Your data, and the data we hold for others.

1. Who we are and what this policy covers

Payrun, Inc. (“Payrun”, “we”, “us”) provides payroll, tax filing and employee benefits through an API that software platforms embed in their own products. This policy explains how we handle personal information when you visit this website, read our documentation, open a developer account or talk to our team.

It does not describe how we handle the payroll data of employers and employees who use Payrun through a partner’s software. For that data we act as a service provider, as explained in the next section.

2. Two roles: business and service provider

When a software platform (a “Partner”) embeds Payrun, the Partner and its employer customers decide why payroll data is collected. We process it only on their instructions, under a written agreement, to run payroll, file taxes, move funds and administer benefits. Under US state privacy laws such as the California Consumer Privacy Act, we act as their “service provider” or “processor” for that data.

That data can include names, home addresses, dates of birth, Social Security numbers, bank account and routing numbers, wages, hours, tips, tax withholding elections (Form W-4), benefits elections and details of dependents. We do not use it for our own marketing, we do not sell it, and we do not combine it with data from other customers except to provide and secure the service.

If you are paid through software that uses Payrun, your employer is responsible for your payroll data. Please send requests about it to your employer or to the software provider, and we will help them answer.

3. The data we collect as a business

Information you give us. Your name, work email, company, role, the software you build and your message when you book a demo, contact sales or apply to become a partner.

Developer account data. Your name, work email, company, account settings and the sandbox and production keys issued to you, which we store as hashes. The sandbox is built for test data: please never send real Social Security numbers or bank accounts to it.

Usage and device data. Pages visited, referring page, approximate location derived from your IP address, browser, device and language, and API request metadata (time, endpoint, response code, key identifier), collected through server logs and the cookies described in our Cookie Policy.

4. How we use it

We use the information above to reply to your requests and run demos; to create and secure developer accounts and issue API keys; to send service notices such as API changes, deprecations and incident reports; to send product news if you ask for it, which you can stop at any time; to measure and improve this website and our documentation; and to detect abuse, fraud and security incidents.

We use payroll data processed for Partners only to provide the service they contracted for: calculating gross-to-net pay, moving funds, filing tax returns and forms, administering benefits, preventing fraud, and meeting our own legal duties, such as keeping records and answering lawful requests from tax agencies.

5. Who we share it with

We share personal information only with organizations that help us provide the service, under written contracts that limit their use of it: hosting and infrastructure providers, our bank partners for direct deposits and tax payments, federal, state and local tax agencies when we file on an employer’s behalf, benefits carriers and plan administrators chosen by the employer, identity and business verification providers, email delivery, analytics (if you accept analytics cookies) and professional advisors.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We may disclose information when the law requires it, to protect people or our rights, or in a merger or sale of our business, under protections at least as strong as the ones in this policy.

6. How long we keep it

Demo and sales requests are kept for up to 24 months after our last exchange. Developer accounts are kept while they are open and for 12 months after they are closed. Website and API logs are kept for up to 13 months.

Payroll and tax records processed for Partners are kept for as long as the Partner agreement requires and federal and state law demands; for employment tax records, that is generally at least four years. When we no longer need information, we delete it or make it anonymous.

7. How we protect it

Social Security numbers and bank account numbers are encrypted at the field level as soon as they reach us and replaced by tokens in our systems and in API responses, so a Partner never has to store them. All data is encrypted in transit and at rest. Staff access is limited by role, requires multi-factor authentication and is written to an audit log.

No system is free of risk. If a breach affects your personal information, we will notify you, the Partner concerned and the authorities as the applicable law requires.

8. Your rights and choices

Depending on the state you live in, you may have the right to know what personal information we hold about you, to get a copy, to correct it, to delete it, and to opt out of its sale, its sharing or its use for targeted advertising. We do none of those three things, and we treat a Global Privacy Control signal sent by your browser as a valid opt-out request.

To make a request about the data we hold as a business, write to privacy@payrun.example (demo address). We will verify your identity, answer within 45 days and never treat you differently for using your rights. You may act through an authorized agent, and if you disagree with our answer you may appeal by replying to it.

For payroll data we process as a service provider, contact your employer or the software you use. We pass any request we receive about that data to them.

9. Children

This website and our developer accounts are meant for adults acting for a business. We do not knowingly collect personal information from children under 13 through this site.

Some employers pay workers under 18. Their payroll data is handled as described in section 2, on the employer’s instructions.

10. Changes and contact

We may update this policy when our services or the law change. The date at the top of this page shows the latest version, and we will announce significant changes on this page or by email before they take effect.

Questions about this policy can be sent to privacy@payrun.example (demo address) or through our contact page.