zone, locations and the positions you schedule | To build your schedule. |
| Staff first and last name, position, work locations, hour preferences and availability | To know who can work which shift. |
| Staff email address, for anyone given a login | To sign in and reset a password. Staff without a login need no email. |
| Staff phone number (optional) | So a scheduler can reach someone. Not required, and nothing is sent to it today. |
| Shifts, assignments, time off, call-offs, lateness and no-shows | The schedule itself, and the attendance record your supervisors keep. |
| Password, stored only as a bcrypt hash | To verify a sign-in. We cannot read your password or recover it for you. |
| A session cookie | To keep you signed in. It is the only cookie the product sets. |
| Billing email, invoice history and a Stripe customer reference | To bill a paid account and answer questions about a past invoice. Only on paid accounts. Never a card number — those are entered on Stripe's own pages and we never receive them. |
What we do not store
- Anything about the people your agency supports. No individuals served, no diagnoses, no behaviour plans, no incident reports, no service or progress notes. The product has no field for any of it.
- No credential or certification records. Delegyn Shift records that a shift needs a med aide; whether a particular person holds a current certification remains your agency's responsibility and is not tracked here.
- No payroll or banking details, and no Social Security numbers.
- No analytics or advertising trackers. There is no Google Analytics, no advertising pixel, and no third-party script following you between pages.
This is worth stating plainly because it changes what a breach could expose. A serious failure on our side would reveal staff schedules and contact details. It could not reveal anyone's care information, because we never had it.
Who else processes this information
We use a small number of service providers to run the product:
| Provider | What they handle |
|---|---|
| Cloudflare | Hosting, DNS and this website. |
| Neon | The database where your schedule is stored. |
| Stripe | Payments. If you convert to a paid account, your agency name, billing email and card or bank details are handled by Stripe. Card numbers are entered on Stripe's own pages and never reach us — we hold only a customer reference and the invoice history. |
| Anthropic | The optional assistant. When a scheduler types a request in plain English, that sentence and the names needed to interpret it are sent to Anthropic's API to be turned into a structured instruction. See below. |
We do not sell your information, and we do not share it with anyone for advertising.
About the assistant
A scheduler can type something like “move Maria to Tuesday at Willow” instead of clicking through the grid. To do that, the sentence is sent to Anthropic's API along with the staff names, locations and positions needed to resolve it. The model only ever proposes a change; every change is applied by our own code after the same checks that apply to a change made by hand.
If you would rather no staff names left our systems for this purpose, do not use the assistant — the rest of the product works normally without it, and we can disable it for your agency on request.
Who can see what
Within your agency, access follows the role you give someone. Administrators see everything for your agency. Schedulers build and change schedules. Staff see only their own shifts and the openings offered to them — a staff member cannot see an unpublished schedule, cannot see attendance records, and is shown a count of colleagues on a shift rather than their names.
Agencies are separated from one another. No agency can see another agency's staff, schedules or anything else. We can see your data in order to operate and support the product; we do not look at it otherwise.
Keeping it safe
- Encrypted in transit with HTTPS everywhere.
- Passwords stored only as bcrypt hashes, never in a readable form.
- Sign-in links for invitations and password resets are single-use, expire, and are stored hashed rather than in the clear.
- Changing a password ends every existing session for that account.
No system is perfectly secure, and we will not claim otherwise. If we ever discover a breach affecting your information we will tell you without delay and tell you what we know, including what we do not yet know.
How long we keep it
We keep your agency's information for as long as your account is active. If you close your account, tell us and we will delete it; ask before you close it and we will provide an export first. Backups are kept for up to 90 days on Cloudflare R2, in the same account as the hosting above, and a deletion reaches them as those copies age out.
Your choices
You can ask us for a copy of your agency's data, ask us to correct it, or ask us to delete it. If you are a staff member rather than an administrator, your agency controls your record — ask your administrator first, and contact us if that does not resolve it.
Children
Delegyn Shift is a tool for employers and their staff. It is not directed at children and we do not knowingly collect information from anyone under 16.
Changes
If we change this policy we will update the date at the top, and we will tell subscribing agencies directly about any change that materially affects them rather than relying on you to notice.
Contact
Questions about privacy, or a request about your data: support@delegynshift.com.