EpicStaff Privacy Policy

1. Who is responsible

EpicStaff, Montréal, Québec, operates the EpicStaff marketplace and is responsible for the personal information described here. Our person in charge of the protection of personal information (privacy officer) can be reached at info@epicstaff.app. Write to that address for any question, request or complaint about your personal information.

2. What we collect

Account: your email address, the sign-in provider you use (email and password, Apple or Google) and the identifiers those providers give us, your display name, phone number and language.

Worker profile: the positions you work and the rates you ask, your availability, the area you are willing to travel to (a radius you choose — we do not track your ongoing location for this), your answers to skills questions, an optional photo, and the reliability and review statistics built from your gigs.

Tax identity (sensitive): your legal first and last names, your social insurance number or business number, your date of birth, your home address, your GST/QST registration numbers when you are registered, and your choice of electronic delivery for tax documents. We ask for these because tax law requires them (section 3).

Payments: the identifier of the Stripe account opened in your name, the status of its verification, the invoices and receipts for each gig, your earnings ledger by quarter, and — for establishments — the saved payment method reference, the pre-authorized debit authorizations and the billing history. Card and bank details are entered on Stripe's pages and are never seen or stored by EpicStaff.

Establishment members: your name, email, role and the establishment's business identity (legal name, business number, program accounts, addresses) that its owner records for tax reporting.

Devices and use: push-notification tokens for the devices you sign in on, the app version and platform, App Check attestations that prove requests come from a genuine copy of the app, and server logs of the actions you take (with timestamps and identifiers, not content). When you clock in or out of a shift, the staff app sends your phone's position once so we can check you are at the venue; only you can see that position — your managers and coworkers see only whether the check passed and how far off it was, never the coordinates. The apps carry no analytics or advertising software.

Chat: the messages and photos you send in the app's conversations (with an establishment's team, about a gig or contract, directly with another person, or with EpicStaff support), your reactions and edits, which conversations you are in, when you last read each one, a typing indicator while you write, your mute and notification choices, the people you block, and the messages you report.

3. Why we use it

To run the marketplace you signed up for: matching gigs to your positions, availability and area, showing your candidate card to the establishments you apply to, letting you talk with the establishments, the teammates and the EpicStaff support you work with, recording hours at the venue, sending the notifications you enabled, and settling payment between the establishment and you through Stripe.

To meet legal obligations: Canadian tax law requires EpicStaff, as a digital platform operator, to collect a worker's identity and report the amounts paid through the marketplace to the Canada Revenue Agency every year (Income Tax Act, Part XX), and requires the establishment that paid you to issue T4A / RL-1 slips with that identity. Payment regulation requires Stripe to verify identities and bank accounts.

To keep the platform safe: preventing fraud and abuse, screening chat messages for abusive language and reviewing the messages people report, handling disputes and refunds, and keeping the records the Terms rely on.

We do not sell personal information, we do not use it for advertising, and we do not profile you for any purpose other than the matching described above.

4. Who we share it with

Establishments: before an establishment selects you, it sees your candidate card (display name, positions, reliability statistics, reviews and whether you charge GST/QST). Your phone number and email reach an establishment only once you have accepted its gig. Your tax identity reaches an establishment only inside the filing export for the T4A / RL-1 slips it issues to you, which is recorded every time it is produced. Establishments never see your SIN on screen.

Stripe Payments Canada, Ltd.: identity and bank verification, charges and payouts. Stripe processes your information under its own privacy policy and may do so in the United States.

Google Cloud / Firebase: our infrastructure (database, storage, functions, sign-in, push notifications), hosted in the Montréal region (northamerica-northeast1). Push notifications transit Apple's and Google's notification services. Apple and Google also process your sign-in when you choose to sign in with them.

Canada Revenue Agency: the annual digital-platform (Part XX) return — your identity, the amounts paid to you through the marketplace and the number of gigs. Revenu Québec: nothing today; we will tell you if that changes.

Email: transactional messages are sent through our email providers in Canada. Professional advisers, and authorities when the law requires it.

Google Maps Platform (Google LLC): when a screen shows a venue on a map, your browser loads the map from Google. Google receives your IP address, browser details and the place being shown — a venue's address or pin, never your account details. Google processes this under its own privacy policy and may do so outside Canada. The links that open a place in a maps app take you to OpenStreetMap only when you click them.

Chat: a message reaches the people in its conversation — an establishment's team conversation reaches its active members; a gig or contract conversation, the establishment's owner and managers and the workers accepted for it; a direct or group conversation, the people in it; your support conversation, EpicStaff staff. An establishment's managers cannot read a direct conversation they are not part of. Authorised EpicStaff staff open a conversation only to review a reported or flagged message, to answer you in your support conversation, or when the law requires it, and every conversation they open is recorded. A notification for a new message shows the sender's name and the start of the message, so it passes through Apple's or Google's notification service.

5. Where it is stored

Your information is stored in Google Cloud's Montréal region. Some processing happens outside Québec: Stripe (United States), Apple and Google sign-in, the notification services of Apple and Google, and Google Maps Platform when a map is shown. Before choosing those providers we assessed the protection they offer; each is bound by contractual safeguards and its own published privacy commitments.

6. How long we keep it

Account and profile information: for as long as your account exists, then deleted when you delete it (section 7). We also back up our database every day and keep each backup for 14 days; if we ever restore one, any deletion recorded since that backup is reapplied to the restored data, so a restore cannot bring back someone who asked to be deleted.

Records tax law requires: the paid-gig history, invoices, receipts and the earnings ledger are kept for six years after the year they relate to (Income Tax Act s. 230). If you were paid in a year, your tax identity is kept until December 31 of the following year — long enough for the establishments' slips, the Part XX return and its amendments — then deleted.

Server logs and audit records: up to twelve months, or longer where they document a dispute or a legal obligation.

Chat: conversations are kept for as long as they exist; we have not yet set a period after which they are deleted, and we will publish it here when we do. Deleting a message erases its text at once; a photo it carried may stay in storage. A photo you upload but never send is deleted after 24 hours. When you delete your account, your name is removed from the conversations' member lists and your list of conversations is deleted; the messages you already sent stay in their conversations, because they are part of the other people's conversation too, but your name on them is replaced with “Deleted worker” or “Deleted member” at once.

7. Your rights

You may access the personal information we hold about you, have it corrected, ask that it be deleted, and withdraw a consent you gave — in the app (Profile) or by writing to the privacy officer. Where Law 25 provides it, you may ask for a copy of the computerized information you gave us in a structured, commonly used format, and ask that a piece of information be de-indexed or that its distribution cease.

Deleting your account is available in the app under Profile → Delete account, and explained at epicstaff.app/account/deletion, including what tax law obliges us to keep.

We answer within 30 days. If you are not satisfied, you may complain to the Commission d'accès à l'information du Québec or to the Office of the Privacy Commissioner of Canada.

8. How we protect it

Information is encrypted in transit and at rest. Tax identity is stored separately from your profile, can only be read by the server functions that need it, and is never returned to a screen in full. Requests to our functions must come from a genuine copy of the app. Access by our staff is limited to what a task requires and is logged. If a confidentiality incident presents a risk of serious injury, we notify the Commission d'accès à l'information and the people concerned, and we keep a register of incidents as Law 25 requires.

9. Automated processing

When an establishment posts a gig, the app automatically notifies the workers whose positions, availability and area match it. That ranking decides who is told first; it does not decide who is hired — an establishment offers a gig to a person it chooses, and you decide whether to accept.

When you send a chat message, the app checks its words against a short list of abusive terms in English and French. A message with a severe term (a slur or an explicit threat) is not sent, and you are told so; a message with a milder term is sent and marked for review by EpicStaff staff, who decide whether it stays marked. The check reads only the words of the message: its text and the term it matched are never logged. No other decision about you is made solely by automated means.

10. Cookies and similar technologies

The website uses one essential session cookie to keep you signed in and one cookie to remember your language. It uses no advertising or analytics cookies. The apps use device storage for your sign-in session and settings.

11. Age

EpicStaff is for people aged 18 and over. We do not knowingly collect personal information from anyone younger.

12. Changes to this policy

When this policy changes we publish the new version here and, for material changes, tell you in the app or by email before it takes effect. The date at the top is the version that applies.

13. Contact

Privacy officer — EpicStaff, Montréal, Québec — info@epicstaff.app.