Privacy Policy

Last updated: January 2026

1. Introduction

MyCompanyID ("we", "our", or "us") is operated by Shape.tech. We are committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, store, and protect your information when you use our digital staff verification platform.

By using MyCompanyID, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

  • Account Information: Email address, password, and organisation name when you register
  • Staff Profile Data: Names, job titles/roles, staff ID numbers, and profile photographs uploaded by organisation administrators
  • Contact Information: Any information you provide when contacting our support team

2.2 Information Collected Automatically

  • Device Information: Device type, operating system, and app version
  • Usage Data: How you interact with the app, features used, and timestamps
  • Log Data: IP addresses, browser type, and access times for security purposes

3. How We Use Your Information

We use the information we collect to:

  • Provide and maintain the MyCompanyID service
  • Enable staff identity verification by authorised parties
  • Authenticate users and secure accounts
  • Send service-related notifications and updates
  • Respond to support requests and enquiries
  • Improve and develop new features
  • Detect, prevent, and address technical issues or security threats
  • Comply with legal obligations

4. Data Sharing and Disclosure

We do not sell your personal data. We may share your information in the following circumstances:

  • Verification Purpose: When someone scans a staff QR code, they can view the staff member's name, role, photo, and verification status. This is the core function of the service.
  • Service Providers: We use trusted third-party services (hosting, analytics) who process data on our behalf under strict confidentiality agreements
  • Legal Requirements: When required by law, court order, or governmental authority
  • Business Transfers: In connection with any merger, acquisition, or sale of assets

5. Data Retention

We retain your personal data only for as long as necessary to provide our services and fulfil the purposes described in this policy. Specifically:

  • Active Accounts: Data is retained while your account remains active
  • Deleted Accounts: Upon account deletion, we delete your personal data within 30 days, except where retention is required by law
  • Staff Records: Organisations can delete staff records at any time, which removes the data immediately

6. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

  • Encryption of data in transit and at rest
  • Secure authentication mechanisms
  • Regular security assessments
  • Access controls limiting who can view data
  • Non-sequential staff IDs to prevent enumeration attacks

However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access: Request a copy of your personal data
  • Correction: Request correction of inaccurate data
  • Deletion: Request deletion of your data (see Account Deletion section)
  • Portability: Request a portable copy of your data
  • Objection: Object to certain processing activities
  • Restriction: Request restriction of processing

To exercise these rights, please contact us at mycompanyid@shape.tech.

8. Account Deletion

You can delete your account at any time through the app:

  1. Open the MyCompanyID app
  2. Navigate to Settings
  3. Select "Delete Account"
  4. Confirm the deletion

Upon deletion:

  • Your account and all associated data will be permanently deleted
  • Any staff records under your organisation will be removed
  • This action cannot be undone

You can also request account deletion by contacting us at mycompanyid@shape.tech.

9. Children's Privacy

MyCompanyID is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

10. International Data Transfers

Your data may be processed in countries outside your country of residence. When we transfer data internationally, we ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection laws.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: