1. Introduction

StubSign Inc. ("we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use StubSign ("Service"), a payroll documentation platform for small businesses.

The Service is currently in beta. Our data practices may evolve as the platform matures.

2. Information We Collect

Information You Provide

• Account Information: Your name, email address, and password used to create and maintain your account
• Company Information: Business name, Employer Identification Number (EIN), state of registration, and business address
• Worker Information: Worker names, last four digits of SSN/ITIN, pay rates, job titles, department information, filing status, addresses, and direct deposit display data (bank name and account last four digits)

Information We Do NOT Collect

• Full Social Security Numbers or ITINs. We never collect, store, or retain full SSN or ITIN numbers. Only the last four digits are stored for pay stub display. When verification is performed, full numbers are transmitted directly to IRS-authorized systems and are not persisted in our databases.

Information Collected Automatically

• Browser type and version, device information, and screen resolution
• IP address and approximate geographic location
• Pages visited, features used, and interaction patterns
• Session duration and navigation paths
• Performance metrics such as page load times and error rates

We use analytics and performance monitoring tools to understand how users interact with the Service, identify issues, and improve the user experience. These tools collect aggregated behavioral data and may use cookies or similar tracking technologies.

3. How We Use Your Information

We use your information to:

• Provide, operate, and maintain the Service
• Generate pay stub documentation based on data you provide
• Facilitate IRS TIN/EIN matching and Secretary of State business verification at your direction
• Authenticate your identity and secure your account
• Send administrative communications (service updates, security alerts, policy changes)
• Monitor and improve the performance, reliability, and usability of the Service
• Detect and prevent fraud, abuse, or unauthorized access
• Comply with legal obligations

4. Data Storage and Security

Your data is stored on secure, managed cloud infrastructure with the following protections:

• Encryption in transit (TLS 1.2 or higher) for all communications
• Encryption at rest for stored data
• Database-Level Access Controls ensuring users can only access their own data
• Role-based access controls limiting internal access to data
• Minimal data collection - we only collect and retain what is necessary to provide the Service

Despite these measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

5. Data Sharing

We do not sell, rent, or trade your personal information. We may share data with:

• IRS-authorized verification systems: For TIN/EIN matching - performed only at your explicit direction
• Government databases: For Secretary of State business verification - performed only at your direction
• Infrastructure providers: Cloud hosting, database management, and authentication services that help us operate the Service
• Payment processors: If and when paid features are offered
• Legal requirements: When required by law, court order, subpoena, or government regulation

6. Cookies and Tracking

We use essential cookies for authentication, session management, and security. We also use analytics tools that may place cookies to collect aggregated usage data. See our Cookie Policy for details.

7. Your Rights

You may:

• Access your personal data stored in your account at any time
• Correct inaccurate data by editing your profile and worker records
• Delete your account by contacting support - we will remove your data within 30 days
• Export your pay stub records as PDF files
• Opt out of non-essential communications by contacting us

To exercise any of these rights, contact privacy@stubsign.com.

8. Data Retention

• Active accounts: Data is retained for as long as your account remains active
• Deleted accounts: Personal data is removed within 30 days of account deletion, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention)
• Verification logs: Records of IRS verification requests are retained for audit and compliance purposes

9. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy as the Service evolves. Material changes will be communicated via email or in-app notification. Continued use of the Service after changes constitutes acceptance.

11. Contact

For privacy questions or data requests, contact privacy@stubsign.com.

For general support, contact support@stubsign.com.