Privacy Policy

1.Who is responsible for your information

AllYearOS is software that businesses use to run their operations, books and payroll. When a business (our “Customer”) puts information about its employees or its own customers into AllYearOS, that business decides what’s collected and why, and we handle it on their behalf and only on their instructions. We’re directly responsible for the information needed to run your login and our own relationship with the Customer.

2.What we collect

• Account information: your name, email address and password. Passwords are stored only in hashed form; nobody at AllYearOS can see them.
• Business records the Customer enters: for example customer names, addresses, phone numbers and notes; invoices and payments; the books; and employee records such as contact details, pay rates, hours, tax withholding choices and, for payroll, Social Security and bank account numbers.
• Security and activity records: sign-ins, the device and IP address used, and a permanent log of who changed what and when inside the account.
• Location, only if the employer turns it on: the location at the moment an employee clocks in or out, to confirm they’re at the job. Never while off the clock.

3.How we use it

• to provide the Service: show, calculate, store and back up the Customer’s records;
• to keep accounts secure and investigate misuse;
• to give support when the Customer or you ask for it;
• to meet legal obligations.

That’s the whole list. We never:

• sell or rent personal information, or share it for advertising;
• build profiles about you for anyone else;
• include a business’s records in industry comparisons unless that business turns it on, and even then only as combined, anonymous totals that can’t identify anyone;
• use personal information to train AI models.

4.Who can see it

• Inside a business: only the people that business has given a role that allows it. Sensitive payroll details such as Social Security and bank account numbers are limited to payroll roles.
• Our service providers, who run the infrastructure under contracts that require them to protect the data and use it only for us: Supabase (database, sign-in and file storage) and Vercel (website hosting), both in the United States. We’ll update this list before adding a new provider that stores personal information.
• The authorities, only when the law requires it. We tell the Customer first unless the law forbids it.

5.Cookies

We use only the cookies needed to keep you signed in and secure. No advertising cookies, no cross-site tracking, no third-party analytics.

6.How long we keep it

We keep a Customer’s records while their account is open. After they cancel, the records stay available to them for 90 days to export, then we delete them within 30 days, and backups age out within 30 days after that. Records the law requires us to keep for ourselves (such as billing records) are kept only as long as required.

7.Your choices and rights

• You can see and update your own profile in the app at any time.
• If you work for (or are a customer of) a business that uses AllYearOS, ask that business to see, correct, export or delete your information. They control those records, and we’ll help them respond.
• You can also email us at legal@allyearos.com. We’ll respond within 45 days, including under the Connecticut Data Privacy Act and similar state laws where they apply.
• We won’t treat you differently for using any of these rights.

8.Security

Data is encrypted in transit and at rest. Each business’s records are walled off from every other business by the database itself, access is limited by role, and changes are recorded in a permanent activity log. If a security incident exposes personal information, we’ll notify the affected Customers within 72 hours of confirming it and help them notify the people involved as the law requires.

9.Children

AllYearOS is for businesses and their teams. It isn’t meant for anyone under 16.

10.Changes to this policy

We’ll post changes here with a new version date. For material changes we’ll give 30 days’ notice and ask you to review the new version in the app.