Privacy Policy

Last updated September 2026

Who this covers

This policy explains what happens to your data when you use Certified Payroll, the website at this domain, and the application where you file certified payroll reports. We are based in the European Union, so EU data protection law (GDPR) applies to how we handle your data, regardless of where you are located.

What we collect

What the product needs to function, plus usage measurement that depends on your choice (see Cookies and tracking below). Nothing is sold.

• Account data: your email address and password, to sign you in. Passwords are handled by our authentication provider and are never visible to us in plain text.
• Payroll and project data: what you type into the app, worker names, hours, wage rates, project details, so it can be assembled into your WH-347 filing and saved for the three-year record you are required to keep.
• Billing data: handled entirely by Stripe. We receive confirmation that a subscription is active, never your full card number.
• Contact form messages: the name, email, and message you submit when you write to us, so we can reply.
• Usage data: which pages you visit, how far you scroll and which buttons you click, and on one page a recording of clicks and scrolling. Only with your consent where the law requires it. Details are under Cookies and tracking.

Where it is stored

Wage rates you look up are fetched from SAM.gov, a public U.S. government source. That lookup does not send any of your personal or payroll data to SAM.gov, only the wage determination number you enter.

How your payroll data is handled

When you generate a WH-347 PDF, it is assembled in your own browser, on your own device. The filled document is not uploaded to our servers to be created. What you have already saved in the app (worker entries, project details) is stored in our database so you can come back to it next week and so your three-year archive exists.

Legal basis

We process account and payroll data because it is necessary to provide the service you signed up for (contract performance). We process contact form messages based on your consent when you submit the form. We keep basic security logs based on our legitimate interest in keeping the service running and free of abuse.

Analytics and advertising measurement runs on your consent in the EU, the EEA, the United Kingdom and Switzerland. Elsewhere it runs by default and you can switch it off at any time. The visit counter described below is based on our legitimate interest in knowing whether the site works.

How long we keep it

Payroll and project data is kept for as long as your account is active, consistent with the three-year recordkeeping period that applies to certified payroll under Davis-Bacon regulations. If you close your account, contact us and we will delete what is not otherwise required to be kept. Contact form messages are kept only as long as needed to answer you. Google Analytics data is kept for 14 months. Hotjar data is kept for the period set in our Hotjar account, and we delete recordings we no longer need.

Cookies and tracking

Part of this depends on your answer. Visitors from the EU, the EEA, the United Kingdom and Switzerland are asked before anything except the first item below runs. Everywhere else the measurement runs by default. Either way, "Cookie settings" in the footer of every page reopens the choice, and a change takes effect straight away.

• Strictly necessary: a cookie called cp_consent remembers your choice for up to six months. The application keeps your login session in your browser's local storage so you stay signed in. Neither needs your consent and neither is shared with anyone.
• Analytics: Google Analytics 4 counts visits, pages, scroll depth and clicks on buttons such as "Try the sample WH-347", so we can see where visitors drop off. On the WH-347 software page only, Hotjar records clicks, scrolling and mouse movement as heatmaps and session recordings. Neither runs on the two pages where you enter data (the wage determination lookup and the fillable form), and Hotjar does not run on the home page or in the application. Hotjar also keeps a few entries in your browser's local and session storage.
• Advertising: Google Ads conversion measurement tells us whether a click on our ad ended in a sample PDF or a signup. We use it for nothing else. In the application, a small entry in your browser's local storage notes that a signup was counted, so it isn't counted twice. It is only written if you have agreed to analytics or advertising.
• Visit counter: a small counter of our own records that a page was opened, with your country (which our host derives from your network address, and we do not store the address), your browser type, the site you came from and any campaign tag in the link. It sets no cookie. If you have agreed to analytics it also uses a random ID in your browser's session storage to group events from one visit. Without that agreement the ID is never created.

Google may process this data in the United States. Google relies on the EU-U.S. Data Privacy Framework and standard contractual clauses for those transfers.

To withdraw, open "Cookie settings" in the footer, untick what you do not want and save. Google Analytics and Google Ads stop sending at once. Hotjar keeps recording until you open the next page. Cookies already in your browser stay until they expire or you clear them.

Your rights

You can ask to see what data we hold about you, correct it, or have it deleted, subject to what we are legally required to keep. To exercise any of these, use the contact form.

Changes

If this policy changes in a way that matters, we will update the date at the top of this page.