Privacy Policy

Who we are

PayoutEngine is a sales commission platform. Sales teams connect their CRM, configure their commission plans, and we calculate every rep's payout with a full, auditable record of how each number was reached.

In this policy, “PayoutEngine,” “we,” and “us” mean the company that operates payoutengine.io and the PayoutEngine app. “You” means the person reading this, whether you're a customer admin, a sales rep whose payouts we calculate, or a visitor to our site.

We're an early-stage company. As PayoutEngine and our operations grow, we'll keep this policy current and note the date of the latest change at the top.

What we collect

We collect information in three ways: what you give us directly, what we gather automatically when you use the site or app, and the CRM data a customer connects so we can calculate commissions.

• Account and contact information. Your name, work email, and company name, plus whatever you enter in a signup, waitlist, or contact form. If you become a paying customer, billing is handled by our payment processor, and we don't store full card numbers.
• Usage and device data. Standard technical information your browser sends, like your IP address, browser type, and the pages you visit, plus site analytics that tell us how people find us and which pages they read. “Cookies and analytics” below names the tool we use for that and lists everything it captures.
• Customer CRM and commission data. When a customer connects HubSpot or imports a file, we receive deal records, amounts, close dates, and the sales reps those deals belong to. We process this on the customer's behalf. See “Data we handle for our customers” below.
• Messages you send us. If you email us or fill in a contact form, we keep the message and our reply so we can help and follow up.

How we use your information

We use personal information to run PayoutEngine, and nothing more. Specifically:

• To provide the service: create your account, connect your CRM, and calculate commissions.
• To support you: answer questions, investigate a calculation, and follow up on a request.
• To keep the product secure and reliable: prevent abuse, debug problems, and protect your data.
• To improve the product: understand which features get used so we can make them better.
• To communicate with you: send service messages, and, only if you opt in, product updates you can unsubscribe from at any time.
• To meet legal and tax obligations, and to enforce our Terms of Service.

We don't sell your personal information, and we don't share it with advertisers.

Our legal bases (for the GDPR)

If you're in the UK or European Economic Area, the law asks us to name a legal basis for processing your personal data. We rely on:

• Performing our contract. So we can give you the service you signed up for.
• Legitimate interests. So we can secure, support, and improve the product, in a way that doesn't override your rights.
• Consent. For optional things like marketing email, which you can withdraw at any time.
• Legal obligation. When a law requires us to keep or disclose information.

Data we handle for our customers

There's an important distinction in how we treat data. For your account and our own site, we decide how and why data is used, which makes us what privacy law calls a controller.

For the CRM and commission data a customer brings into PayoutEngine, including the personal information of their sales reps, the customer is the controller and we're the processor. We act only on that customer's documented instructions, we use the data solely to provide the service, and we don't use it for our own purposes. Business customers can ask us for a data processing agreement that spells this out.

If you're a sales rep and you want a copy of your commission data, or you want it corrected, please contact your employer first, since they control that data. We'll support them in responding to you.

Who we share it with

We share personal information only with the service providers that help us run PayoutEngine, and only what each one needs. The providers we rely on today are:

• Cloud hosting. Our infrastructure runs on DigitalOcean, which stores the data that powers the app.
• Email delivery. We use Mailgun to send transactional email like confirmations and payout statements.
• CRM integration. If you connect HubSpot, your data flows only one way: from HubSpot to PayoutEngine. We never change anything in your HubSpot.
• Site analytics. PostHog measures traffic on our public website. It acts as our processor, on our instructions, and it holds that data on its US infrastructure. PostHog's code runs on our marketing pages only and never on a signed-in screen of the app.

Each provider is bound to protect the data and use it only to provide their service to us. We may also disclose information if the law requires it, to protect our rights or someone's safety, or as part of a merger or acquisition, in which case we'll tell you before your information becomes subject to a different policy.

To say it once more: we don't sell your personal information.

How long we keep it

We keep personal information for as long as your account is active and as long as we need it for the purposes in this policy. When you close your account, we delete or anonymize your personal data within a reasonable period, except where we're required to keep certain records for legal, tax, or accounting reasons, or need them to resolve a dispute.

Because every payout is exportable and every calculation is in the audit log, a customer takes their historical record with them when they leave.

Website analytics run on a shorter, fixed clock. PostHog holds the analytics and session recordings from our public site for one year, and anything older than that drops off.

How we protect it

We protect your data with encryption in transit, access controls that limit who can see what, and separation of each customer's data from every other customer's. Sensitive fields are encrypted at rest. No system is perfectly secure, but security is core to a product people trust with payroll-adjacent numbers, and we treat it that way. If a breach ever affects your personal data, we'll notify you and the relevant authorities as the law requires.

Where your data is processed

PayoutEngine is operated from the United States, and the providers we use may process data there. If you access the service from outside the US, you understand your information will be transferred to and processed in the US. Where we move personal data out of the UK or EEA, we rely on approved safeguards such as the standard contractual clauses.

Your rights and choices

Depending on where you live, you have some or all of these rights over your personal information:

• Access. Ask for a copy of the personal data we hold about you.
• Correction. Ask us to fix data that's wrong or incomplete.
• Deletion. Ask us to delete your personal data.
• Portability. Get your data in a portable, machine-readable format.
• Objection and restriction. Object to or limit certain kinds of processing.
• Withdraw consent. Opt out of marketing email or withdraw any consent you gave, at any time.

To exercise any of these, email us and we'll respond within the time the law allows, usually within 30 days. We won't charge you or treat you differently for asking. If you're a California resident, the CCPA gives you these rights too, including the right to know what we collect and the right not to be discriminated against for exercising them, and we confirm again that we don't sell your personal information. If you're in the UK or EEA and think we've mishandled your data, you can complain to your local data protection authority, though we'd appreciate the chance to put it right first.

Cookies and analytics

We use a small number of essential cookies. They keep you signed in and keep the app secure, and the product can't work without them.

For our public website we use PostHog, an analytics tool that acts as our processor. The data it collects is held on PostHog's infrastructure in the United States, and PostHog keeps it for one year.

Until you tell us otherwise, PostHog writes nothing to your device. No cookie, no local storage, nothing. It counts your visit using an identifier that PostHog works out on its own servers, by combining your IP address and browser with a secret value that rotates every day and is then discarded, so tomorrow you look like a new visitor. That's a deliberate trade. We get a rough traffic count rather than a precise one, and you get nothing stored on your machine.

There's one exception, and it's your own answer. If you tell us no, we save that no on your device so the banner stops asking on every page. It's the only thing a no puts there, it identifies nobody, and without it a no couldn't stick. Say yes and the device identifier below is saved as well.

• Pages and paths. Which pages of our site you open, and in what order.
• Referrer. The site or link that sent you to us.
• Campaign tags. The utm_source, utm_medium, and utm_campaign values on a link you followed, so we can tell which post or ad brought you here.
• Basic browser information. Your browser and device type, which your browser sends with every request it makes anyway.
• Your IP address. Your browser sends it with every request, so PostHog receives it the way our own servers do. Until you consent it's used only to work out that daily identifier and is then stripped, so nothing works out where you are. Once you consent it reaches PostHog's location lookup, which turns it into an approximate country and region.
• A device identifier, only if you consent. A cookie and a local storage entry that let us recognize a returning visitor and count unique visitors accurately.
• Session recordings, only if you consent. Covered on its own below, because it deserves the space.

We don't run advertising trackers, we don't build a profile of you for anybody else, and we don't sell what we learn.

None of this reaches the app. The analytics code is served on our public marketing pages only, so no signed-in screen ever loads it and no quota, deal amount, or payout figure is ever sent to PostHog.

Session replay

Session replay gets its own section because it's the piece people ask about most, and they're right to.

A replay is a reconstruction of a browsing session: the pages you saw, where you moved the pointer, what you clicked, and how far you scrolled. PostHog records it and we watch it to find out where our site confuses people.

Two limits on it, and both are firm. It's off unless you give consent, because we can't record a visitor who has nothing stored on their device. And it covers our public marketing website only, meaning the pages anyone can read without an account. We record no signed-in screen of the app, so a rep's attainment, a deal amount, and a payout total never appear in a recording.

Recordings stay with PostHog in the United States under the same one-year window as the rest of our analytics, and you can ask us to delete yours at any time.

Your tracking choices

The optional half of this is yours to control, and you can change your mind whenever you like.

• Without consent. Nothing is recorded, and the only thing stored on your device is your answer to the question itself, saved so we stop asking. We still count the visit as one anonymous pageview, and your IP address is stripped before anything works out where you are.
• With consent. PostHog sets a cookie so we can recognize a returning visitor, session replay becomes available on our public pages, and your IP address is used to work out an approximate country and region. That's the whole difference.
• Withdrawing it. Use the buttons at the end of this section. They switch cookies on and off for this browser at any point, as often as you like, and they're the same two the banner offers. If you'd rather not rely on us, clearing PayoutEngine's cookies and site data in your browser gets you back to a blank slate, and your browser's cookie-blocking settings do the job up front.
• Deleting what we already hold. Email us and we'll delete the analytics records and any session recordings tied to you. “Your rights and choices” above covers the rest of what you can ask for.

Essential cookies are outside this choice. They keep you signed in and keep the app secure, and no version of the product works without them.

Children's privacy

PayoutEngine is a tool for businesses and isn't meant for anyone under 18. We don't knowingly collect personal information from children. If you believe a child has given us their information, email us and we'll delete it.

Changes to this policy

We'll update this policy as the product and the law evolve. When we make a material change, we'll revise the date at the top and, where it's significant, tell you directly. Continuing to use PayoutEngine after a change means you accept the updated policy.

How to reach us

Questions about your privacy, or want to exercise one of the rights above? Email us at [email protected], or reach us through our contact page.