Privacy policy

Account agreement records

When you select the agreement checkbox, we save your account identifier, the acceptance time, the exact checkbox wording, and the versions of the Terms of Service and Privacy Policy you reviewed. Supabase stores these records and an archived copy of each version. You can view your acceptance history in Settings. Acceptance does not enable optional marketing, analytics, or AI processing.

Agreement records are separate from workspace files and can remain after workspace or account closure where needed to establish the applicable agreement, resolve disputes, or meet legal recordkeeping obligations. Contact support for access or deletion requests; we review whether continued retention is necessary. We do not add your raw IP address or browser fingerprint to this acceptance record.

Information we process

We process account identifiers, email addresses, workspace memberships, facility details, uploaded staffing files, employee identifiers, hours, role classifications, review notes, and submission evidence. We also retain filing revisions, access history, billing references, and support messages to provide and operate the service.

Original spreadsheets may contain more information than a PBJ filing needs. Remove unrelated data before uploading. This workspace is for staffing reporting; do not upload patient records, Social Security numbers, bank details, or passwords.

Sign-in, storage, and payments

Clerk handles sign-in and sessions. If you choose Google sign-in, EasyPBJ requests basic identity information: your profile and email address. It does not request access to your Gmail, Drive, or contacts.

Your optional account profile can include a display name, job role, and whether you work with one facility, multiple facilities, or client facilities. Supabase stores these details and when you reviewed them. They personalize setup, do not grant workspace access, and are not included in filing XML. Edit them in Settings; account deletion removes this profile.

Supabase stores shared filings and private files. Vercel hosts the app, and Cloudflare provides domain DNS. Workspace membership determines which staff can access your filings. Administrators and infrastructure providers may process information needed to operate, secure, and support the service.

Stripe processes payments and subscription management. EasyPBJ stores billing references and subscription status; card details are entered on Stripe-hosted pages. For invoice orders, we retain the customer’s legal name, billing address, AP email, PO reference, signer’s name and title, verified account email, acceptance time, and the exact agreement accepted. These billing and agreement records can remain after workspace closure for accounting and legal recordkeeping.

Account email and communication choices

We save your primary sign-in email, verification status, and account identifier so we can contact you about your account, security, billing, and services you request. This also applies when you sign up with Google. Optional PBJ reminders and EasyPBJ product news, tips, and offers are separate choices; creating an account does not opt you into them.

Supabase stores your contact information, communication preferences, and when and how you recorded your choices. You can change optional email preferences in Settings and update your primary email through your sign-in account. Contact support for access, correction, or deletion of your account contact information. We retain suppression information where needed to honor unsubscribe and delivery restrictions.

Customer support

Get help saves your selected category, workflow stage, short description, optional diagnostic reference, account identifier, and any workspace or filing reference you choose to include. Supabase stores requests, human-written replies, status changes, and timestamps. Only you and explicitly designated EasyPBJ support operators can read your conversation. Support access does not grant access to your payroll. Do not include payroll records, employee information, passwords, or attachments.

Replies appear in My support requests. We target a first response within one business day, Monday–Friday Eastern Time; resolution may take longer. Resolved conversations are removed from active storage after 180 days during scheduled maintenance. Account deletion removes your support conversations and operational designation. Necessary billing, agreement, and refund records may be retained separately for accounting and legal recordkeeping. Private feedback for your workspace team remains separate.

Optional PBJ email reminders

When you request reminders through the public reminder form, we send a confirmation link; preparation and deadline reminders start only after you confirm. When you opt in during account setup or in Settings, your verified sign-in email supplies that confirmation. Supabase stores your subscription, consent, and delivery status. Resend processes your address and message contents to deliver these emails. Reminder emails do not contain your payroll files or employee records; open and click tracking are disabled for the reminder sending domain.

You can unsubscribe using the link in any reminder. We retain a suppression record to honor that choice. Unconfirmed requests are removed after seven days, and completed delivery records are retained for up to 90 days for troubleshooting. Unsubscribed and suppressed addresses remain on a suppression list until an authorized deletion request. Provider logs and backups follow their separate retention policies. Contact support to request deletion of your reminder information.

CMS result records

Your facility’s authorized submitter uploads the prepared file in iQIES. You may save CMS receipts and validation reports with the filing in EasyPBJ. We do not store HARP passwords, MFA secrets, or account recovery codes.

Past authorized submission requests, attempts, receipts, original reports, access history, and service updates remain in the private workspace where needed to resolve that earlier work. Service updates use the requester’s verified sign-in email and contain no payroll data or CMS report attachments. They are separate from optional deadline reminders.

Optional AI assistance

Reports combine public CMS facility ratings and measures with aggregate patterns from your saved staffing filings. Public CMS snapshots are cached separately from private workspace records. Opening a report, downloading it, or adjusting a scenario does not send data to AI.

Using the filing assistant sends your question, recent conversation, source file names, aggregate totals, and review status directly to OpenAI. Employee-level rows and evidence notes are not automatically included in chat. Do not put credentials, Social Security numbers, or resident information in questions. Conversations are retained with the filing and are available to permitted workspace members until authorized deletion.

Choosing an AI reporting explanation sends your question, relevant reporting conversation, public CMS metrics, aggregate staffing facts, and scenario assumptions directly to OpenAI after your consent. It does not automatically include employee identifiers, individual payroll rows, source workbooks, or evidence notes. Reporting conversations are retained with the selected filing under the same access and deletion controls as filing conversations.

Manual mapping is available. Choosing AI interpretation sends the selected file’s parsed contents, including personal information in its cells, from EasyPBJ’s server directly to OpenAI. You confirm this before sending. The AI proposes mappings and questions; your team confirms the interpretation before records are committed.

EasyPBJ requests that OpenAI response storage be disabled. This does not eliminate all provider retention. OpenAI’s default abuse-monitoring retention is up to 30 days, with possible longer retention for legal or safety reasons. Prompt caching may retain encrypted representations for up to 24 hours. These are provider defaults, not a zero-retention promise. See OpenAI’s data controls.

Cookies, device drafts, and diagnostics

When enabled, Sentry receives minimized application-error diagnostics: release identifiers, broad page categories, and sanitized application stack locations. We exclude payroll contents, uploaded filenames, account identities, raw error messages, request bodies, and sign-in information. Session replay and behavioral tracing are disabled. Network providers still process connection metadata needed to deliver requests. Better Stack checks public page availability and coarse authenticated service health; its checks do not read customer filings. Diagnostic reporting is separate from optional product analytics.

Sign-in uses cookies and session information. The app also saves drafts in your browser for recovery. Signing out does not replace clearing browser storage on a shared device. Downloaded files remain on your device until you remove them.

Application diagnostics exclude payroll contents and record bounded error categories and provider status codes. Hosting and authentication providers may retain technical request and security logs under their own policies.

Workspace feedback stores a selected issue category, workflow step, account identifier, reference number, review state and time. Coarse completion and failure signals help your workspace team identify difficult steps. These entries contain no payroll values, filenames, page addresses, free text or session recordings. Owners and reviewers can read their workspace’s entries; other members can read their own. We keep up to 500 entries per workspace and remove older entries as new ones arrive. Workspace deletion removes this history. The sample sends no workspace feedback or filing workflow signals. Optional sample-opening analytics is described below. Customer support requests and human-written replies are saved separately as described above.

Optional site analytics

Choose Allow analytics to let EasyPBJ connect visits to signup and purchases using a random first-party cookie for 30 days. Decline leaves all product features available. Analytics preferences in the footer lets you withdraw; withdrawal stops collection and removes the account-attribution link. This choice is separate from email consent.

Optional events include public page visits, deadline-picker use, calendar-download clicks, sample opening, signup-link clicks, and real-workspace milestones for completed setup, confirmed imports, and reaching payroll review. Sample activity is excluded from these onboarding milestones. We use approved page names and coarse traffic sources. We do not record payroll, employee IDs, facility CCNs, email addresses, file names, form contents, full page addresses, raw IP addresses, or screen recordings in these events.

Verified account, facility, checkout, and positive-payment counts come from server operations. Without analytics consent, those operational counts remain unattributed to browsing. Raw growth events are kept for 90 days before becoming anonymous daily totals. Minimal hashed event/payment receipts and facility counters prevent duplicate counts and distinguish first purchases from expansion and renewals. Account deletion removes account links and facility counters. Providers may separately retain request and security logs under their own policies.

Facility-quarter export usage

To enforce the shared free export allowance, we record a facility identifier, CMS fiscal year and quarter, salted employee ID fingerprints, and random identity-group identifiers. This auxiliary usage ledger stores no employee names, payroll hours, or source file contents. Confirmed employee ID links can associate fingerprints for the same person. Authorized website export operations update this private ledger; chat guidance does not send records to it.

The ledger is separate from filing and workspace records and can remain after they are deleted to prevent restarting the allowance for the same facility quarter. It is used for export access, including paid exports, and is not a public employee register. Contact support about privacy, access or deletion requests; we verify authority and review the operational need for retained usage information.

Retention and your choices

Shared originals and filing history remain until an authorized owner requests deletion. Owners can delete filings and workspace data in Settings. Interrupted file cleanup can be retried there. Export needed records and follow your facility’s retention requirements before deleting.

Deletion from the active workspace does not instantly remove separately retained recovery backups, billing records, provider logs, or files already downloaded by authorized users. Contact support for account closure, correction, access, and backup-deletion requests. We verify your authority before acting; legal retention obligations may limit deletion.

Your facility manages its employee data and team permissions. Employees seeking changes to a staffing record should contact their facility administrator; support can help with requests affecting EasyPBJ’s own account records.

Contact

EasyPBJ is operated by Joshua King, operating as King & Co. Consulting. Contact support@easypbj.app for account, billing, privacy, or support requests. Please do not email payroll files or credentials.