Privacy Policy

Our roles

AJAI LLC is the controller or business for account administration, billing, service security, support, and public-site information used for our own purposes. When a customer submits or connects workforce and payroll data and determines why and how it is processed, the customer is the controller or business and AJAI LLC acts as its processor or service provider. Questions about employer-controlled workforce data should ordinarily be directed to that employer. Our Data Processing Addendum describes that processing.

Information we collect

We collect account and business information such as name, business email, company name, billing and subscription status, authentication events, role, tenant membership, authorization status, and MFA status. We record affirmative legal acceptance evidence, including the accepting user and tenant, document versions, acceptance time, assent statement, request identifier, IP address when available, and browser user-agent.

At a customer’s direction, we may process worker names or workforce identifiers; roles, locations, services, and work dates; hours, shifts, bookings, sales, tips, commissions, pools, pay rates, and rule references; earnings, payroll lines, adjustments, and employee totals; exceptions, unresolved questions, decisions, review notes, source provenance, calculation lineage, and audit events. Connected providers may supply these categories. The public AI connector is not designed to request or return government identifiers, bank or routing information, payment-card data, health or benefits information, passwords, MFA codes, provider credentials, or original provider payloads.

Our infrastructure providers process limited device, browser, IP address, request, diagnostic, performance, and security information needed to deliver and protect the service.

If you accept analytics, AJAI also records public pages viewed, return visits, referral sources, general device type, and categories of links clicked in its private CRM. A random browser identifier lasts up to 90 days on this website. It does not identify you across unrelated websites or devices. Visitor events exclude form values, URL queries and fragments, and raw IP addresses. History is limited to 90 days, with older records removed as new visits are processed. Declining or withdrawing analytics stops collection and clears the identifier. Authenticated app activity is excluded.

With your permission, public marketing pages use Google Analytics to measure visits and Microsoft Clarity to understand masked website interactions through heatmaps and session recordings. These tags do not load on the authenticated payroll workspace or admin domain. Form text is masked, query strings are excluded from our GA page URLs, and advertising personalization is disabled. Choose Essential only to decline, or change your choice through Privacy choices. Forms and scheduling work without optional analytics. See Microsoft's privacy statement and Google's privacy policy.

How we use information

• Provide, secure, maintain, bill for, and troubleshoot PayCanvas.
• Authenticate users and enforce tenant, role, OAuth, MFA, and connector permissions.
• Run customer-authorized onboarding, source connection, payroll preparation, calculation, and review workflows.
• Maintain source provenance, legal acceptance, audit history, abuse prevention, and reliability evidence.
• Respond to support, privacy, legal, and security requests and comply with law.
• Understand and improve the public website and product experience.

AI and connector data

When an authorized user connects PayCanvas to ChatGPT, Claude, Codex, or another supported client, that customer directs PayCanvas to disclose the tenant-scoped information requested through enabled tools. Confirmed tools may also start bounded source collection, record an immutable non-payroll review note, apply a PayCanvas-offered factual resolution, copy selected prior-period adjustments, or queue a provisional calculation. Live access checks and, where applicable, an exact preview and explicit confirmation still apply. The connector cannot approve, export, submit, fund, or pay payroll.

The chosen AI client processes disclosed information under its own terms and privacy policy. Its storage, memory, training, and retention behavior depends on that provider and the customer’s account settings. Disconnecting PayCanvas stops future connector access but does not delete information the AI client already received. An optional native PayCanvas agent may use a model provider as our subprocessor only when that feature is enabled; the product will identify that processing before use.

How we disclose information

We may disclose information to hosting, database, authentication, storage, billing, monitoring, communication, and other service providers that help operate PayCanvas; to a customer’s authorized users, connected providers, and selected AI clients; to professional advisers under confidentiality; when required by law or necessary to protect rights and security; or in a merger, financing, acquisition, or sale. Our current infrastructure subprocessors are listed on the Subprocessors page.

We do not sell personal information and do not share personal information for cross-context behavioral advertising. We do not use customer payroll data for unrelated advertising.

Retention schedule

• Account, membership, OAuth, billing, and legal acceptance records: active records remain while needed to provide the service. Grant revocation blocks future connector use immediately. Legal acceptance and related audit evidence are retained for contract, security, and dispute purposes, subject to verified deletion rights and legal obligations.
• Payroll inputs and evidence: payroll inputs, results, adjustments, resolutions, review notes, provenance, calculation versions, and audit evidence currently have no fixed automatic expiration. They remain immutable while retained and are kept until the customer directs verified deletion or the relationship ends, subject to payroll-record duties, legal holds, dispute needs, and contractual instructions.
• Unreferenced provider uploads: provider-response objects that never become referenced payroll or forecast evidence are operational debris and are automatically removed after at least 24 hours. Referenced provider evidence follows the payroll-input schedule above.
• Support communications: messages remain in the business email service until deleted through the ordinary support process or a verified request, subject to legal or dispute needs.
• Security and infrastructure logs: hosted application request and runtime logs are retained for no more than 30 days. Supabase project logs available to PayCanvas are retained for up to seven days on the current plan. We do not copy these logs into a separate long-term analytics store.
• Website analytics: consented public-site measurement is stored by Google Analytics and Microsoft Clarity under their service retention settings. PayCanvas does not copy session recordings into the payroll database.
• Backups: the production database uses rotating daily physical backups with a seven-day recovery window. A deleted database record may remain in a backup for up to seven additional days. Storage objects are not included in those database backups.
• Legal holds and customer instructions: affected records are retained until the instruction or legal obligation ends and then handled under the applicable schedule.

Security

We use administrative, technical, and organizational safeguards designed for the nature of the information, including tenant and role controls, MFA for sensitive workflows, encrypted transport, managed infrastructure, secrets handling, and audit records. No system can guarantee absolute security.

Your choices and privacy rights

Depending on where you live and subject to exceptions, you may request access, correction, deletion, or a copy of personal information, or appeal a denied request. You may also have rights to know categories of information and disclosures, opt out of certain sales or sharing, or limit certain sensitive-information uses. PayCanvas does not sell personal information or share it for cross-context behavioral advertising. We will not discriminate against you for exercising a privacy right.

For customer-controlled workforce data, we may direct the request to the relevant customer or assist that customer. We verify requests before acting. You may control public-site analytics through Privacy choices, browser settings, and supported opt-out signals, and may disconnect an MCP authorization through the applicable client or PayCanvas controls.

Children, changes, and contact

PayCanvas is a business service and is not directed to children. We may update this policy and will post a revised effective date; material changes may also be communicated to account administrators.

Contact hello@paycanvas.io or AJAI LLC, 26897 Spyglass Dr, Orange Beach, AL 36561, for privacy questions, requests, or appeals.