Privacy Policy
Last updated November 3, 2026 · Version 2026-11-draft.1
How PayrollGrove collects, uses, protects, and deletes personal information.
Who we are
PayrollGrove is operated by [LEGAL ENTITY NAME], doing business as PayrollGrove, [ADDRESS] ("we", "us"). This policy explains how we handle personal information on payrollgrove.com (the "website") and in the PayrollGrove application at app.payrollgrove.com (the "Service").
Our two roles
When we are the controller. We decide how to use information about our own customers and prospects: website visitors, people who contact us, account owners and administrators, partner firm staff, and billing contacts. This policy describes that processing.
When we are a processor (service provider). Companies use PayrollGrove to manage their own employees and contractors. For that data (for example, an employee's pay, tax forms, and bank details) the company is the controller and we process it only on its instructions under our Data Processing Addendum. Under the California Consumer Privacy Act (CCPA/CPRA) we act as a service provider for that data. If you are an employee or contractor of a PayrollGrove customer, your employer's privacy notice applies, and requests about your data should go to your employer first (see "Your rights" below).
Information we collect
From website visitors
- Contact form submissions: name, work email, company name, company size, and your message.
- Basic server logs: IP address, time, requested page, and browser user agent, kept for security and troubleshooting.
The website uses no cookies, no analytics, no advertising pixels, and no third-party scripts. See the Cookie Policy.
From customers and users of the Service
- Account data: name, email, password (stored only as a salted hash), multi-factor authentication settings, role, and notification preferences.
- Company data: legal name, address, tax identifiers, bank and ACH settings, pay schedules, and policies.
- Security data: sign-in events, device and IP information, and audit log entries recording who did what and when.
- Billing data: billing contact, invoices, and monthly usage counts.
- Support data: messages you send us.
Worker data we process for our customers
On behalf of each customer we process data about its employees and contractors, including identity and contact details, job and compensation history, time and time-off records, tax elections (W-4 and state forms), I-9 information, pay stubs and tax forms, documents and signatures, and payment details. Some of it is restricted data:
| Category | Examples | How it is protected |
|---|---|---|
| Restricted | Social Security and taxpayer numbers, bank routing and account numbers, date of birth, I-9 data, garnishment case numbers, employer tax IDs | Encrypted field by field with a key unique to each company; masked by default; revealing a value requires permission and re-authentication and is logged |
| Confidential | Compensation, home address, personal contact details, time-off notes, documents | Encrypted disks and encrypted backups; visible only to permitted roles |
| Internal | Name, title, department, work email, manager | Visible in the company directory |
Restricted values never appear in our application logs, notifications, or emails.
How we use information
We use personal information to:
- provide, secure, and support the Service, including payroll calculation, document generation, and reminders;
- authenticate users and detect fraud, such as suspicious sign-ins or direct-deposit changes;
- respond to inquiries and send service and billing communications;
- meet legal obligations, such as record retention; and
- improve the Service using aggregated, non-identifying operational metrics.
We do not use worker data for our own marketing, we do not build advertising profiles, and we do not use customer data to train third-party AI models.
No selling or sharing
We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA. We disclose personal information only:
- to the subprocessors that help us run the Service, under written contracts;
- to users your company authorizes, including partner firms you approve;
- when required by law, after checking that the request is valid and, where allowed, notifying the affected customer; and
- in a merger or acquisition, subject to this policy.
Where data is stored
Data is stored and processed in the United States, on servers we operate in a US data center, with encrypted disks. Offsite encrypted backups are stored in the United States by our affiliate. We do not transfer customer data outside the United States.
Security
Key measures include field-level encryption of restricted data, mandatory multi-factor authentication for privileged users, step-up authentication for sensitive actions, tamper-evident audit logs, rate limiting, encrypted backups with point-in-time recovery, and no standing staff access to customer data. Staff can access a company's data only with that company's approval, for a limited time, with every action logged. Customers can see an access log showing who viewed or revealed their restricted data. More detail is on our Security page. No system is perfectly secure; if a breach affects your information, we will notify you or your employer as required by law and our contracts.
How long we keep information
We keep data only as long as needed for the purposes above or as required by law. Default retention periods for customer data:
| Record | Default retention |
|---|---|
| Payroll runs, tax liabilities, filings records, tax forms, W-4s | 7 years after the end of the tax year |
| Pay stubs | 7 years |
| NACHA payment files | Deleted 90 days after creation (a record and checksum are kept) |
| Timesheets | 4 years |
| Form I-9 | The later of 3 years after hire or 1 year after termination, then deleted within 30 days |
| Employee records after termination | 7 years, then reduced to name and identifiers needed to link payroll history |
| Audit logs | 7 years |
| Closed company accounts | 90-day read-only export window, then the periods above |
| Website contact submissions | [24 months] |
A customer's legal hold overrides these deletion schedules.
Deletion and backups: the honest timeline
When a company's data is permanently deleted, we destroy that company's encryption keys. Its restricted fields and files become unreadable in the live system immediately. Copies inside backups stay recoverable until those backups expire:
- physical database backups used for point-in-time recovery expire after about 4 weeks;
- nightly encrypted database archives are kept on a schedule of 7 daily, 4 weekly, 12 monthly, and up to 7 yearly copies, to meet payroll record-keeping requirements.
Full deletion therefore completes when the last backup containing the company's keys ages out, or earlier if we rotate and destroy the master key that protects them. Backups are encrypted and access to them is restricted to restore and recovery operations.
Your rights
Depending on where you live, you may have rights to know, access, correct, delete, or obtain a copy of your personal information, and to not be discriminated against for exercising them.
- Customers and website visitors: email privacy@payrollgrove.com. We will verify your request and respond within the time the law requires.
- Employees and contractors of our customers: contact your employer, which controls your data. Many requests can be handled directly in the Service (for example, updating your address or downloading your pay stubs). If you contact us, we will forward your request to your employer and help it respond.
Children
The Service is for businesses and is not directed to children under 16. Employers may process data about minor workers as required by employment law; that data is handled under the DPA.
Changes to this policy
We will post updates here and change the "updated" date. For material changes we will notify customers by email or in the Service at least 30 days before they take effect.
Contact
privacy@payrollgrove.com · [LEGAL ENTITY NAME], [ADDRESS]