Privacy policy

This policy explains what PaySaver.ai ("we", "us") holds about businesses, their people and our users, why, how we protect it and how long we keep it. We hold employee information for the business that employs them; that business decides what is entered.

Data we hold

• Account information: name, email address and sign-in details (through Microsoft Entra External ID), two-factor settings, language preference.
• Business information: legal name, EIN, addresses, pay schedule, state tax account numbers, the payroll bank account.
• Employee information: names, contact details, Social Security numbers, withholding certificates, pay rates, hours and time off, pay stubs, deductions and garnishments, direct-deposit bank accounts, and documents the business uploads.
• Contractor information: names, addresses, taxpayer identification numbers and payments.
• Billing information: subscription status and invoices. Card details are collected and kept by Stripe, not by us.
• Usage and security information: audit and activity logs, device and network details needed to keep the service secure.
• Anonymous page views and clicks: which pages are opened, where on a page people click and which button or link (by its name in our code), the kind of device, browser and system, the site that linked to us, and a random id that lasts one browser tab. Never what you type or what a page shows, never your name, business or IP address, and no cookies. We use it only to see which parts of PaySaver.ai are used and to improve them. It's off when your browser sends Global Privacy Control or Do Not Track.

How we use it

Only to provide the service: calculating payroll and taxes, preparing pay stubs and tax forms, reminders, support, billing, security and fraud prevention. We do not sell personal information or use it for advertising.

How we protect it

• Encrypted in transit (TLS 1.2 or later) and at rest.
• Social Security numbers, taxpayer identification numbers, bank account and routing numbers and tax account numbers are also encrypted field by field (AES-256), with keys held in Azure Key Vault. Screens show only the last four digits; a full reveal needs permission and two-factor and is logged.
• Each business's data is kept separate on every request and in the database itself.
• Owners use two-factor sign-in; banking actions always need a second check.
• Our staff see a business's data only in a time-limited support or setup session, and every look is recorded in that business's audit log. The setup team never sees full SSNs or bank numbers.

Retention

• Payroll and tax records: kept while you're a customer and for 4 years after you cancel (read-only, downloadable), then deleted.
• Sent emails and texts: 90 days. Anonymous page views and clicks: 90 days. Activity and in-app notifications: about 13 months. Audit logs: kept with the payroll records they relate to.
• Backups roll off on their own schedule after deletion.

Subprocessors

Placeholder list, to be confirmed before launch:

• Microsoft Azure — hosting, database, file storage, key management, email delivery (Azure Communication Services)
• Microsoft Entra External ID — sign-in
• Stripe — subscription billing and card payments
• Azure OpenAI Service — the in-app help assistant, when turned on (questions are redacted of SSNs first)
• [Support desk / text message provider — to be named]

Sharing

We share information only with the subprocessors above to run the service, when the business directs us to, or when the law requires it. We don't file with tax agencies on anyone's behalf; the business does.

Your choices

Owners can see, correct and download their business's records in the app. Employees can see their own pay and documents in the employee portal and should ask their employer to correct anything. Depending on your state, you may have more rights; email us to make a request.

Contact

Questions? Email support@paysaver.ai.