Privacy Policy

1. Who This Policy Applies To

This policy applies to:

• Clients — individuals and organizations that request or book event staffing services through our website or by phone.
• Applicants — individuals who apply to join our staffing network.
• Staff members — individuals employed or engaged by TorontoEats to work events.
• Website visitors — anyone who visits torontoeats.ca.

2. Information We Collect

From clients and inquiry submissions

• Name, email address, and phone number
• Event details: type, date, location, guest count, estimated duration
• Whether your event is inside or outside the Greater Toronto Area
• Any notes or special requirements you provide

From staff applicants

• Name, email address, and phone number
• Work history and experience (as provided by you)
• Roles, preferred work areas, and availability
• Resume or LinkedIn profile link, if provided

From staff members

• Account credentials (email and password hash — never stored in plain text)
• Profile information: role, bio, photo, and expected hourly rate
• Availability dates and shift history

Automatically collected

• Server logs (IP address, browser type, pages visited) retained for up to 90 days for security purposes
• Session cookies required for staff portal authentication — no persistent tracking cookies are used

3. How We Use Your Information

We use personal information only for the purposes for which it was collected:

• To respond to staffing inquiries and prepare event staffing plans and quotes
• To fulfill booked events — coordinating staff assignments, sending shift notifications, and confirming attendance
• To review and process staff applications
• To operate staff accounts — managing availability, assignments, and confirmations
• To send transactional emails — inquiry confirmations, shift offers, and booking updates (via Postmark)
• To comply with legal obligations under Ontario employment and tax law
• To improve our services — aggregate, non-identifying analysis of inquiry and booking patterns

We do not use your information for advertising profiling, sell it to third parties, or use it for any purpose unrelated to the services you've requested.

4. Legal Basis for Processing

Under PIPEDA, we collect and use personal information with your knowledge and consent. By submitting an inquiry, applying to our network, or creating a staff account, you consent to the collection and use of your information as described in this policy. You may withdraw consent at any time (subject to legal or contractual restrictions) by contacting us at the address below.

5. Disclosure to Third Parties

We do not sell or rent personal information. We share it only with:

• Postmark (ActiveCampaign, Inc.) — our transactional email provider. Email addresses and message content necessary to deliver confirmations and shift notifications. Postmark processes this data under its own privacy policy.
• Google Cloud Platform / Firebase — our hosting and infrastructure provider. Application data is stored on servers in Canada or the United States. Google operates under standard contractual clauses with appropriate safeguards.
• Government authorities — only when required by law, court order, or to protect the safety of individuals.

When we share data with processors, we require them to handle it in accordance with this policy and applicable law.

6. Data Retention

• Client inquiry records — retained for 3 years from the date of the inquiry to support follow-up and dispute resolution, then deleted.
• Staff application records — retained for 12 months from submission; accepted applications are retained as long as the staff relationship is active.
• Staff account data — retained while the account is active and for 2 years after deactivation for payroll and tax compliance purposes.
• Server logs — retained for 90 days.

You may request earlier deletion of your data at any time (see Section 8).

7. Cookies and Tracking

Our public website does not use advertising cookies, analytics tracking cookies, or third-party pixel trackers. The only cookies set are:

• Session authentication cookies — required for the staff portal to function. These expire when you close your browser or after 7 days of inactivity.

You can disable cookies in your browser settings, but doing so will prevent access to the staff portal.

8. Your Rights

Under PIPEDA, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request that inaccurate or incomplete information be corrected
• Deletion — request deletion of your personal information, subject to our legal retention obligations
• Withdraw consent — withdraw consent to the use of your information for non-essential purposes at any time
• Complain — file a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated

To exercise any of these rights, contact us at . We will respond within 30 days.

9. Data Security

We implement appropriate technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include:

• Passwords stored as salted hashes — never in plain text
• All data transmitted over HTTPS/TLS
• Access to production systems restricted to authorized personnel
• Session tokens with automatic expiry

No system is perfectly secure. If you suspect a breach involving your information, contact us immediately at .

10. Children's Privacy

Our services are not directed at individuals under 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be noted on this page with an updated effective date. Your continued use of our services after changes are posted constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related questions, requests, or complaints: