NorthShift is workforce software for Canadian small businesses — clock-ins, scheduling, time-off, documents, and an AI assistant. This policy explains, in plain language, what personal information NorthShift handles, why, where it lives, and what rights you have under Canadian privacy law.
1. Our role — and your employer's role
NorthShift is a service provider (sometimes called a "processor"). Businesses use NorthShift to manage their own teams. Each business customer decides what information to collect about its employees and is responsible for its own legal obligations to those employees — including telling employees what is collected and why.
NorthShift processes that information only to provide the service, on the business's behalf. We do not decide why your employer collects your information. If your question is about why your employer collects something, ask the business — and we will help the business respond to your request.
2. What we collect
Account details
Name, email address, and login credentials for business owners, managers, and employees who sign in, plus the business name and each person's role.
Employee profile information
Information an employee or their employer adds to a profile, which can include date of birth, home address, phone number, and emergency contacts (a contact's name, phone number, and relationship). NorthShift deliberately never collects Social Insurance Numbers or banking information.
Location data for clock-ins
When an employee clocks in or out by scanning a worksite QR code, the app checks the device's location at that moment to confirm the employee is within the radius the business set for that worksite. Location is checked at clock-in and clock-out events — NorthShift does not continuously track anyone's location in the background.
Work records
Schedules, shifts, clock-in and clock-out times, breaks, time-off requests and approvals, leave balances, and exception reports (for example, an out-of-range clock-in an employee asks a manager to review).
Uploaded documents
Files that a business or an employee uploads to an employee's private document folder, such as contracts, certifications, or ID copies.
Usage data
Technical information about how the service is used: device type, app version, feature activity, logs, and error reports. When you use the AI assistant, we also handle the text you type and the actions it takes for you.
3. Why we collect it
- To run the service: accounts, clock-ins, schedules, time-off, documents, reports, and payroll exports.
- To verify clock-ins against a worksite's location radius, at the business's request.
- To apply the rules a business configures, such as break and overtime flags and leave limits.
- To provide support, keep the service secure, and detect misuse.
- To understand how the service is used so we can improve it.
We never sell personal information. Not to advertisers, not to data brokers, not to anyone.
4. Canadian privacy law and our commitments
NorthShift operates in Canada and follows the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Where a substantially similar provincial law applies instead — British Columbia's and Alberta's Personal Information Protection Acts (PIPA) for private-sector activity in those provinces, and Quebec's Law 25 — we follow those laws too.
We build our practices around PIPEDA's ten fair information principles:
- Accountability. We are responsible for personal information in our custody, and we have a designated person in charge of privacy (our privacy officer — see Contact).
- Identifying purposes. We say why information is collected, in this policy, before or at the time of collection.
- Consent. Information is collected with consent — given by you directly for your account, or obtained by your employer for employment information — subject to the employment-context limits described below.
- Limiting collection. We collect only what the service needs, by fair and lawful means.
- Limiting use, disclosure and retention. Information is used and shared only for the purposes described here, and kept only as long as those purposes require.
- Accuracy. We keep information as accurate as its use requires, and you can correct it.
- Safeguards. We protect information with security measures appropriate to its sensitivity.
- Openness. This policy is public, and we will explain our practices on request.
- Individual access. You can ask what personal information we hold about you and how it has been used.
- Challenging compliance. You can raise a concern with our privacy officer, and with the Privacy Commissioner of Canada or your provincial commissioner.
Quebec — Law 25
For users and businesses in Quebec, Law 25 adds specific requirements and rights, and we honour them:
- Our person in charge of the protection of personal information (privacy officer) can be reached through the contact below.
- If a confidentiality incident presents a risk of serious injury, we notify the Commission d'accès à l'information and the people affected, as Law 25 requires.
- You have the right, in the circumstances Law 25 sets out, to ask that your personal information be erased, and to ask that hyperlinks to your information be de-indexed (stop being disseminated).
- Where Law 25 requires a privacy impact assessment — for example, before personal information is communicated outside Quebec — we carry one out.
British Columbia and Alberta — PIPA
Where BC's or Alberta's PIPA applies to a business and its employees, we handle personal information in line with those laws, including their breach-notification rules for the provincial commissioners.
5. Where your information lives — and cross-border processing
NorthShift's data is hosted on Supabase cloud infrastructure. That means your information may be stored or processed outside Canada, including in the United States. When information is in another country, it can be subject to that country's laws, including lawful access by its courts, governments, and law-enforcement agencies. We disclose this openly so businesses and employees can take it into account; business customers remain accountable to their employees for information processed by NorthShift on their behalf.
6. Who we share it with
- Your employer. Managers and admins of the business you work for can see the information the service is designed to show them, under role-based permissions. An employee's private profile details and documents are restricted — other employees cannot see them.
- Service providers under contract. Supabase (hosting and database), AI model providers (the assistant sends the text of a request so it can produce an answer), and email delivery for invites and notifications. They may use information only to provide their service to us.
- Legal requirements. We disclose information when the law requires it, such as under a court order.
We do not share personal information for anyone else's marketing, and — again — we never sell it.
7. How we protect it
- Encryption in transit (TLS) on every connection, and encryption at rest in our hosted database and file storage.
- Access controls: accounts are authenticated, permissions are role-based, and private profile data and documents are separated per employee so users can only reach what their role allows.
- Operational safeguards: activity is logged so actions taken through the service — including by the AI assistant — leave a record.
No system is perfectly secure, but we treat employee information as something we are borrowing, not something we own.
8. If something goes wrong — breach notification
If there is a breach of our security safeguards involving personal information, and it creates a real risk of significant harm to an individual, we will report it to the Privacy Commissioner of Canada and notify the affected individuals, as PIPEDA requires, and we keep records of breaches. Incidents in Quebec are handled under Law 25 (notification to the Commission d'accès à l'information and affected persons where there is a risk of serious injury), and BC and Alberta incidents under their PIPA rules, where those apply.
9. Your rights: access and correction
You can ask what personal information NorthShift holds about you, and ask for it to be corrected if it is wrong or incomplete. Much of your profile you can review and update yourself in the app. For anything else, contact your employer or our privacy officer (below); we will respond within the time the applicable law requires, and we will help the business respond where the request belongs with them.
10. Withdrawing consent — and its limits at work
You may withdraw your consent to our handling of your personal information, subject to legal or contractual restrictions and reasonable notice. In an employment context there are honest limits: a business needs certain information to schedule you, record your hours, and pay you correctly, and it must keep certain records under employment law. Withdrawing consent may mean the business cannot use NorthShift to manage your employment, and some information may still need to be kept as described in the next section. Talk to your employer or our privacy officer and we will explain what applies in your situation.
11. Retention and deletion
We keep personal information while an account is active and as long as needed for the purposes above. The NorthShift app includes in-app account deletion: a user can delete their account from within the app, and personal information tied to that account is deleted or anonymized.
Deletion is subject to legal retention obligations that may apply to the business. For example, Ontario's Employment Standards Act requires employers to keep certain employment records for three years. Records a business is legally required to keep may be retained for that period before being deleted — that obligation belongs to the business, and we support it rather than override it.
12. Children's privacy
NorthShift is a workplace tool for businesses and their employees. It is not directed at children, and we do not knowingly collect personal information from children.
13. Marketing messages — CASL
We send marketing emails only with consent, as Canada's Anti-Spam Legislation (CASL) requires, and every marketing message includes a working unsubscribe. Service messages — invites, schedule and approval notifications, security alerts — are not marketing and are sent as part of providing the service.
14. Changes to this policy
If we change this policy in a way that matters, we will post the updated version here and update the date above, and where the law requires notice or fresh consent, we will provide it.
15. Contact our privacy officer
Questions, access or correction requests, or a concern about how we handle personal information:
Privacy Officer, NorthShift
Email: privacy@northshiftapp.com
You may also contact the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or the Information and Privacy Commissioner for your province (British Columbia or Alberta) if you are not satisfied with our response.