Privacy Policy

Last updated September 5, 2026

Hoshipay runs payroll, which means handling some of the most sensitive information a business holds about the people who work for it. This policy explains what we collect, why, who we share it with, how long we keep it and what your choices are. It is written to be read, and if anything in it is unclear, ask us at support@hoshipay.com.

Who this covers

This policy applies to hoshipay.com and to the Hoshipay platform: the employer portal, the accounting-firm workspace, the employee portal and the time clock. It covers three kinds of people. Customers are the businesses and accounting firms that hold an account. Workers are the employees and contractors those businesses pay; their information is entered by their employer, and we process it on the employer’s behalf. Visitors are people browsing the website without signing in.

What we collect

From customers: the name, email address and password of each person who signs in; the legal name, address, EIN and state tax account numbers of each company; the business bank account used to fund payroll; agency credentials the company gives us so we can file and pay on its behalf; and billing details for the plan (card payments are taken by our billing provider, and we never see the full card number).

About workers, as entered by the employer: name, home address, date of birth, Social Security number or taxpayer ID, pay rates, hours, earnings, deductions, benefits, garnishments, tax withholding elections, and the bank account wages are paid to. If a worker uses the time clock, we record the clock-in and clock-out times.

Automatically, when anyone uses the Service: the IP address, browser type, pages visited and the time of each request; and a record of every sign-in, failed sign-in, password change and significant payroll action, kept as an audit log. We use only the cookies needed to keep you signed in and to protect the site against fraud. There are no advertising cookies and no third-party analytics or tracking scripts on the Service.

Why we use it

To calculate and run payroll; to prepare, file and pay payroll taxes and wage reports; to pay workers and contractors; to produce pay stubs, W-2s, 1099s and other records; to bill for the Service; to keep accounts secure and detect misuse; to answer support requests; to send the operational emails the Service depends on, such as payroll approvals, filing confirmations and password resets; and to meet our legal obligations. We do not use personal information for advertising and we do not sell it.

Hoshi AI

Hoshi AI answers questions about payroll a company has already run. To do that it sends summaries of that payroll to a third-party AI model provider. Those summaries include worker names, pay dates and pay amounts. They do not include Social Security numbers, bank details, home addresses or dates of birth. We do not allow your information to be used to train the provider’s general-purpose models.

Who we share it with

We share personal information only with the service providers we need to deliver the Service, each of which is allowed to use it only for that purpose, and with the government agencies payroll requires. Specifically:

Tax agencies — the IRS, state revenue and workforce agencies and local tax authorities receive the returns, wage reports and payments the employer instructs us to make, which necessarily include worker names, Social Security numbers and wages. E-filing provider — we transmit federal and state returns through TaxBandits, which receives the same filing information and stores the resulting filing documents. Banking and payment partners — moving wages and tax payments through the ACH network requires giving our banking and payment partners the names and bank account details of the employer and of the people being paid. Billing — Stripe processes plan payments and receives the company name, billing email and the worker count the plan is priced on. Email — Resend delivers the emails the Service sends and therefore sees recipient addresses and message contents. Accounting software — if a company connects QuickBooks Online, we post payroll journal entries to Intuit at that company’s request. AI model provider — for Hoshi AI, as described above. Hosting — the Service and its database run on cloud infrastructure providers in the United States.

We may also disclose information when the law requires it, to respond to a valid legal request, to protect the rights and safety of Hoshipay, our customers or others, or as part of a merger, sale or reorganisation of our business, in which case this policy continues to apply to the information transferred.

How we protect it

Social Security numbers, taxpayer IDs, bank routing and account numbers, and agency credentials are encrypted in our database with AES-256 before they are stored, and decrypted only at the moment they are needed to run payroll or file a return. Passwords are stored as salted bcrypt hashes and must be at least twelve characters. Accounting firm users and platform administrators are required to use two-factor authentication. Every request to the Service is checked against the signed-in user’s permissions, repeated failed sign-ins lock the account, and sign-in and payroll activity is written to an audit log that records who did what, from where, and when. All traffic to the Service is encrypted in transit. No system is perfectly secure; if we learn of a breach affecting your information we will tell you and the relevant authorities as the law requires.

How long we keep it

Payroll is a regulated record. Federal law requires employment tax records to be kept for at least four years after the tax is due or paid, and some states require longer. We keep company and worker payroll records for as long as the company’s account is active and afterwards for the period the law requires, then delete or de-identify them. Audit logs are kept for the same period. Account information for people who sign in is kept while the account exists. Marketing-site visit data that is not tied to an account is kept only briefly for security purposes.

Your choices

If you hold an account, you can review and update your own details, your company’s details and your workers’ details in the Service, and you can close your account by contacting us. If you are a worker, your employer controls the information it holds about you, so start there: your employer can correct your details in the Service, and you can see your own pay stubs and tax forms in the employee portal. You can also write to us at support@hoshipay.com to ask what information we hold about you, to ask for a copy, or to ask us to correct or delete it. We will answer within thirty days. Where the law requires us to keep a record, we will tell you that and keep only what is required.

We do not sell or share personal information for advertising, so there is nothing to opt out of on that front. You can unsubscribe from any non-essential email using the link in it; emails the Service needs to send, such as payroll approvals and password resets, cannot be turned off while the account is open.

Children

The Service is for businesses and the adults who work for them. We do not knowingly collect information from anyone under 16 except as a worker record entered by their employer where the law permits that employment.

Where your data lives

Hoshipay is a United States business serving United States employers, and personal information is stored and processed in the United States.

Changes to this policy

We may update this policy as the Service changes. We will change the date at the top, and for material changes we will notify account holders by email or in the Service before they take effect.

Contact

Hoshipay, LLC, 16341 Mueschke Rd #105, Cypress, TX 77433 · support@hoshipay.com. See also our Terms of Use.