EasyStaff

Privacy Policy

Last updated: 18 August 2026

EasyStaff (“EasyStaff”, “we”, “us”, or “our”) provides a staff scheduling service for shift-based businesses. This policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights you have. We process personal information in accordance with South Africa’s Protection of Personal Information Act, 2013 (“POPIA”).

This policy applies to managers and business owners who use the EasyStaff app or website, and to staff members whose details are added to EasyStaff by their employer — including those who receive work-schedule messages on WhatsApp without installing the app.

1. Who is responsible for your information

The business (your employer) that adds you to EasyStaff decides why your information is processed and is the responsible party for your work data. EasyStaff acts as the operator that processes that information on the business’s behalf, and as the responsible party for account and service data we collect directly. Our contact details are at the end of this policy.

2. Information we collect

From managers and business owners

• Name and email address (used to create and secure your account).
• Business details you enter — business name, contact number, sites, roles, and currency.
• Authentication and security data, including accepted legal-policy versions, device identifiers, device names, session and sign-in information, and, if permission is granted, push-notification tokens.
• Subscription and billing status. For South African plans, Paystack collects card and checkout information under its own privacy notice so we can charge the subscription; EasyStaff does not store card numbers. International checkout, when enabled, is processed by Paddle as merchant of record under Paddle’s privacy notice.

About staff members

• Name and, where provided, contact phone number.
• Work-related information: assigned shifts, roles, sites and addresses, availability, shift-request reasons, attendance, clock times where enabled, and manager notes.
• Optional hourly rates, tips, payment records, paid hours, and related notes, where a business chooses to use those features.
• Optional profile photos. Profile photos are shared within the relevant business and are stored in a public-content storage location; do not upload sensitive photos.

Device integrations

• Push-notification tokens and delivery data when you allow app notifications.
• Calendar event details only when you choose to add or sync an assigned shift to your device calendar. EasyStaff writes those events to the calendar you choose; it does not read your unrelated calendar events.

WhatsApp messaging information

Where a business enables WhatsApp messaging and a staff member opts in, we process:

• The staff member’s WhatsApp phone number.
• Opt-in and opt-out status and the time it was set.
• The content of operational messages we send (for example, shift details and reminders) and replies received (for example, tapping “Confirm” or “Can’t work”, or messaging “STOP”).
• Message delivery information such as sent, delivered, read, and failure status.

3. How we use your information

• To create schedules and let managers assign, publish, and manage shifts.
• To notify staff of assigned shifts, changes, and reminders — in the app and, where enabled and opted in, on WhatsApp.
• To let staff confirm shifts or indicate they cannot work.
• To show managers delivery and confirmation status so schedules can be relied on.
• To keep the service secure, prevent misuse, and meet legal obligations.
• To maintain account records, enforce plan limits, process subscriptions, and provide support.

4. Legal basis for processing (POPIA)

We process personal information where:

• it is necessary to provide the scheduling service and carry out the working relationship;
• you have consented — for example, opting in to receive WhatsApp messages; and
• it is necessary to pursue our or the business’s legitimate operational interests, balanced against your rights.

5. Sharing your information

We share personal information only as needed to run the service:

• Meta Platforms (WhatsApp Business Platform): phone numbers and message content are processed by Meta to deliver WhatsApp messages, subject to Meta’s own terms and privacy practices.
• Our hosting and infrastructure providers (for example, our database and cloud hosting partners), who process data on our behalf under appropriate safeguards.
• Supabase: authentication, database, storage, and server functions.
• Expo: push-notification delivery where you enable notifications.
• Paystack: South African subscription checkout, card authorizations, recurring charges, and refunds as our payment processor.
• Paddle: international subscription checkout, tax, invoicing, payment, and refund processing as merchant of record, when that checkout is enabled.
• Your employer / the business that added you, who can view your work data, message delivery status, and replies within EasyStaff.
• Where required by law, regulation, or valid legal process.

Some of these providers may process information outside South Africa. Where that happens, we take reasonable steps to ensure a comparable level of protection as required by POPIA.

6. WhatsApp opt-in and opt-out

Staff receive WhatsApp messages only after opting in. Messages identify the business and are limited to operational scheduling communication (rosters, shift details, updates, cancellations, and reminders). You can opt out at any time by replying STOP to any message, and opt back in by replying START. A manager can also turn WhatsApp messaging off for you. Opting out of WhatsApp does not remove you from the schedule — your employer will contact you another way.

When a manager turns WhatsApp on for a staff member, the manager must confirm that the staff member gave advance consent to receive those messages from the named business. EasyStaff stores that attestation (who confirmed, when, and which consent notice version) as evidence of the opt-in process. Staff who reply START on WhatsApp create a direct opt-in record themselves.

7. How long we keep information

We keep personal information for as long as needed to provide the service and to meet legal and operational requirements. Retention for WhatsApp-related data is:

• Raw WhatsApp webhook payloads: deleted automatically after 30 days.
• WhatsApp message delivery logs (sent/delivered/failed history and short body previews): deleted automatically after 90 days.
• Opt-in preferences and consent attestation: kept while the staff member remains linked to the business, and for a short period after removal where needed for audit or legal obligations.
• Push-notification tokens: kept while linked to the user and removed when the related user record is deleted.

Other account, schedule, attendance, rate, tip, payment, and staff records are kept while the business account remains active or as the business instructs us, unless a longer period is required or permitted by law, needed to establish or defend a legal claim, or retained in a secure backup for a limited cycle. Removing a staff member from a schedule does not by itself delete employment records. A business or data subject may request deletion or de-identification through the contact details below; we will assess the request with the responsible party and applicable retention obligations.

7A. Access, correction, deletion, and breach response

For workplace data held because your employer uses EasyStaff, contact your employer first — they are the responsible party for that data. You may also contact us at the details below. We will help businesses respond to access, correction, and deletion requests relating to data we process as their operator.

If we become aware of a security compromise, we will take reasonable steps to contain it. For workplace data, we will notify the affected business without undue delay so that it can meet its responsible-party notification duties. For account and platform data for which EasyStaff is the responsible party, we will notify affected people and the Information Regulator where required.

8. How we protect information

We use technical and organisational measures to protect personal information, including access controls, encryption in transit, and restricting who can access data. This does not apply to a profile photo uploaded to the public-content storage location described above. Message-sending credentials are stored securely on our servers and are never exposed in the app. No system is perfectly secure, but we take reasonable steps to safeguard your information.

9. Your rights

Under POPIA you have the right to:

• ask what personal information we hold about you and request access to it;
• request correction of information that is inaccurate or incomplete;
• request deletion of information where appropriate;
• object to processing in certain circumstances; and
• withdraw consent, such as opting out of WhatsApp messages.

To exercise these rights, contact us using the details below. You also have the right to lodge a complaint with the Information Regulator (South Africa): inforegulator.org.za.

10. Children

EasyStaff is intended for use in a working context and is not directed at children. We do not knowingly collect information about anyone below the legal working age without appropriate consent.

11. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you.

12. Contact us