Privacy

Only what a payroll system cannot work without.

• About you: your name, your email address, and a password that is stored only as a salted scrypt hash. We cannot read your password and cannot tell you what it is.
• If you sign in with Google: your Google account identifier, name and email. We never see your Google password.
• About your company: its legal name, entity type, addresses, and tax registration identifiers.
• About the people you pay: names, work email addresses, job titles, start dates and pay. Home addresses, tax elections and bank details are collected from the worker directly, once that part of the product exists.
• About your use of the service: an append-only record of who changed what and when, plus the IP address and browser of each sign-in, so an unexpected session is something you can actually spot.

• There is no advertising, no advertising identifier, and nothing on this site is sold or shared with an advertising network.
• There are no third-party analytics or tracking scripts. The only cookies set are the two needed to keep you signed in and to protect forms against cross-site request forgery.
• Payroll data is never used to train a machine-learning model.

• Identifiers that would be damaging to leak — tax registration numbers today, government identification numbers and bank details when those exist — are encrypted before they reach the database, with AES-256-GCM and a key the database itself does not hold.
• Those values are never written to a log, an error report or an analytics event. That is enforced in the code that does the logging, not left to whoever writes the next feature.
• Signing in gives your browser an opaque token. It expires after 8 hours without use, and after 30 days regardless. Only a hash of it is stored, so a copy of the database does not let anyone sign in as you.
• Each company is a separate tenant. Every query is scoped to one organisation at the database layer, and a record belonging to another company reads as though it does not exist rather than as a refusal.

As few parties as the job allows, and each one for a named reason. Nothing below is enabled unless the corresponding feature is switched on for your account.

• Our hosting and database providers, who hold the data at rest in order to run the service.
• An address verification service, when you ask for an address to be checked. It receives that address and nothing else — no names, no pay, no identifiers.
• Google, if you choose to sign in with Google.
• A payment provider, once one is connected. None is connected today, and no card details have ever been collected by this service.

When payroll filing and money movement exist, they will involve licensed partners who necessarily receive worker and bank details in order to do the work. That is not the case today, and this page will say so plainly when it changes.

Payroll records exist to be looked back at, and several of the obligations attached to them are measured in years, so the default is to keep rather than to delete. Ask us to delete your account and we will, subject to records we are required to retain — and the retention periods that apply to payroll records are a matter for your accountant or lawyer, not for us to state on your behalf.

You can see and correct everything about you and your company inside the product, export it, and ask for your account to be closed. Depending on where you live you may have further rights over your personal data; exercising them starts with the same request.

Write to info@payrole.net. That address reaches us for anything on this page — a question, a correction, a copy of your data, or a request to close your account.

PayRole is pre-release and small enough that this is a real inbox rather than a queue, which cuts both ways: a person reads it, and there is no rota, so we will not promise you a reply inside a number of hours we cannot keep.