Privacy Policy
Last updated August 2026
Who this covers
This policy explains what happens to your data when you use Certified Payroll, the website at this domain, and the application where you file certified payroll reports. We are based in the European Union, so EU data protection law (GDPR) applies to how we handle your data, regardless of where you are located.
What we collect
Only what the product needs to function. Nothing is collected for advertising, and nothing is sold.
- Account data: your email address and password, to sign you in. Passwords are handled by our authentication provider and are never visible to us in plain text.
- Payroll and project data: what you type into the app, worker names, hours, wage rates, project details, so it can be assembled into your WH-347 filing and saved for the three-year record you are required to keep.
- Billing data: handled entirely by Stripe. We receive confirmation that a subscription is active, never your full card number.
- Contact form messages: the name, email, and message you submit when you write to us, so we can reply.
Where it is stored
| Service | Purpose | Region |
|---|---|---|
| Supabase | Account login, database for your payroll and project data | Switzerland (eu-central-2) |
| Stripe | Payment processing | Handled under Stripe's own privacy terms |
| Netlify | Website hosting, contact form delivery | Handled under Netlify's own privacy terms |
Wage rates you look up are fetched from SAM.gov, a public U.S. government source. That lookup does not send any of your personal or payroll data to SAM.gov, only the wage determination number you enter.
How your payroll data is handled
When you generate a WH-347 PDF, it is assembled in your own browser, on your own device. The filled document is not uploaded to our servers to be created. What you have already saved in the app (worker entries, project details) is stored in our database so you can come back to it next week and so your three-year archive exists.
Legal basis
We process account and payroll data because it is necessary to provide the service you signed up for (contract performance). We process contact form messages based on your consent when you submit the form. We keep basic security logs based on our legitimate interest in keeping the service running and free of abuse.
How long we keep it
Payroll and project data is kept for as long as your account is active, consistent with the three-year recordkeeping period that applies to certified payroll under Davis-Bacon regulations. If you close your account, contact us and we will delete what is not otherwise required to be kept. Contact form messages are kept only as long as needed to answer you.
Cookies and tracking
This website does not use tracking cookies or analytics. The application stores your login session in your browser's local storage so you stay signed in, this is not a tracking cookie and is not shared with anyone.
Your rights
You can ask to see what data we hold about you, correct it, or have it deleted, subject to what we are legally required to keep. To exercise any of these, use the contact form.
Changes
If this policy changes in a way that matters, we will update the date at the top of this page.