Privacy Policy

Last updated: November 12, 2026

This policy explains how StaffGala ("we", "us") handles information in the StaffGala service (the website staffgala.com, the admin dashboard, the worker pages and related apps). StaffGala is used by event staffing companies ("Customers") to manage their events and workers ("Workers").

Who controls your data. When a Customer adds Workers, events or client details, that Customer decides how the information is used and is responsible for it. StaffGala processes that information on the Customer's behalf to run the Service. For account and billing information of Customers, StaffGala is responsible.

Information we collect

• Company accounts: company name, owner and admin names, email addresses, password (stored encrypted by our authentication provider), plan and billing status.
• Billing: handled by Stripe. We receive the plan, payment status, billing email and the last 4 digits and brand of the card. We never see or store full card numbers.
• Workers: name, email, phone number, the roles they work (for example server or bartender), availability and application details they enter, and their responses to job offers (accepted, declined).
• Events: event date, times, location, event type, number of guests and staff needed, and the client contact details a Customer enters.
• Notifications: if a Worker turns on phone notifications, a notification token for that phone or browser.
• Technical data: basic logs (such as IP address, browser type and time of request) needed to run and secure the Service.

How we use information

• to provide the Service: create accounts, show events, send job offers and cancellations, record responses;
• to send transactional emails and phone notifications (job offers, schedule changes, sign-in codes, plan limit and billing notices);
• to process subscriptions and payments;
• to keep the Service secure, prevent abuse and fix problems;
• to comply with legal obligations.

We do not sell personal information, and we do not use Worker or client information for advertising.

Separation between companies

Each Customer sees only its own events, Workers and admins. If a Worker works for more than one company, they use one login and can see the jobs from each company they joined, but one company cannot see the Worker's details or jobs from another company.

Emails and phone notifications

Job emails are sent on behalf of the staffing company, show the company's name, and replies go to the company. Workers can turn phone notifications off at any time in their phone or browser settings. Emails related to jobs are transactional; a Worker who no longer wants them can ask the company to remove them or delete their worker account.

Service providers

We use trusted providers that process data only to run the Service for us:

• Supabase (database and sign-in)
• Vercel (website hosting)
• Resend (email delivery)
• Apple Push Notification service and browser push services (phone notifications)
• Stripe (payments and invoices)

We may also share information if required by law, to protect the rights and safety of users or StaffGala, or as part of a sale or merger of the business (with this policy continuing to apply).

Data retention and deletion

• We keep information while the account is active.
• Company accounts with no activity for 90 days (no admin sign-in and no new or upcoming events, Workers or job assignments) are deleted automatically, together with all their data. We email the owner at least 7 days before, and signing in keeps the account. Accounts on a paid plan are never deleted this way.
• A company owner can ask us to close the company account; we then delete the company's events, Workers and admins within 30 days. Any admin can delete their own login from the admin dashboard.
• A Worker can delete their worker account from the worker pages; this removes their records and notification tokens from every company they joined.
• Billing records (invoices) are kept by Stripe and by us as long as tax and accounting laws require.
• You can also ask us to delete or export your information by contacting us below.

Security

Data is sent over encrypted connections (HTTPS). Database access is restricted so that each company can only reach its own data. No system is perfectly secure, but we take reasonable measures to protect information.

Your rights

Depending on where you live (for example California), you may have the right to know, access, correct or delete your personal information, and to not be discriminated against for using these rights. Workers should first contact the company they work with; you can also contact us and we will help or forward the request.

Children

The Service is not intended for anyone under 18, and we do not knowingly collect information from children.

Changes

We may update this policy. If a change is significant, we will notify Customers by email or in the admin dashboard.

Contact

Privacy questions or requests: cristimaxinmihai@yahoo.com