PrevailComply (“PrevailComply,” “we,” “us”), helps small contractors generate and file certified payroll reports for government-funded construction projects. This policy explains what information we collect, how we use and protect it, how long we keep it, and the rights you have over it. It applies to the PrevailComply website and web application. You can reach us at contact@prevailcomply.com.
Information we collect
You provide the following information when you use PrevailComply:
- Account & identity. Your name and email address, managed through our authentication provider, plus the state you work in and how you currently file certified payroll.
- Company profile. Your legal business name, DBA, business address, Federal Employer Identification Number (FEIN), contractor license type and number, public works registration number, and the name and title of your certifying signer.
- Project & payroll data. Project names, awarding agencies, contract numbers, locations, wage determinations, weekly hours, deductions, and fringe benefit amounts.
- Worker information. For each worker on a project — which may include your employees and, in some cases, you (for example, an owner who performs work on the job): name, trade classification, W-4 filing status, apprentice status, and Social Security number. For most of the app we store and display only the last four digits of a worker’s SSN.
- Full Social Security numbers. California DIR electronic certified payroll (eCPR) filing requires a worker’s full SSN. When you enter one for eCPR, we store it in encrypted form (see “How we protect your information” below).
- Billing information. When you subscribe to a paid plan, our third-party payment processor collects and processes your payment details to charge your subscription. We receive limited billing records (such as your plan, subscription status, and the last four digits of the card); we do not store full payment card numbers on our systems.
We also automatically collect limited technical and usage data needed to keep the service running and secure — such as error diagnostics, IP address, device and browser type, and how you interact with our website. See “Cookies & analytics” below for how our website uses cookies and similar technologies.
When you enter another person’s information (such as a worker on your crew), you are responsible for having the authority to provide it to us and for giving that person any notice required by law about how their information is collected and used for certified payroll.
How we use your information
- To generate your WH-347 and state certified payroll reports.
- To prepare and, where supported, electronically file reports with the appropriate government agency (for example, the California DIR eCPR portal).
- To maintain an audit trail of the reports you generate, as certified payroll compliance requires.
- To operate, secure, support, and improve the service.
We do not sell your personal information, and we do not use worker SSNs for any purpose other than producing and filing your certified payroll reports.
How we protect your information
- Encryption at rest. Full Social Security numbers are encrypted with AES-256-GCM before they are stored. They are decrypted only on our servers at the moment an eCPR file is generated, and are never returned to your browser — the app shows a masked value such as “•••-••-6789”.
- Encryption in transit. Data moves between you and PrevailComply over encrypted (HTTPS/TLS) connections.
- Access isolation. Your data is scoped to your account, and database-level controls prevent one customer’s records from being read by another.
How we share information
We share information only in these limited circumstances:
- Government agencies. When you file a report, the data in that report (which may include worker SSNs) is transmitted to the awarding or labor agency you are filing with, as the filing requires.
- Service providers. We rely on vendors to run the service — for authentication, cloud hosting, database storage, payment processing, error monitoring, and website analytics. They process data on our behalf under contract and only to provide their service to us.
- Legal. If required by law or valid legal process, or to protect the rights, safety, and security of PrevailComply and its users.
Cookies & analytics
Our website uses cookies and similar technologies to operate the site and to understand how visitors use it. We use Google Tag Manager to manage these tags, which currently load Google Analytics. These tools may collect information such as your IP address, device and browser type, pages viewed, and referring links.
How long we keep it
We retain your account, company, project, and payroll records while your account is active and for as long as needed to provide the service and to preserve the certified payroll audit trail that compliance requires. Certified payroll records often must be retained for several years under federal and state law, and we keep your data long enough to support those obligations. When data is no longer needed, we delete or de-identify it.
Your rights
You may request access to, correction of, or deletion of your personal information, and you may ask us to delete a specific worker’s data. We will honor deletion requests except where we are required to retain certain records to meet a legal or certified payroll recordkeeping obligation. To make a request, email us at contact@prevailcomply.com.
Your California privacy rights
If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect and how we use and disclose it, to request access to or deletion or correction of it, and to not be discriminated against for exercising these rights.
- Categories we collect. Identifiers (name, email), commercial information (subscription/billing records), professional information (business and license details), internet activity (website usage), and sensitive personal information — specifically Social Security numbers entered for certified payroll filing.
- How we use sensitive personal information. We use SSNs only to generate and file your certified payroll reports, and not to infer characteristics about anyone. You may limit our use of sensitive personal information, though this may prevent us from producing eCPR filings that legally require a full SSN.
- Sale/sharing. We do not sell your personal information and do not share it for cross-context behavioral advertising.
- How to exercise your rights. Email contact@prevailcomply.com. We will verify your request before acting on it, and you may use an authorized agent.
- Worker data. Where the information relates to your employees rather than to you, we handle it on your behalf as your service provider. A worker who wants to exercise rights over their own data should contact their employer (the account holder who entered it); we will support the employer in responding to such a request.
Changes to this policy
We may update this policy as the service evolves or as the law changes. We will post the updated policy here and revise the effective date above.
Contact us
Questions about this policy or your data? Email contact@prevailcomply.com.