Privacy Policy
Effective date: August 7, 2026 Last updated: August 7, 2026This Privacy Policy explains what personal information Code Stack Technology LLC (“we”, “us”, the “Platform”) collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it. We provide a multi-tenant consulting and resource-management service through which staffing and consulting companies (“tenants”) manage their workers, assignments, timesheets, approvals, invoicing and payments.
We are committed to handling personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec’s Act respecting the protection of personal information in the private sector (Law 25), and applicable privacy laws in the United States and other jurisdictions where our users are located.
1. Roles: who controls your information
For most personal information processed in the Platform, the tenant that employs or engages you (your staffing company, consulting firm or operator) is the organization that decides how and why your information is used — under PIPEDA and Law 25 they are the organization accountable for it. We act as their service provider and process the information on their behalf and under their instructions, in addition to operating and securing the Platform for our own legitimate business purposes. If you are a worker or account contact, direct access and correction requests to your tenant first; we will assist them, or act directly where we are the accountable organization.
2. Information we collect — and from whom
We limit collection to what is necessary to provide the service. Depending on your role, we may collect:
Identity & contact details — name, email address, phone number, mailing/home address.
Demographic & HR details — date of birth, emergency-contact information, role/title, skills and certifications.
Banking information — direct-deposit bank account and routing/transit details used to pay workers.
Tax identifiers — government tax identification numbers (US SSN/EIN, Canadian SIN) required for tax reporting (e.g. 1099-NEC, T4/T4A) and identity verification.
Assignment & work records — timesheets, hours, allowances, expenses, approvals, pay and bill rates, invoices and payables.
Account & usage data — login records, IP/device information, and audit logs needed to operate and secure the Platform.
We collect this information directly from workers (for example, when you complete your profile, submit a timesheet or expense, or enter banking details) and from account contacts at the tenant and operator companies who manage assignments and approvals. Some information (such as assignments, pay rates and approvals) is entered about you by your tenant.
3. Why we collect it (purposes)
We use personal information to:
Process payroll and pay workers, including direct deposit;
Generate timesheets, invoices and payables, and manage the approval workflow;
Meet legal, tax and employment-reporting obligations (e.g. 1099-NEC, T4/T4A);
Manage tenant accounts, assignments and user access;
Secure the Platform, prevent fraud and abuse, and maintain audit trails;
Communicate with you about your account, assignments and approvals.
We will not use your information for a new purpose that is incompatible with these without your consent or unless permitted by law.
4. Legal basis & consent
Under PIPEDA we rely on your meaningful consent — given knowingly and in plain language — to collect, use and disclose your personal information for the purposes described above, except where the law allows or requires us to act without consent (for example, to meet a legal or tax obligation, or to establish, manage or terminate an employment or engagement relationship). Where Quebec’s Law 25 applies, we obtain express consent for sensitive personal information — which includes financial data such as banking details and tax identifiers — and that consent is requested separately and clearly for that purpose. You may withdraw your consent at any time, subject to legal and contractual restrictions and reasonable notice (see Your rights below); withdrawing consent may mean we can no longer provide some or all of the service.
5. Who we share it with
We disclose personal information only as needed to deliver the service:
Your tenant — the staffing/consulting company that employs or engages you, and, where relevant to an assignment, the operator/client account you are placed with;
Payment processors and financial institutions — to deposit pay and process payments;
Tax and government authorities — where required by law for tax reporting and compliance;
Sub-processors — vetted service providers (e.g. cloud hosting, email delivery) bound by confidentiality and data-protection obligations and permitted to use the data only to provide their service to us.
6. Retention
We keep personal information only as long as necessary for the purposes described above or as required by law. Certain financial and employment records — timesheets, invoices, payables and tax records — are retained for the periods mandated by tax and employment-standards legislation (for example, several years after the end of the relevant tax year) even after a worker leaves. When you exercise your right to erasure, we anonymize identifying personal information while preserving these legally required financial records in de-identified form. After applicable retention periods expire, information is securely deleted or irreversibly anonymized.
7. How we protect it (security safeguards)
We apply technical, physical and organizational safeguards appropriate to the sensitivity of the information, including:
Encryption — data is encrypted in transit (TLS) and at rest;
Role-based access control — access is restricted to authorized users on a need-to-know basis, enforced by per-tenant data isolation;
Masking — sensitive identifiers such as SSN/SIN and bank account numbers are masked in the interface and exposed only where strictly necessary;
Audit logging — access to and changes of records are logged.
No system is perfectly secure, but we work to protect your information and to limit and respond to any incident.
8. Your rights
Subject to legal limits, you have the right to:
Access — request confirmation of, and a copy of, the personal information we hold about you. Account administrators can produce this through the Platform’s Export personal data tool.
Correction — ask us to correct inaccurate or incomplete information.
Withdraw consent — withdraw consent to processing where applicable, subject to legal and contractual limits.
Erasure / anonymization — request that we delete or anonymize your personal information. The Platform provides an Anonymize administrative tool for this. Note that financial and employment records we are legally required to keep are retained (in de-identified form where possible) rather than deleted.
Portability — receive certain information in a structured, commonly used, machine-readable format.
To exercise these rights, contact us using the details in section 11, or ask your account administrator. We will respond within the timeframes required by applicable law. You also have the right to complain to your privacy regulator (see section 11).
9. Where your data is stored (cross-border)
Because data is stored and processed in the United States, it may be subject to US laws, including lawful access requests by US authorities. For users in Canada, and particularly in Quebec, this is a cross-border transfer: under Law 25 we have assessed the privacy implications of storing personal information outside Quebec and apply contractual and technical protections (including encryption and access controls) to provide an adequate level of protection. A Canada-resident hosting option is available for tenants who require their data to remain in Canada — contact us to enable it for your organization.
10. Quebec Law 25 specifics
Privacy Officer. Our designated person in charge of the protection of personal information is Michael Duhon, Managing Member, reachable at sales@codestack.services.
Breach notification. If a confidentiality incident involving your personal information presents a risk of serious injury, we will notify the Commission d’accès à l’information du Québec and affected individuals as required, and keep a register of such incidents.
Automated decisions. We do not use your personal information to make decisions based exclusively on automated processing. If that changes, we will inform you and honour your right to request review.
11. Text message (SMS) communications
We can send text messages about work you are already doing on the Platform — for example a reminder that a timesheet is due, a request to approve someone’s time, or notice that a payment has been released. We do not send marketing or promotional text messages.
Consent. You choose to receive text messages by opting in within the Platform, in your notification preferences. We do not add you from any purchased, rented or third-party list. Consent is not a condition of employment, of engagement by any company using the Platform, or of using the Platform itself — every notification we send by text is also available in the app and by email.
Message frequency. Varies with your activity — messages are triggered by events such as a timesheet becoming due or an approval being requested, not on a fixed schedule.
Opting out. Reply STOP to any message to stop receiving them. You can also turn text notifications off at any time in your notification preferences. Opting out of texts does not affect your account, your pay, or the notifications you receive in the app or by email.
Help. Reply HELP to any message, or contact us at sales@codestack.services.
Cost. Message and data rates may apply. Message delivery depends on your mobile carrier, and carriers are not liable for delayed or undelivered messages.
We do not sell, rent or share mobile phone numbers, text-message opt-in information, or consent with third parties or affiliates for their own marketing or promotional purposes. Mobile numbers and opt-in status are disclosed only to the messaging provider that transmits the messages on our behalf, strictly for the purpose of delivering them, and to the company that engages you where that company is the organization accountable for your information (see section 1).
12. Contact us & making a request
For privacy questions, requests or complaints, contact our Privacy Officer:
sales@codestack.services
Code Stack Technology LLC — Texas, United States
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for Quebec residents, the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).
13. Changes to this policy
We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, for material changes, provide additional notice as required by law. Your continued use of the Platform after an update takes effect indicates your awareness of the revised policy.