Privacy

Only what a payroll system cannot work without.

• About you: your name, your email address, and a password that is stored only as a salted scrypt hash. We cannot read your password and cannot tell you what it is.
• If you sign in with Google: your Google account identifier, name and email. We never see your Google password.
• About your company: its legal name, entity type, addresses, and tax registration identifiers.
• About the people you pay: names, work and home addresses, email addresses, job titles, start dates, pay, hours, time off, tax elections and bank account details.
• Work eligibility records: for each employee, the Form I-9 attestations and a record of the documents an employer examined. Document numbers are encrypted and only their last four digits are ever displayed; no images of anybody’s passport, licence or residence card are stored.
• About your use of the service: an append-only record of who changed what and when, plus the IP address and browser of each sign-in, so an unexpected session is something you can actually spot.

• There is no advertising, no advertising identifier, and nothing on this site is sold or shared with an advertising network.
• There are no third-party analytics or tracking scripts. The only cookies set are the two needed to keep you signed in and to protect forms against cross-site request forgery.
• Payroll data is never used to train a machine-learning model.

• Identifiers that would be damaging to leak — tax registration numbers today, government identification numbers and bank details when those exist — are encrypted before they reach the database, with AES-256-GCM and a key the database itself does not hold.
• Those values are never written to a log, an error report or an analytics event. That is enforced in the code that does the logging, not left to whoever writes the next feature.
• Signing in gives your browser an opaque token. It expires after 8 hours without use, and after 30 days regardless. Only a hash of it is stored, so a copy of the database does not let anyone sign in as you.
• Each company is a separate tenant. Every query is scoped to one organisation at the database layer, and a record belonging to another company reads as though it does not exist rather than as a refusal.

As few parties as the job allows, and each one for a named reason. Nothing below is enabled unless the corresponding feature is switched on for your account.

• Our hosting and database providers, who hold the data at rest in order to run the service.
• An address verification service, when you ask for an address to be checked. It receives that address and nothing else — no names, no pay, no identifiers.
• Google, if you choose to sign in with Google.
• PayPal, if you subscribe to a paid plan. It receives the identifier of your company and the plan you chose, so it can bill you. Payment details are entered on PayPal’s own pages and never reach this service — no card number has ever been collected here.
• Your subscription to PayRole and the payment of your workers are entirely separate. PayPal is not involved in paying anybody’s wages, and worker data is never sent to it.

When payroll filing and money movement exist, they will involve licensed partners who necessarily receive worker and bank details in order to do the work. That is not the case today, and this page will say so plainly when it changes.

Payroll records exist to be looked back at, and several of the obligations attached to them are measured in years, so the default is to keep rather than to delete. Ask us to delete your account and we will, subject to records we are required to retain — and the retention periods that apply to payroll records are a matter for your accountant or lawyer, not for us to state on your behalf.

Inside the product you can see and correct everything about you and your company, download a copy of your own account data as a file, and ask for your account to be closed. Those three are built in rather than promised, so they do not depend on us answering an email.

Depending on where you live you may have further rights — to a copy in a portable form, to correction, to deletion, to object to a particular use, or to complain to a regulator. Exercising any of them starts with the same message to info@payrole.net, and we do not charge for it or treat you differently afterwards for having asked.

Two different relationships run through this product, and they carry different obligations.

• For your own account — your name, your email, how you sign in — PayRole decides what is collected and why.
• For the people your company pays, your company decides what is collected and why, and PayRole holds and processes it on your instructions. Their questions about their own data are properly answered by their employer, and we will help you answer them.

If you need that relationship written down formally — a data processing agreement, or particular terms for a customer of your own — ask, and understand that this is one of the places where a pre-release product will tell you honestly that the paperwork is not finished yet.

The service and its database run in the United States. If you or the people you pay are outside the United States, using PayRole means data about them is held there.

Payroll itself is United States only today, so this mostly matters for your own account rather than for worker records.

PayRole is a tool for businesses and is not directed at children. We do not knowingly collect anything from a child. A young person can lawfully be an employee, and if your company pays one then their record is payroll data like anyone else’s, held for the same reasons and protected the same way.

If personal data held here is exposed, we will tell the companies affected, and tell them what we actually know rather than waiting until the picture is complete. Every sign-in and every change is recorded, which is what makes it possible to say who was affected instead of guessing.

The date at the top is when it was last reviewed against the code, not when it was last tidied. Where a change means we collect something new, or send something somewhere new, we will say so rather than quietly editing a sentence — and the pre-release sections above will be rewritten as the things they describe stop being hypothetical.

Write to info@payrole.net. That address reaches us for anything on this page — a question, a correction, a copy of your data, or a request to close your account.

PayRole is pre-release and small enough that this is a real inbox rather than a queue, which cuts both ways: a person reads it, and there is no rota, so we will not promise you a reply inside a number of hours we cannot keep.