Privacy policy

1. Who this notice covers

This draft notice is provided by Payhr. It describes account information handled for PayHr’s own service purposes and employee information processed for business customers. Your employer controls the payroll records it submits and the purposes for which it uses those records. Contact your employer first for questions about your pay or an employment record.

2. Information involved

PayHr may process account names, email addresses, usernames, passkey records, session and security logs; business contact, address, membership and billing details; and employee identity, employment, earnings, tax, banking, time and payroll documents. The exact information depends on the features used. Support messages and attached files are also processed when you request help.

Only provide information needed for the task. Do not put sign-in codes, full SINs, banking information or payment-card details in ordinary support messages.

3. Why information is used

Information is used to provide accounts and business workspaces, prepare payroll calculations and records, manage billing, respond to requests, prevent misuse, and maintain an audit history. Business customers are responsible for the employee notices and authority required for the information they submit. Optional information and new purposes should be explained when requested.

4. Service providers and disclosures

Stripe processes payment-card details through its payment component; PayHr does not receive the full card number. When you choose representative verification, Stripe Identity collects your photo ID and selfie. PayHr stores the verification result, consent record, Stripe session reference and company-authorization review; this integration does not store document or selfie images. Review the Stripe privacy policy before continuing. The application also uses email delivery, hosting and storage providers, Cloudflare abuse protection, and Google address suggestions where enabled. Address queries may be sent to Google when you use address suggestions; manual address entry is available.

The final provider list, contractual safeguards and processing locations require operational confirmation. Information may also need to be disclosed to comply with a lawful request, protect the service or fulfil an authorised business instruction, subject to applicable requirements.

5. Cookies and device information

Account sessions and security controls use cookies and related device or request information. Device recognition is a risk signal, not proof of identity. This marketing site does not add advertising trackers or analytics cookies. Authentication and payment providers may use their own necessary storage when you use the application or payment flow.

6. Retention and deletion

Payroll, financial and security records can have different retention needs. An account closure or subscription cancellation does not necessarily delete records that must be kept for an applicable obligation or a business customer’s authorised purpose. The final retention schedule, backup deletion process and request timelines must be confirmed before this draft becomes effective.

7. Access, corrections and requests

Contact your employer to correct employer-managed payroll information. For PayHr account information or a privacy question, email [email protected] with “Privacy request” in the subject. Explain what you need without attaching sensitive identity documents. Identity and authority may need to be verified through an appropriate channel before a record can be disclosed or changed.

Access, correction, consent withdrawal and complaint rights depend on the law that applies and may be subject to exceptions. If a request cannot be fulfilled, the reason and available options should be explained.

8. Safeguards and processing locations

The application includes passkey support, revocable sessions, workspace roles, protected sensitive fields and audit records. These controls do not establish independent certification or eliminate risk. Production infrastructure, hosting regions, backup arrangements and international-processing disclosures remain subject to confirmation. No Canadian-only data residency or SOC 2 certification is claimed.

9. Contact and updates

Payhr is the contact for this notice. Send privacy questions to [email protected]. The named privacy officer and business address should be added before adoption. Material changes should be reflected in the effective date and communicated where required.

For general information on Canadian privacy principles, see the Office of the Privacy Commissioner of Canada.