Privacy notice
Draft for review: these terms are not yet final.
Version 2026-10-26, updated 26 October 2026.
Terms of service · Privacy notice · Data processing agreement · Sub-processors · Cookies
1. Who we are
[company legal name], [company number], [registered office address] is the controller of the personal data described here: about the people who use PWS accounts and the PWS website. Contact us about privacy at [contact email]. ICO registration: [ICO registration number].
The payroll data in the PWS Payroll app (about your employees) is yours: you are its controller. It stays on your computer; where we handle it for you (the cloud vault, AI explanations through PWS, support bundles) we act as your processor under the data processing agreement, not under this notice.
2. What we collect and why
| Information | Why | Lawful basis |
|---|---|---|
| Account: name, business name, email address, how you sign in (password, Google, Microsoft, Apple), whether two-step sign-in is on, sign-in times. Passwords are held by our sign-in provider as one-way hashes, never by PWS. | To provide your account and keep it secure. | Contract; legitimate interests (security). |
| Billing: Stripe customer reference, card brand and last four digits, invoices and payments. Full card numbers are given to Stripe only. | To bill you and keep accounting records. | Contract; legal obligation (tax records). |
| Usage: for each month, anonymous references for your businesses (a one-way code made by the app, never the name), how many employees each paid, numbers of AI explanations and calculation-API requests. | To bill you, apply your free allowances, and run the service. | Contract; legitimate interests (running and improving the service using totals). |
| Computers you sign in: the computer's name, when it was linked and last used (its key is stored only as a hash). | To let the app use your account, and let you sign computers out. | Contract; legitimate interests (security). |
| Technical: network (IP) addresses and requests in our server logs; security events; the audit log of account changes. | Security, preventing abuse, fixing faults. | Legitimate interests. |
| Support: messages you send us, and support bundles (a health report of the app, with no employee details) if you send one. | To help you. | Legitimate interests; contract. |
| Consents and acceptances: which version of these documents you accepted and when; your cloud-vault consent. | To show what you agreed to. | Legal obligation; legitimate interests. |
We do not sell personal data, use it for advertising, or make decisions about you by automated means that have legal or similarly significant effects. We send emails about your account and billing only; no marketing without your separate agreement.
3. Who we share it with
Our sub-processors, under contracts that protect it: see sub-processors. If you sign in with Google, Microsoft or Apple, that company handles your sign-in under its own privacy notice. We may share information where the law requires it, or to protect our rights or others' safety.
4. International transfers
Our servers are in the European Union, which the UK recognises as giving adequate protection. Some sub-processors (Supabase, Stripe, Anthropic, Cloudflare) may handle data in the USA or elsewhere; those transfers are protected by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or by the UK–US data bridge where the recipient is certified.
5. How long we keep it
- Account details: while your account is open, and deleted within 30 days after it closes.
- Invoices, payments and the usage behind them: 6 years after the end of the financial year they relate to (tax law).
- Server logs with network addresses: 14 days. Service logs: overwritten as they fill (a few weeks at most).
- Audit log of account and security events: 6 years.
- Cloud vault: until you delete it or close your account (the newest 10 encrypted copies).
- Database backups: 30 days, after which deleted data is gone from them too.
6. Security
Encryption in transit (HTTPS with HSTS); cloud-vault data encrypted end to end; separate, least-privilege database access for each part of the service; two-step sign-in for you and mandatory for our staff; no scripts on our web pages; rate limits and lock-outs; audit logs; daily backups. See also the security measures in the data processing agreement.
7. Your rights
Under the UK GDPR (and the EU GDPR where it applies) you can ask for a copy of your personal data, have it corrected or deleted, restrict or object to its use, and receive it in a portable form. Where we rely on consent you can withdraw it at any time. Contact [contact email]; we reply within one month. You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113) or, in the EU, your local data protection authority; we would like the chance to help first.
8. Cookies
We use only the cookies the website needs: see cookies.
9. Changes
We will post changes here and tell account holders of significant ones.