Privacy Policy

This covers the Catch a Shift website and the accounts inside it, for workers and for employers. It does not cover an employer's own systems, or what an employer does with details you give them directly.

Almost all of it is what you type in yourself.

• Account details: your name, email address, phone number, and a password, which is stored hashed and never in a form anybody can read back.
• Worker profile: date of birth, address, job categories, skills, experience, the area you cover and how far you will travel.
• Documents: the identification and certifications you upload to show you can do the work.
• Consent and signature: the signature you draw, the name you type beside it, and the date it was given.
• Payment: a Stripe customer reference, the card brand and last four digits, the amount, and whether the payment is held, taken or released. We never receive your full card number.
• Technical: your IP address, browser and device, and when you sign in - kept for security, and for working out what went wrong when something breaks.

• To create and run your account, and to verify your email address and phone number.
• To review your application and decide whether to approve it.
• To match you with shifts in the categories and the area you chose.
• To hold, take or release the payment for your plan.
• To keep accounts secure and to investigate misuse.
• To answer you when you contact support.

We set two, and neither of them is for advertising.

• A session cookie holding your access token. It is httpOnly, which means no script on the page can read it, and it is the only place that token lives.
• cas_signed_in_worker or cas_signed_in_employer, which holds nothing but which kind of account is signed in, so the app knows to keep your session alive rather than dropping you out mid-form.

We do not use advertising or cross-site tracking cookies, and we do not sell your personal information.

• Employers whose shifts you apply for see the parts of your profile that are relevant to that application.
• The Catch a Shift reviewers who assess applications see what you submitted, including your documents.
• Stripe processes payments and holds your card details. Their own privacy terms cover what they do with them.
• Our hosting and storage providers hold the data on our behalf, and may not use it for anything of their own.
• Authorities, where we are legally required to hand something over.

Account details stay for as long as the account exists. Documents and the signature stay while the account is active, because they are the record of what was verified and what you agreed to.

Payment records are kept for as long as accounting and tax obligations require, even after an account is closed. Ask us to close your account and we remove what we are not required to keep.

• A copy of what we hold about you.
• A correction, where something is wrong.
• Deletion of anything we are not required to keep.
• Withdrawal of a consent you gave, though some of those are what let the account work at all.

Email support@catchashift.com and we will answer. We may need to check who you are before we do.

• Passwords are hashed. Nobody at Catch a Shift can read yours.
• Your access token lives in an httpOnly cookie, so a script on the page cannot lift it, and it expires and is renewed rather than left open.
• Card numbers never reach our servers.
• Access to documents is limited to the people who review applications.

No system is perfect. If something happens that affects you, we will tell you.

Catch a Shift is for people aged 18 and over. We do not knowingly collect anything about anybody younger, and we delete it if we find that we have.

The date at the top is the version you are reading. Where we change something that matters to you, we will say so rather than quietly reposting it.

Questions, requests or complaints about privacy go to support@catchashift.com.