Data processing
Data processing addendum
This page describes the categories of personal data processed by WorkTag, storage locations, retention schedules, and breach notification commitments. Privacy practices · Security architecture.
Data categories processed
| Category | Data elements | Persons concerned |
|---|---|---|
| Identity | Display name, city, region, profile photo (optional) | Workers |
| Credentials | Credential type, issuer, issue/expiry dates, verification status | Workers |
| Documents | Uploaded files (invoices, contracts, certificates) stored in object storage | Workers |
| Clearance checks | Eligibility status, blocking reasons, missing requirements, expiry warnings | Employers |
| Eligibility computation | Eligibility status, credential summary, expiry tracking, fraud signal flags | Workers |
| Access logs | Viewer identity (if authenticated), access type, scope granted, timestamp | Workers, viewers |
| Account credentials | Email address, hashed password (managed by Supabase Auth) | Workers, employers |
Data residency
WorkTag uses Supabase as the managed database and storage provider. Data is stored in the region selected at project creation. For Canadian organizations, confirm the Supabase project region with us before signing.
Note: Supabase infrastructure is currently operated on AWS. Organizations with data sovereignty requirements should review Supabase’s own data residency documentation and confirm the selected region satisfies their obligations before onboarding.
Retention schedule
| Data type | Retention period | Trigger |
|---|---|---|
| Profile, credentials, proofs | Duration of active account | Deleted within 30 days of account deletion request |
| Uploaded documents | Duration of active account | Purged from object storage within 30 days of account deletion |
| Access logs | 12 months | Deleted on rolling basis after 12 months |
| Eligibility computation logs | 12 months | Deleted on rolling basis after 12 months |
| Share link records | Until expiry or deletion | Expired/revoked links purged within 7 days |
| Aggregate statistics | Indefinite | Non-personal, anonymized |
Breach notification
If a confidentiality incident involving personal information presents a risk of serious injury, we will promptly notify the Commission d’accès à l’information (CAI) and the persons concerned, as required by Quebec law, take measures to reduce the risk of harm, and record the incident in our incident register.
Notifications will include: the nature of the breach, categories of data affected, approximate number of individuals affected, likely consequences, and measures taken or proposed to address it.
Organizations that have executed a data processing agreement with WorkTag will receive notification within 24 hours of our internal confirmation.