PrevailCrew
Menu

Privacy policy

Last updated November 10, 2026

PrevailCrew helps contractors prepare certified payroll. That means we handle payroll information about you and your workers. This page explains what we collect, why, where it goes and the choices you have, in plain words.

The short version

  • The free tools need no account. The free WH-347 builder saves nothing, not even in your browser, and builds the PDF on your device.
  • In the paid app we store what you enter so next week can start from this week: your company, projects, workers, rates and payrolls.
  • Full Social Security numbers (SSNs) and ITINs are not stored unless your company turns on “Save SSNs for export”. It is off by default.
  • We don't sell personal information, and we don't use advertising or third-party analytics trackers.

Free tools (no account)

WH-347 builder. What you type is not saved anywhere, not even in your browser, and the PDF is generated on your device. It is not uploaded to us. Closing or reloading the page clears the builder.

Waitlist. Before launch, the free WH-347 builder offered a waitlist. If you joined it, we keep the email address and answers you gave (role, plan of interest, payroll software, state) to tell you about the paid plan. Ask us and we'll delete them.

Rate pages and calculator. These work without sending us anything you type. The calculator runs in your browser.

Your account and the paid app

When you create an account and use the app, we store:

  • Account details: your name, email address and a hashed password (or a sign-in link sent to your email).
  • Company details: name, address and registration numbers you enter, and the people with access to the company.
  • Projects: names, locations, contract and project numbers, wage determinations and rates.
  • Workers: names, the last four digits of their SSN or a worker ID, addresses and other fields a certified payroll needs.
  • Payrolls: hours, rates, fringe, deductions, check numbers and notes for each week.
  • Billing status: your plan, trial dates and subscription status. Card details go to our payment processor, not to us.

We use this only to provide the service: to show your data back to you, pre-fill next week, check the math and produce your reports and export files.

Workers' Social Security numbers and ITINs

California's electronic certified payroll (eCPR) requires each worker's full SSN or ITIN. Each company chooses how these are handled with the “Save SSNs for export” setting.

Setting off (the default): typed at export, kept in your browser

  • The export dialog asks for each worker's full number. The California XML file is built in your browser and downloaded directly.
  • The full numbers never leave your device: they are not sent to us in any request, URL, log, analytics or error report, and are not written to your browser's storage. They are held in memory only and cleared when the dialog closes.
  • We check each typed number against the stored last four digits so it isn't entered against the wrong worker.

Setting on (opt-in): saved, encrypted

  • Turning it on shows a plain-language consent, and we record who turned it on and when.
  • Numbers you save are encrypted in our application with AES-256-GCM before they reach the database. The encryption key is kept outside the database.
  • On screen, saved numbers are always masked (•••-••-1234). The full number only reaches your browser in the entry form.
  • When you export, the numbers are sent to our server for that export request and decrypted there only to build the file. Numbers you type for workers without a saved one are sent in that same request, and saved if you leave “Save these numbers for next time” checked. Each decryption is logged (who, which worker, when and why), never the number itself. The XML is streamed to you and not stored.
  • Turning the setting off deletes every stored number for your company immediately and permanently, after a confirmation. The deletion is logged.

The free tools never ask for full SSNs. The WH-347 itself uses only the last four digits or a worker ID.

Cookies and local storage

  • Sign-in cookie. When you sign in we set a cookie that keeps you signed in. It's needed for the app to work.
  • Local storage. We don't use it for your data. The free WH-347 builder keeps nothing between visits, and it deletes a draft an older version may have left in your browser.

We don't use advertising cookies or cross-site tracking.

Who we share information with

Only the service providers we need to run PrevailCrew, under agreements that limit their use of it:

  • Dodo Payments, our merchant of record, which sells you the subscription, processes payments and handles sales tax. Dodo Payments receives your billing details directly and has its own privacy policy.
  • Our hosting and database providers, which store the app's data.
  • Our email provider, which sends sign-in links and account emails.

We may also disclose information if the law requires it. We don't send your payroll data to government agencies: you download your reports and file them yourself.

How long we keep it

Your data stays while your account is active (including when paused) so your payroll history is there when you need it. Federal and state rules require contractors to keep payroll records for years after a job ends; we recommend you keep your own copies of every report you file. If you ask us to delete your account, we delete your company's data except where we must keep billing records.

Security

See our security page for how we protect data, including encryption and access logging.

Your choices and rights

You can view and edit your data in the app, export your reports, turn SSN saving off at any time, and ask us for a copy of your data or to delete it. Depending on where you live (for example California), you may have further rights under state privacy law. Workers whose information a contractor entered should contact that contractor, who controls their payroll records.

Contact

Questions about privacy: privacy@prevailcrew.com.