Privacy Policy

This policy applies to personal information that Square 1 collects, uses, or discloses through the App, as well as employment-related personal information that Square 1 displays in the App (for example, your shifts, role, and location assignments) but collects through other employment processes.

If you are not an employee of Square 1, the App is not intended for you.

Our Privacy Officer is responsible for compliance with this policy and with applicable privacy law. To reach the Privacy Officer with a question, a rights request, or a complaint:

We will respond to privacy requests within 30 days. If we need more time we will tell you why and give a new response date, as PIPA permits.

We collect only what is reasonably required to run the App and to manage your employment.

3.1 Information you provide

Identity

Legal name, preferred name, date of birth, home address

Source: You, at hire or via the App

Contact

Email address, phone number, emergency contact details

Source: You, at hire or via the App

Government identifiers

Social Insurance Number (SIN), collected for Canada Revenue Agency payroll remittance; stored encrypted and not visible anywhere in the App

Source: You, at hire (outside the App)

Banking (if applicable)

Direct-deposit account details for payroll; stored encrypted and not visible in the App

Source: You, at hire (outside the App)

Preferences

Shift-time preference, preferred weekdays, weekly hours range, location ranking, email-notification opt-in

Source: You, via the App

3.2 Information generated through your use of the App

Employment

Position, role, location(s) you work at, employment start date, employment status

Source: Our HR records, shown in the App

Scheduling

Scheduled shifts, worked shifts, break records, time-off requests, shift swaps, shift offers, declared availability

Source: You and your manager, via the App

App account

Magic-link sign-in codes, current session tokens, device push tokens (if you enable notifications)

Source: Automatic, when you sign in

Technical

Device type and OS version, app version, IP address, server request logs

Source: Automatic, when you use the App

3.3 What we do NOT collect

• Location tracking.The App does not request or access your device’s GPS or location services.
• Biometric data.If you choose to enable Face ID or Touch ID to unlock the App, the evaluation is performed on your device by Apple’s Secure Enclave; biometric data is never transmitted to us or stored on our servers.
• Contacts, photos, health data, or advertising identifiers.
• Contents of personal communications (email, SMS, or other messaging on your device).

We use personal information only to:

• Operate the App— authenticate you, show your schedule and time-off status, and process your availability, time-off, and shift-swap requests.
• Manage the employment relationship— payroll, scheduling, benefits administration, performance management, and lawful termination.
• Comply with legal obligations— Canada Revenue Agency reporting, Alberta Employment Standards recordkeeping, workers’ compensation, and other laws that apply to us as an Alberta employer.
• Protect the App— detect and respond to account compromise, abuse, or fraud, and maintain system integrity.
• Improve the App— aggregate, non- identifying usage metrics and (where integrated) crash reports.

We do not use your personal information for advertising, profile-based marketing, or sale to third parties, and we do not permit our service providers to do so.

Under PIPA sections 15 through 21, we may collect, use, and disclose personal employee information without your consent where the purpose is reasonably required to establish, manage, or terminate your employment relationship with us. This policy serves as your notification of that collection, use, and disclosure.

For purposes outsidethe employment relationship — for example, optional email notifications about schedule changes — we rely on your express opt-in consent. You can withdraw consent for optional processing at any time via your Profile in the App, or by emailing the Privacy Officer.

Withdrawing consent for processing that is required to operate the App or your employment (for example, sign-in authentication or payroll) will result in loss of access to the App. We will tell you the likely consequences before acting on a withdrawal.

We share personal information only with:

6.1 Service providers acting on our behalf

Application hosting and database

Hosts the App and stores scheduling / preference data

Source: Amazon Web Services (AWS) — Canada

File storage

Stores files you upload through the App (if any)

Source: Amazon Web Services (AWS) S3 — Canada

Email delivery

Delivers sign-in codes and opt-in notifications to your email

Source: Resend — United States

Address autocomplete

Returns address suggestions, queried only when you actively type an address

Source: Google (Places API) — United States

Push notifications

Delivers opt-in push notifications to your device

Source: Apple (APNs) — United States

App distribution

Distributes the App and processes any payments (none at present)

Source: Apple (App Store) — United States

Diagnostic data sharing

If you opt in via iOS Settings, shares anonymized crash and performance reports with us through Xcode Organizer

Source: Apple — United States

Each provider is bound by a written agreement or terms of service that restricts their use of your personal information to the services they provide to us, and that requires them to protect the information with safeguards equivalent to ours.

6.2 When required or permitted by law

We may disclose personal information in response to a valid legal demand (for example, from the Canada Revenue Agency, a court order, or a regulator), or to comply with a legal obligation such as Alberta Employment Standards recordkeeping or a workers’ compensation claim.

6.3 No sale, no advertising

We do not sell your personal information, share it with advertising networks, or use it to target ads to you.

Several of the service providers listed in Section 6 store and process personal information in the United States. When personal information is processed outside Canada, it becomes subject to the laws of that jurisdiction, including laws that may require disclosure to foreign government authorities (for example, the U.S. Clarifying Lawful Overseas Use of Data Act (“CLOUD Act”) and orders under the Foreign Intelligence Surveillance Act).

By using the App you consent to this cross-border processing for the purposes described in this policy. We select providers that apply recognized data-protection standards and that limit their personnel’s access to your data. You may contact the Privacy Officer for the name of the provider used for any particular category of information.

App account (sign-in tokens, session state)

Disabled on your last day of employment; deleted after the applicable employment-record period below.

CRA-mandated payroll records (T4s, SIN, remittance records)

Six years after the tax year they relate to, as required by the Income Tax Act, s. 230.

Alberta Employment Standards records (hours, wages, holidays)

Three years after the record was made, as required by Alberta’s Employment Standards Code.

Scheduling data not subject to the above

Retained for as long as it serves a legitimate business purpose, including supporting future scheduling decisions, operational analytics, and the defence of any legal claims.

Server request logs

Thirty days.

Anonymous crash and performance reports (Apple-shared)

If you opt in via iOS Settings → Privacy & Security → Analytics & Improvements → Share with App Developers, Apple shares anonymized reports with us through Xcode Organizer; retention is managed by Apple.

Encrypted database backups

Up to 14 days, per our AWS RDS backup configuration.

After the applicable retention period ends, we securely destroy or irreversibly de-identify the information. Where a record is subject to more than one retention requirement, the longest period applies.

We use administrative, physical, and technical safeguards appropriate to the sensitivity of the information:

• Transport encryption (HTTPS/TLS) for all network traffic between your device and our servers.
• Encryption at rest for the database, file storage, and backups.
• Passwordless sign-in via short-lived emailed codes, so there are no stored passwords to steal.
• Sensitive fields encrypted separately — Social Insurance Numbers and banking details are stored with field-level encryption keys managed apart from the application database.
• Role-based access controls— employee personal information is accessible only to managers and administrators with a legitimate need.
• Audit logging of administrative access to sensitive fields.

No system can be guaranteed secure. If a breach affects your personal information and involves a real risk of significant harm(the test in PIPA section 34.1), we will notify you and the Office of the Information and Privacy Commissioner of Alberta as the law requires.

We use an automated scheduling system (the “Scheduler”) to propose draft weekly shifts based on your declared availability and preferences, your employment terms, and legal constraints such as Employment Standards limits. A human manager reviews and publishes every schedule.

No employment decision — including hiring, discipline, termination, or any change to your terms of employment — is made solely by the Scheduler. To understand the factors that went into a particular schedule, contact your manager or the Privacy Officer.

Alberta’s Employment Standards Regulation permits employment in certain settings for adolescents (typically ages 13 and 14) and young persons (15 to 17) subject to restrictions. Where we employ a minor, we obtain the consent of a parent or legal guardian for the collection, use, and disclosure of the minor’s personal information as described in this policy.

We do not knowingly collect personal information from anyone outside an employment relationship.

Under PIPA and, where applicable, PIPEDA, you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Withdraw consent for optional processing (Section 5).
• Request deletion of information we are not legally required to retain.
• Complain to a Privacy Commissioner (Section 13).

To exercise any of these rights, contact the Privacy Officer (Section 2). We may ask you to verify your identity before responding. We will respond within 30 days, and will tell you promptly if we need additional time as permitted by law.

13.1 Changes to this policy

We will update this policy when our practices change. Material changes will be announced in the App and, where we have your email address, sent to you by email before they take effect. The Effective and Last updated dates at the top will reflect the revision.

13.2 Complaints

If you are not satisfied with how we have handled your personal information, you may complain to:

Where PIPEDA applies (for example, to personal information that crosses provincial boundaries for commercial purposes):