Privacy policy
The short version: payroll files you use with our tools are read and processed in your own browser and are never sent to us. We keep only what you choose to give us (an email address) and anonymous usage counts.
Who we are
Certified Payroll Kit ("we", "us") runs certifiedpayrollkit.com from the United Kingdom. For anything about this policy or your data, email [email protected]. We act as data controller for the limited personal data described below, under the UK General Data Protection Regulation and the Data Protection Act 2018.
Payroll files and worker data
When you use the WH-347 generator or the eCPR XML checker, your file is opened by JavaScript running in your browser. Worker names, Social Security numbers, addresses, hours and pay are processed only on your device to build the PDF or check the XML. They are not uploaded to our servers, and we have no access to them. Our automated tests check the site's network requests to make sure none of this data is sent.
Project templates (project details, fringe plans, apprenticeship programs) and your column matches are saved in your browser's storage (IndexedDB) so you can reuse them. They stay on that computer until you clear your browser data or delete them, and you can export them to a settings file yourself.
What we do collect
- Email address, if you give it for weekly reminders or for a "notify me" message. We use it only for that purpose. Lawful basis: your consent. You can unsubscribe at any time by replying to any email or writing to us, and we delete the address.
- Anonymous counts. When a file is built we record the date and the format (for example "wh347"), with no data about you or your workers. This tells us how much the tools are used.
- Server logs and security. The site is hosted by Cloudflare, which processes IP addresses and request details to deliver pages and protect against abuse. See Cloudflare's privacy policy.
- Paid plan customers (when available): name, email and billing details are handled by Stripe, our payment processor; we receive your email, subscription status and the last digits of your card, never the full card number.
Cookies and analytics
We don't use advertising or tracking cookies, and there are no third-party analytics scripts on the tool pages. If we measure page views, we use Cloudflare Web Analytics, which does not set cookies or track individuals across sites.
Sharing and transfers
We don't sell or rent personal data. Our providers (Cloudflare for hosting and storage, Resend for email, Stripe for payments) process data on our behalf. Some are based in the United States; transfers are covered by the UK International Data Transfer Addendum or the UK Extension to the EU–US Data Privacy Framework, as applicable.
How long we keep data
Reminder and notification emails: until you unsubscribe. Anonymous counts: indefinitely. Customer and billing records: as long as you are a customer and then as required for tax and accounting (normally six years in the UK).
Your rights
You can ask to access, correct or delete your personal data, object to or restrict its use, or withdraw consent. Email us and we'll respond within one month. If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.uk.
Changes
If we change this policy we'll update the date above. Material changes affecting customers will be emailed.