InStaff Privacy Policy
Last Updated: October 26, 2026
This Privacy Policy explains what information InStaff collects, how we use and protect that information, and the choices available to our customers and users.
Throughout this Privacy Policy, “InStaff,” “we,” “our,” or “us” refers to INSTAFF INC., the company providing the service.
“The service” refers to our online pay stub delivery platform, employee portal, and related services.
A “customer” refers to an organization that uses the service. A “user” refers to an individual with an account that allows them to access and use the service.
Information We Collect and Receive
1. Customer Data
Information and content submitted by customers or users to the service are referred to as “Customer Data.”
Customer Data is controlled by the organization using the service. When InStaff collects or processes Customer Data, it does so on behalf of the customer.
Examples of Customer Data include, but are not limited to:
- Company announcements and documents uploaded by customers.
- Employee directory information, including names, job titles, profile photographs, and contact information.
- Information contained in employee pay stubs and tax forms.
Customers are responsible for obtaining any informed consent required for the use of the service by individuals whose information they submit.
InStaff collects and processes the personal information necessary to support its services, including information contained in pay stubs and tax forms that allows employees to be associated with their respective documents.
We aim to collect only the personal information necessary to deliver, maintain, and improve our services.
2. Other Information
InStaff may also collect and receive the following information.
Account Creation Information
Users may provide information such as their email address and password when creating an account.
Customer Setup and Contact Information
When an organization registers for our service, we may collect its company name, approximate company size, contact email addresses, and domain information.
Billing and other information
Our third-party payment processor, Stripe, may collect and store billing addresses and credit card information on our behalf. In certain circumstances, InStaff may collect or maintain billing information directly.
Service Usage Information
We may collect information about how users access and interact with the service, including administrative communications, support requests, and features used.
Log Data and Device Information
We may collect technical and device-related information associated with accessing and using the service to support functionality, security, and troubleshooting.
Geo-location information
Wi-Fi information and IP addresses received from a user’s device may be used to determine an approximate geographic location.
How We Use Your Information
1. Customer Data
InStaff may access and use Customer Data as reasonably necessary and in accordance with customer instructions to:
- Provide, maintain, and improve the service.
- Prevent, investigate, or resolve service disruptions, security concerns, and technical issues.
- Respond to customer support requests.
- Meet applicable legal obligations.
- Fulfill our contractual obligations to customers or other purposes expressly authorized by the customer in writing.
2. Other Information
Understanding and Improving Our Service
We may analyze service usage and trends to better understand how customers and users interact with our platform and identify opportunities for improvement.
Responding to Requests
If you contact us with a question, concern, or technical issue, we may use the information you provide to investigate and respond.
Sending emails
We may send service-related and administrative communications, including security notifications, fraud alerts, service changes, and important product information.
These communications form part of the service and may not be subject to opt-out.
We may also send promotional communications concerning new features and service offerings. Users may opt out of promotional emails at any time.
Billing management
We use relevant billing information to administer subscriptions, process payments, and maintain transaction records.
Customer Communication and Marketing
We may contact customers regarding invoicing, account management, and related business matters.
We may use contact information for marketing or advertising purposes, subject to applicable requirements and available opt-out options.
Your Choices
1. Customer Data
Customers retain control over the Customer Data they submit to InStaff and may provide instructions concerning its management.
During the initial setup process, InStaff creates an administrative user account to facilitate implementation and configuration.
By default, this administrative access may remain active to allow InStaff to provide technical and administrative support.
Following setup, customers may deactivate InStaff’s administrative access through the service.
Deactivating this access may limit our ability to provide full technical support. Customers may restore access when necessary.
2. Other Information
If you have questions about your personal information, its use, your rights, or available choices, you may contact us at privacy@instaff.org.
Sharing and Disclosure
1. Customer Data
InStaff may share Customer Data in accordance with its agreements with customers and their instructions.
Third-Party Service Providers and Agents
We may engage third-party companies or individuals to process Customer Data on our behalf when necessary to provide or support the service.
2. Other Information
InStaff may share other information under the following circumstances.
Sharing Information with Customer Organizations
When an employee or user contacts InStaff for assistance, we may share relevant details of the issue with their employer or customer organization when necessary to investigate or resolve the concern.
Third-Party Service Providers
We may engage third-party providers, including payment processing services, to process information on our behalf.
3. Other Types of Disclosure
InStaff may also disclose Customer Data or other information in the following circumstances.
Changes to Our Business Structure
Information may be shared or transferred in connection with a merger, acquisition, bankruptcy, dissolution, restructuring, financing, sale of assets, or similar business transaction, including related due diligence.
Compliance with Laws
We may disclose information when necessary to comply with applicable laws, regulations, lawful requests, court orders, or legal proceedings.
Protection of Rights, Fraud Prevention, and Safety
We may use or disclose information to protect the rights, property, or safety of InStaff or third parties, enforce contracts and policies, investigate suspicious activities, and prevent fraud.
Aggregated or De-identified Information
InStaff may use or share aggregated or de-identified information for business, analytical, or research purposes.
For example, we may share general workforce statistics or collaborate with research organizations to study trends related to our services.
Data Breach Incidents
In the event of a confidentiality incident involving personal information, InStaff will inform affected customers of the incident and its extent, including the affected data elements and number of individuals, as soon as feasible.
InStaff will also notify the Commission d’accès à l’information du Québec (CAI) and concerned individuals, as applicable, and maintain a register of confidentiality incidents.
We will take reasonable measures to reduce the risk of harm to affected individuals and prevent similar incidents from occurring.
Customer Data Retention and Deletion
Customer Data Retention
InStaff retains Customer Data only for as long as reasonably necessary to fulfill the purposes for which it was collected and used.
Customer Data may be retained while users maintain active accounts or while InStaff continues providing services to a customer.
For terminated employees, information may continue to be retained for the period determined necessary by the customer, including situations where former employees require access to historical pay documents.
Customer Data Deletion
InStaff deletes Customer Data under the following circumstances:
- Upon request from an authorized representative of the customer, such as a portal administrator, including requests associated with service cancellation or support.
- In accordance with InStaff’s Terms of Service, including the standard seven-year retention period applicable to pay documents.
Customers are responsible for collecting, verifying, and administering data deletion requests submitted by their employees and users.
Authorized customer portal administrators are responsible for deleting relevant employee information when appropriate.
InStaff does not directly fulfill employee or user deletion requests when it cannot adequately verify the individual’s identity or authority.
Employees requesting deletion of their information should contact their organization’s portal administrator.
Security Incidents
Records of security incidents will be maintained for five years.
Our Cookie Policy
InStaff uses cookies and similar technologies, including web beacons and single-pixel GIFs, to collect and maintain log information.
We use both session-based and persistent cookies.
Cookies are small text files exchanged between a website or service and a user’s device.
Session-based cookies remain active while a browser session is open and are generally removed when the browser closes.
Persistent cookies remain until they expire or are deleted by the user or browser.
Certain cookies are associated with user accounts and help maintain authenticated sessions. Other cookies support website analytics, customization, and related functionality.
Users accessing InStaff through a web browser may manage their cookie preferences using browser settings.
Disabling certain cookies may affect service availability or functionality.
InStaff sets and accesses cookies on domains that it operates.
We may also use third-party services, such as Google Analytics, to support website analytics. Users may access the relevant third-party service’s available opt-out mechanisms.
InStaff does not currently recognize or respond to browser-initiated Do Not Track signals because there is no consistent industry standard for compliance.
Information Security
InStaff takes the security of Customer Data seriously and implements measures designed to address confidentiality, security, system availability, and disaster recovery.
For security-related inquiries, please contact: contact@instaff.org
Confidentiality
InStaff applies controls to restrict employee access to Customer Data and prevent unauthorized viewing or use.
Certain authorized personnel may require access to systems that store or process Customer Data to operate and support the service.
For example, InStaff personnel may need access to relevant information when investigating a technical problem reported by a customer.
Customer Data is accessed only for purposes consistent with this Privacy Policy.
Mobile Application Privacy Amendment
This section supplements InStaff’s existing Privacy Policy and applies to users accessing InStaff services through its mobile application (“Mobile App”), including applications available on supported iOS and Android devices.
1. Information Collected Through the Mobile App
When users access the Mobile App, InStaff may collect and process information necessary to provide the application’s features and functionality.
This may include:
- Account information, including login credentials and user profile details.
- Employee records and other Customer Data available through the service.
- Mobile device information, operating system details, and application usage information.
- Technical information necessary for authentication, troubleshooting, security, and service performance.
The Mobile App may request access to certain device features, including the camera, photo library, or location services, when these are required for supported functionality.
Access to such features is subject to the permissions granted by the user through their device settings.
2. How We Use Mobile App Information
Information collected or processed through the Mobile App may be used to:
- Provide access to InStaff’s employee portal and supported mobile features.
- Authenticate users and maintain account security.
- Display and process information authorized by the customer’s organization.
- Support technical troubleshooting and application performance.
- Maintain, secure, and improve the Mobile App and related services.
- Comply with applicable legal and contractual obligations.
Customer Data accessed or processed through the Mobile App remains under the control of the respective customer organization and is handled in accordance with this Privacy Policy.
3. Device Permissions
Depending on available application features, the Mobile App may request permission to access certain device capabilities.
Users can review or change applicable permissions through their mobile device settings.
Disabling permissions may limit or prevent access to features that rely on those capabilities.
InStaff will use device permissions for purposes associated with the relevant Mobile App functionality.
4. Data Sharing and Third-Party Services
Information processed through the Mobile App may be shared with authorized service providers when necessary to operate, maintain, secure, or support the application.
Any such processing remains subject to applicable privacy and security obligations and the provisions of this Privacy Policy.
InStaff does not obtain ownership of Customer Data accessed through the Mobile App.
5. Data Security and Retention
InStaff applies appropriate security measures to protect information processed through the Mobile App against unauthorized access, disclosure, alteration, or loss.
Customer Data accessed through the Mobile App is subject to the retention and deletion provisions described in the Customer Data Retention and Deletion section of this Privacy Policy.
6. User Rights and Data Management
Users may manage applicable Mobile App permissions through their device settings.
Requests to access, correct, or delete employee information must be directed to the user’s organization or authorized portal administrator, consistent with InStaff’s existing Customer Data management practices.
Uninstalling the Mobile App does not automatically delete information maintained by the user’s organization within the InStaff platform.
For privacy-related questions regarding the Mobile App, users may contact: privacy@instaff.org
7. Applicability of Existing Privacy Policy
All other provisions of InStaff’s Privacy Policy, including those relating to information collection, data usage, sharing, security, retention, disclosure, and user rights, continue to apply to the Mobile App.
Where this amendment does not specifically address a matter, the existing provisions of this Privacy Policy remain applicable.
Changes To This Privacy Policy
InStaff may update this Privacy Policy periodically.
Any changes will be posted on this page.
If a change materially affects how we use or disclose previously collected Customer Data or other information, we will notify affected customers by email.
Continued use of the service after updated terms become effective constitutes acceptance of the revised Privacy Policy, subject to applicable legal requirements.
Special Note for Quebec Residents Regarding Law 25
InStaff’s Privacy Policy is intended to align with the requirements of Quebec’s Law 25.
We will continue reviewing and updating our practices and policies as necessary to address applicable requirements.
Contacting InStaff
If you have questions or concerns about this Privacy Policy or InStaff’s privacy practices, please contact our Privacy Officer.
Email: privacy@instaff.org
Mailing Address:
INSTAFF INC.
2000 Argentia Road, Plaza 2, Suite 210
Mississauga, ON L5N 1V8
Canada