EpicStaff Privacy Policy
Draft for review — 2026-09-03. Not yet in force.
This policy explains what personal information EpicStaff collects when you use the EpicStaff apps and website, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It is written for Québec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's PIPEDA, and it covers both workers and the people who use EpicStaff on behalf of an establishment.
1. Who is responsible
EpicStaff, Montréal, Québec, operates the EpicStaff marketplace and is responsible for the personal information described here. Our person in charge of the protection of personal information (privacy officer) can be reached at info@epicstaff.app. Write to that address for any question, request or complaint about your personal information.
2. What we collect
Account: your email address, the sign-in provider you use (email and password, Apple or Google) and the identifiers those providers give us, your display name, phone number and language.
Worker profile: the positions you work and the rates you ask, your availability, the area you are willing to travel to (a radius you choose — we do not track your location), your answers to skills questions, an optional photo, and the reliability and review statistics built from your gigs.
Tax identity (sensitive): your legal first and last names, your social insurance number or business number, your date of birth, your home address, your GST/QST registration numbers when you are registered, and your choice of electronic delivery for tax documents. We ask for these because tax law requires them (section 3).
Payments: the identifier of the Stripe account opened in your name, the status of its verification, the invoices and receipts for each gig, your earnings ledger by quarter, and — for establishments — the saved payment method reference, the pre-authorized debit authorizations and the billing history. Card and bank details are entered on Stripe's pages and are never seen or stored by EpicStaff.
Establishment members: your name, email, role and the establishment's business identity (legal name, business number, program accounts, addresses) that its owner records for tax reporting.
Devices and use: push-notification tokens for the devices you sign in on, the app version and platform, App Check attestations that prove requests come from a genuine copy of the app, and server logs of the actions you take (with timestamps and identifiers, not content). The apps carry no analytics or advertising software.
3. Why we use it
To run the marketplace you signed up for: matching gigs to your positions, availability and area, showing your candidate card to the establishments you apply to, recording hours at the venue, sending the notifications you enabled, and settling payment between the establishment and you through Stripe.
To meet legal obligations: Canadian tax law requires EpicStaff, as a digital platform operator, to collect a worker's identity and report the amounts paid through the marketplace to the Canada Revenue Agency every year (Income Tax Act, Part XX), and requires the establishment that paid you to issue T4A / RL-1 slips with that identity. Payment regulation requires Stripe to verify identities and bank accounts.
To keep the platform safe: preventing fraud and abuse, handling disputes and refunds, and keeping the records the Terms rely on.
We do not sell personal information, we do not use it for advertising, and we do not profile you for any purpose other than the matching described above.
5. Where it is stored
Your information is stored in Google Cloud's Montréal region. Some processing happens outside Québec: Stripe (United States), Apple and Google sign-in, and the notification services of Apple and Google. Before choosing those providers we assessed the protection they offer; each is bound by contractual safeguards and its own published privacy commitments.
6. How long we keep it
Account and profile information: for as long as your account exists, then deleted when you delete it (section 7).
Records tax law requires: the paid-gig history, invoices, receipts and the earnings ledger are kept for six years after the year they relate to (Income Tax Act s. 230). If you were paid in a year, your tax identity is kept until December 31 of the following year — long enough for the establishments' slips, the Part XX return and its amendments — then deleted.
Server logs and audit records: up to twelve months, or longer where they document a dispute or a legal obligation.
7. Your rights
You may access the personal information we hold about you, have it corrected, ask that it be deleted, and withdraw a consent you gave — in the app (Profile) or by writing to the privacy officer. Where Law 25 provides it, you may ask for a copy of the computerized information you gave us in a structured, commonly used format, and ask that a piece of information be de-indexed or that its distribution cease.
Deleting your account is available in the app under Profile → Delete account, and explained at epicstaff.app/account/deletion, including what tax law obliges us to keep.
We answer within 30 days. If you are not satisfied, you may complain to the Commission d'accès à l'information du Québec or to the Office of the Privacy Commissioner of Canada.
8. How we protect it
Information is encrypted in transit and at rest. Tax identity is stored separately from your profile, can only be read by the server functions that need it, and is never returned to a screen in full. Requests to our functions must come from a genuine copy of the app. Access by our staff is limited to what a task requires and is logged. If a confidentiality incident presents a risk of serious injury, we notify the Commission d'accès à l'information and the people concerned, and we keep a register of incidents as Law 25 requires.
9. Automated processing
When an establishment posts a gig, the app automatically notifies the workers whose positions, availability and area match it. That ranking decides who is told first; it does not decide who is hired — an establishment offers a gig to a person it chooses, and you decide whether to accept. No other decision about you is made solely by automated means.
11. Age
EpicStaff is for people aged 18 and over. We do not knowingly collect personal information from anyone younger.
12. Changes to this policy
When this policy changes we publish the new version here and, for material changes, tell you in the app or by email before it takes effect. The date at the top is the version that applies.
13. Contact
Privacy officer — EpicStaff, Montréal, Québec — info@epicstaff.app.