Privacy Policy
Last reviewed: 2026-07-29
Who this policy covers
Numbaroll is a record-keeping tool for household employers. Two kinds of people appear in it: employers (the account holder — you hire a nanny, caregiver, or other household worker) and workers (the people you pay, whose information you or they enter). This policy covers both. Workers can claim their own sign-in via an invite and only ever see their own records — household isolation is enforced on every request at the API layer.
1. What we collect
Data you provide directly:
- Email address and password for your account (passwords are stored hashed, never in plain text)
- Household profile: name, address, and — because Schedule H requires it — your federal EIN
- Worker information needed to run payroll and prepare tax forms: legal name, date of birth, address, Social Security number, W-4 elections, I-9 work-authorization details (including alien registration, I-94, or foreign passport numbers where applicable), and — optionally — bank routing and account numbers for direct-deposit records
- For 1099 contractors: W-9 details including their taxpayer identification number (SSN or EIN)
- Hours logs, pay rates, PTO, pay stubs, and the year-end forms built from them (W-2, 1099-NEC, Schedule H, CPA packet)
Data collected automatically:
- IP address, browser type, and operating system (server logs via hosting infrastructure)
- Pages visited (Plausible Analytics, self-hosted — anonymized, cookieless, no cross-site tracking)
- In-app feedback submissions: message, category, page URL, and browser type (only when you submit feedback voluntarily)
- A log of transactional emails we sent you (for deduplication and delivery troubleshooting)
- Structured error logs — these are built to refuse personal data: SSN, bank numbers, date of birth, and address fields are rejected by the logging layer and never written
Data visible on public pages:
- Pay-stub verification pages (/verify) show only a cryptographic hash and its timestamp proofs — never names, amounts, or identifiers
- Income-verification letters (/letter-verify) are visible to anyone the workershares the unique long link with (e.g. a landlord or lender); they show the worker's pay summary and can be revoked or expired by the worker at any time
Data we do NOT collect:
- Credit card numbers (handled entirely by Stripe)
- Tracking or advertising cookies of any kind
2. How sensitive fields are stored
Social Security numbers, bank routing and account numbers, taxpayer identification numbers, and I-9 document numbers are encrypted with AES-256-GCM before they touch the database — plaintext for these fields is never written to disk and never logged. Nightly database backups therefore carry these fields only in encrypted form.
3. How we use it
We use your data solely to provide the Numbaroll service: keeping your payroll records, computing cited pay math, preparing your year-end forms, sending transactional emails, and understanding how the product is used in aggregate. Numbaroll never moves your money and never files with the IRS or a state agency on your behalf.
4. Who we share it with
We do not sell your personal data. We share data only with the following service providers, each bound by their own privacy commitments:
| Service | Purpose |
|---|---|
| Hetzner | Hosting (Falkenstein, Germany) |
| Cloudflare R2 | Nightly database backups (sensitive fields remain encrypted inside the backup) |
| Stripe | Payment processing (if you subscribe) |
| Amazon Web Services (SES) / Resend | Transactional email delivery |
| Plausible (self-hosted) | Privacy-respecting, cookieless analytics — runs on our own infrastructure |
| Feedy (operator-run) | In-app feedback processing — only what you type into the feedback widget |
| Sectigo / DigiCert / OpenTimestamps | Pay-stub timestamping — these services receive only a cryptographic hash, which reveals no personal or payroll data |
5. Data retention
We retain your data while your account is active. When you request account deletion, there is a 7-day grace window during which you can cancel the request. After that, your access ends — but because the IRS requires household employers to keep payroll records for 4 years, payroll and tax records are retained for 4 years from your request and then permanently deleted, with a final confirmation email to you.
6. Your rights
You have the right to access, correct, export, or delete your data. Workers can view and download their own pay stubs and income-verification letters from their own sign-in at any time. For anything else, email support@numbaroll.com and we will respond within 30 days.
7. Cookies
We use one strictly necessary session cookie to keep you signed in. We use no tracking or advertising cookies; Plausible Analytics is cookieless by default. If this changes, we will update this policy and notify users.
8. Children
Numbaroll accounts are not intended for users under 16. We do not knowingly collect data from children.
9. Changes
We will notify users by email before making material changes to this policy.