Privacy Policy

We use the information described above to:

• Provide the core product: aggregate account balances and transactions, forecast your household cashflow, and calculate how much you can safely pay toward bills or credit cards.
• Detect recurring income and bills and suggest them to you for confirmation.
• Send you account and product communications you have asked for, including overdraft-risk alerts and bill reminders.
• Keep Payroom secure: authenticate you, prevent fraud and abuse, and investigate suspicious activity.
• Diagnose and fix bugs, measure performance, and improve features.
• Comply with our legal obligations.

We do not sell your personal information, and we do not use your financial data to serve advertising.

Payroom shares your information only with service providers acting on our behalf (sometimes called “subprocessors”), with you, and where required by law. Our current subprocessors are:

• Plaid — secure connection to your financial institutions and transaction retrieval.
• Supabase — managed PostgreSQL storage and authentication. Your data is stored encrypted at rest.
• Render — hosting for the Payroom API.
• Vercel — hosting for the Payroom web application.
• Sentry — error tracking and diagnostics.
• Resend — transactional email delivery (alerts, account notifications).

Each subprocessor is contractually bound to use your data only to provide services to Payroom and to protect it with appropriate technical and organizational safeguards. All of these providers are based in the United States; see the Cross-border data transfers section below for what that means for Canadian users.

We may disclose information when required by law, subpoena, court order, or other valid legal process — including orders issued in Canada or the United States — or when we reasonably believe disclosure is necessary to protect the rights, property, or safety of Payroom, our users, or the public.

We keep your information only as long as we need it to provide Payroom to you, to meet legal obligations, or to resolve disputes.

• Active accounts. Account, transaction, and forecasting data is retained while your account is active so that forecasts remain accurate and trend history is available to you.
• Inactive-account deletion.If your account has had no sign-in activity for 24 months we will email you a warning at your registered address with a 30-day notice before permanent deletion. You can cancel the deletion at any time during that 30-day window by signing in to Payroom or clicking “Keep my account” in the warning email. If we do not hear from you within 30 days of the warning, your account is soft-deleted and enters the same 30-day grace window as a self-service deletion; after that grace window your transactional data is permanently purged.
• Account deletion from Payroom. When you delete your account from the Accounts page in Payroom, we immediately revoke the connection to Plaid for all of your linked institutions and destroy any encrypted Plaid access tokens we hold for you, then soft-delete your account for a 30-day grace window during which you can contact support to restore it; after the grace window we permanently purge your transactional data.
• Account deletion by email. You can also request deletion at any time by emailing security@payroom.app. We acknowledge email deletion requests within 7 days; at that point we revoke the Plaid connection, destroy encrypted access tokens, and start the same 30-day soft-delete grace window as the self-service flow. Because the 30-day grace window is measured from the soft-delete (not from email receipt) and the hard-purge runs once a night, the worst-case time from email receipt to full deletion is up to 38 days: up to 7 days of acknowledgement, 30 days of grace, and up to 24 hours waiting for the next nightly purge run.
• Deletion audit record. When a deletion completes we keep a minimal audit record (a one-way SHA-256 hash of the user identifier, the deletion timestamp, and the number of linked institutions revoked) for up to seven years so that we can demonstrate compliance with applicable law if asked. No financial data, email address, or other personal information is retained in this record. The hash is deterministic so we can verify, on request, that a deletion occurred for a specific account when provided with the original identifier — but the record on its own cannot be used to reconstruct who you are.
• Database backups. Your data may persist in encrypted backups for a short period after deletion while those backups expire on a rolling schedule (currently up to 30 days). During that window the data is not restored into production and is not accessible through Payroom.

Depending on where you live, Canadian privacy law (PIPEDA, plus Ontario law) and US state privacy laws give you some or all of the following rights in relation to the personal information we hold about you:

• Access. Ask for a copy of the personal information we hold about you and information about how we use it.
• Correction. Ask us to correct information that is inaccurate or incomplete. Most profile data (account nicknames, income, bills, account policies) you can correct yourself from inside Payroom; for anything else, contact us.
• Deletion. Delete your account yourself from the Accounts page, or email us to request deletion. See the retention section above for the full deletion flow, including the 30-day grace window during which you can contact support to restore the account.
• Withdrawal of consent. Withdraw consent to our continued collection, use, or disclosure of your personal information. Depending on the scope of your withdrawal this may mean we can no longer provide Payroom to you.
• Disconnect an institution. Disconnect a specific linked institution yourself from the Accounts page — this immediately stops Payroom from fetching new transactions from that institution and destroys the associated Plaid access token. You can also email us; we will process email disconnect requests within the same 7-day acknowledgement window that applies to deletions, at which point the token is destroyed and sync stops.

To exercise any of these rights, email security@payroom.app. We will respond to verified requests within 30 days; if you are a US resident exercising rights under a state privacy law, see section 9 below for the statutory response window that applies.

Verifying your identity. To protect your privacy we may need to verify your identity before acting on a request — typically by confirming it from the email address on file. For sensitive requests (such as deletion or a full data export) we may ask for additional information to match against our records. We will not act on requests we cannot reasonably verify and will tell you why.

Your consent record. We keep a dated, per-event record of each time you accept our Terms of Service and Privacy Policy — at signup, when you authorize a new bank connection, and whenever you accept an updated version of either policy. You can request a copy of your consent history from us at any time using the email above.

If you are in Canada and believe we have not handled your personal information in accordance with PIPEDA, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada.

We use a layered approach to protect your information in transit and at rest:

• All traffic between your browser or device and Payroom is encrypted using TLS 1.2 or higher.
• Data is stored in a managed PostgreSQL database that is encrypted at rest with AES-256.
• Plaid access tokens are additionally encrypted at the application layer using AES-256-GCM before being written to the database.
• Administrative access to production systems requires multi-factor authentication. The number of people with access is kept to the minimum necessary.
• End-user accounts require multi-factor authentication (TOTP, via an authenticator app) at signup and at every sign-in, before any financial data is fetched or any institution is linked via Plaid.
• We monitor our dependencies for known vulnerabilities and patch on a defined schedule.

No security program is perfect. If you believe your account has been compromised or you have discovered a vulnerability, please contact us at security@payroom.app. Our machine-readable security contact is also published at /.well-known/security.txt (per RFC 9116) for researchers using automated disclosure tools.

Payroom is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

Payroom is operated from Canada but the service providers we use to store data, host the application, send email, and track errors are based in the United States. By using Payroom you acknowledge that your personal information will be transferred to, stored in, and processed in the United States, and that while it is in the United States it is subject to US law — including lawful access by US courts, regulators, and law-enforcement authorities.

We require each of our US-based providers to protect your information with safeguards comparable to those required under Canadian law, and we use only established providers with published security and privacy programs.

Payroom is designed to comply with:

• The federal Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada.
• Applicable provincial privacy laws in the Canadian provinces we serve, including Ontario common law and relevant sector legislation.
• US state privacy laws where applicable, including the California Consumer Privacy Actas amended by the California Privacy Rights Act (“CCPA/CPRA”), and equivalent laws in Virginia, Colorado, Connecticut, Utah, and Texas.

We may update this policy from time to time. If we make material changes we will notify you by email or through an in-app prompt before the changes take effect, and we will ask you to re-accept the updated policy if required. The “Last updated” date at the top of this page always reflects the current version.

Payroom’s Privacy Officer is accountable for our compliance with this policy and with applicable Canadian privacy law.

• Privacy Officer: Mark Tawfik, Privacy Officer
• Email: security@payroom.app
• Mailing address: 462 William Dunn Cres, Newmarket, ON, Canada, L3X 3L2

For any privacy question, request, or complaint, reach us using the email above. We will acknowledge your message promptly and respond within 30 days.