Privacy Policy

Checkmate Payroll collects only what is required to run payroll, meet tax obligations and keep your account secure. The complete inventory:

• Personally identifiable information

  Legal name, work email, home address, Social Security Number, date of hire, employment status, filing status and withholding elections. SSNs are encrypted at rest with Fernet AES-128; only the last four digits are ever rendered in any screen, PDF or API response.
• Financial and bank data

  ACH routing number, account number, account type, and the tokenized references returned by our payment processors. Account numbers are encrypted at rest with the same AES-128 scheme as SSNs. We never store a full card number, CVC, or expiry — card data is captured inside Stripe's own iframe and reaches us only as a payment-method token.
• Location and device data

  Clock-in GPS coordinates, captured only at the moment you tap Clock In, used solely for geofence validation. Portal-login IP address and coarse city/country, captured only when your employer has enabled Remote Work Tracking and you have accepted that specific disclosure.

Checkmate is not a bank and does not hold your money. Movement of funds is performed by two regulated processors, and each receives the minimum data required to complete the instruction:

• Stripe, Inc. — payment processing, Stripe Connect payouts and instant payouts. Stripe receives payout amounts, the destination account or payment-method token, and the payroll reference. Business debit cards are entered directly into Stripe Elements: the card number never touches Checkmate's servers, logs or database, and we retain only Stripe's pm_… token plus the brand and last four digits. Stripe processes this data as an independent controller under its own privacy policy and PCI-DSS Level 1 attestation.
• Plaid Inc. — bank-account verification and ACH pre-funding. When you choose to link a bank account, Plaid authenticates you directly with your financial institution; Checkmate never sees or stores your online banking username or password. Plaid returns an item identifier, an access token and the verified routing and account numbers. The access token is encrypted at rest and is never returned to any browser or API client.

You may decline both. Businesses can fund payroll by check or manual ACH, and employees can receive a physical check instead of a direct deposit, at the cost of the speed those processors provide.

• Twilio — phone number, for SMS alerts you have opted into.
• Resend — email address, to deliver pay-stub and workflow notifications.
• Mapbox — worksite latitude and longitude for geocoding; no personal identifiers.
• ipapi.co — public IP address only, and only under Remote Work Tracking.
• AI providers — anonymized aggregate signals for the Office Manager, Billing Concierge and Buddy chat. AI models are never given SSNs, bank details or full addresses.

Payroll records are retained for seven years to satisfy IRS, FLSA and state requirements, then flagged for reviewed deletion. The full schedule, including what is anonymized versus purged, is published in our Data Retention Policy.

• Access and portability — Settings → Right to be Forgotten → Download My Data returns a machine-readable dump of every record we hold about you.
• Deletion — Delete My Account removes your login and employee profile. Payroll history your employer is legally required to keep is anonymized so it no longer identifies you.
• Correction — ask your payroll administrator, or email us directly, to fix inaccurate data.
• Opt-out of sale — not applicable: there is no sale to opt out of (see section 4).

Rights under GDPR Art. 15–17 and CCPA §1798.100–.125 are honoured for all users regardless of residence. Requests are completed within 30 days.

Privacy questions and data-subject requests: privacy@checkmatepayrolls.com. Security disclosures: legal@checkmatepayrolls.com.