Privacy Policy

Who this is for

Workera Shift is a time-tracking app used by staffing agencies and the workers they place, and by businesses for their own staff. In this policy, “your company” means the company that added you to Workera Shift: your employer, or the staffing agency that places you. Your company creates your account and decides who there can see your records. Your company is the controller of that information. Workera operates the software on its behalf.

What we collect

• Your account. Name, email address, and phone number if your company has it. Optionally a photo, a name you go by on site, the email address your pay is sent to, and the language you choose for the app.
• Your shifts. When you clock in and out, when you start and end breaks, where the shift was (the site, and for a staffing agency's workers the client you were placed at), and any note you add.
• Your pay. Your pay rate, the hours you are paid for, and a record of each payment sent to you.
• One location point per punch. Latitude, longitude, and an accuracy figure, recorded at the moment you clock in, start or end a break, or clock out. Nothing between those moments.
• A face template. When you first verify, a mathematical representation of your face is created and stored so later scans can be matched against it.
• Expense claims. Amounts, categories, descriptions, and any receipt photo you choose to take.
• Time-off requests and the reason you give, if you give one.

How you sign in

You can sign in with Apple, with Google, with a code sent to your email, or with a password. Signing in never gives you access on its own: only your company can add you to its team.

• Sign in with Apple shares your name and email address with us. If you choose to hide your email, Apple gives us a private relay address instead, and emails sent to it are forwarded to you.
• Sign in with Google shares your name, email address, and a link to your Google profile picture.
• Signing in with Apple or Google does not send them your shifts, your pay, your location, or any other record.

Your face, specifically

A face template is biometric information, so it gets its own section.

• We do not keep the photo. Each scan is sent to Amazon Rekognition for matching, and Workera Shift does not keep the image. What is stored is a template, a set of numbers derived from your face, held by Amazon Rekognition in Canada. Amazon Web Services may keep scans under its own service terms.
• It is only used to confirm it is you at a punch, such as when you clock in or come back from a break. We never use it to identify you in other images, to estimate anything about you, or to train any model.
• You are asked before the first scan and your consent is recorded with the date and the version of this policy.
• You can withdraw your consent at any time. Deleting your account in the app does this for you. To keep your account and stop the face check, ask your company or write to shift.support@workera.ca. We delete your face template and record that you withdrew. From then on the app asks for your consent before any new scan. If you say no, your clock-ins go to your manager for manual review. If your company requires the face check for every clock-in, talk to your manager about another way to confirm your shifts.

Shared tablets (kiosks)

Some workplaces put one tablet at the front desk, using the Workera Shift Kiosk app, instead of using the app on each person's phone.

• Pairing. A manager pairs the tablet with a one-time code. After that the tablet holds a random pairing key and nothing about any person.
• Setting up your face. It needs a one-time code your manager gives you, and you are asked for your consent first, just as in the app.
• Clocking in. The tablet takes a photo and sends it to Amazon Rekognition to find your face template. The tablet does not keep the photo, and neither does Workera Shift.
• No location. The tablet does not record where you are.
• What the screen shows. While you punch, your first name and the time recorded. The list of who is on shift appears only as a number.

What we never do

• We do not track your location between punches, and the app does not use location in the background.
• We do not sell your information, and we do not share it for advertising.
• We do not use your data to train machine-learning models.
• We do not show your manager a route or a history of where you have been. They see only the point recorded at each punch.

Who can see it

Managers and administrators at your own company, and nobody at any other company. Access is enforced in the database itself, not only in the app. If a staffing agency places you with a client, that client may be shown the hours worked on their own jobs, without your contact details or your location.

Service providers

We use these companies to run the app. Each one only gets what it needs for its job.

• Supabase. The main database, file storage (such as receipt photos and profile photos), and sign-in.
• Vercel. Hosts the manager console and the API the app talks to.
• Amazon Web Services. Face matching, in Canada.
• Cloudflare. Nightly backup copies.
• Expo. Delivers app updates to your phone. It sees technical details such as the app version, not your records.
• Apple and Google. Sign-in, if you choose it.
• Resend. Sends the app's emails to you, such as your invitation to the app.
• OpenStreetMap. The console looks up the street address of the location point from a punch and shows it on a map. OpenStreetMap receives those coordinates, not your name. A manager can also open the point in Google Maps.

Workera Contracting, the staffing agency behind Workera Shift, also uses the services below for its own staffing work. They apply only if Workera Contracting is your company. When another company added you, nothing from its records goes to them.

• Google Workspace. Workera Contracting's email and files. The console reads timesheets and payment notices that arrive by email, which can name you, and the resumes Workera Contracting keeps in Google Drive. It also sends Workera Contracting's messages from that email.
• Airtable. Workera Contracting's recruiting records. The console reads the resumes kept there, which can name you, the client and role you were put forward for, and a rate range. It sends Airtable only the status of a client's job request, never anything about you.
• Zorro CRM. Workera Contracting's customer relationship system. It holds your name, email, phone number, the client you are placed at, and your pay rate.
• OpenAI, with Anthropic as a backup. They read the timesheets and payment documents Workera Contracting receives by email, and answer questions its staff ask in the console. These can include your name, your hours, and your pay.

Every provider that stores your information for us must protect it to at least the standard in this policy. OpenStreetMap and Google Maps are public map services. They receive only a location point, and we have no contract with them.

Where it is stored

• Database, files, and sign-in: Supabase, in the United States (Oregon).
• The console and its API: Vercel, in the United States.
• Face templates: Amazon Web Services, in Canada.
• Nightly backups: Cloudflare, in eastern North America, which may be outside Canada.

This means your information may be stored and processed outside Canada, mostly in the United States. While it is there, the law of that country applies, and its courts and authorities may be able to access it. We protect it by contract with each provider that stores it. Wherever it sits, it is encrypted in transit and at rest, and it remains subject to this policy.

How long it is kept

Shift, pay, and tax records are kept for six years, because Canadian tax law requires it. After that they are deleted. Your face template is kept until you delete your account or withdraw your consent, and then it is deleted. Backups hold copies of the same records and never hold face templates.

Deleting your account

• How. In the Workera Shift app, go to Account, then Delete account. Or email shift.support@workera.ca and we will do it for you.
• What happens. You can no longer sign in. Your face template is deleted right away. If that cannot be done at that moment, it is switched off at once, so it can never match a scan again, and we finish deleting it as soon as we can. Your company is told that you closed your account.
• What is kept. Your shift, pay, and tax records are kept for six years, because Canadian tax law requires it, and then deleted. This is also how you still get paid for hours you already worked.
• Managers. Manager and administrator accounts are closed from the manager console, not in the app.

Your rights

You can ask your company for a copy of what is held about you, ask for corrections, ask for your face template to be deleted, withdraw consent to face verification, or delete your account. Under Canadian privacy law you may also complain to the Office of the Privacy Commissioner of Canada, or to your provincial regulator.

Contact

Speak to your company first, as it holds your records. For questions about the app itself, or to delete your account, write to shift.support@workera.ca.