1. Who we are
Onest is a product of YNET Plus Inc., a corporation operating out of Ontario, Canada. This Privacy Policy explains how we collect, use, store, and protect personal information in connection with the Onest marketing website (onest.so) and payroll application (app.onest.so) — together, the "Service" — in accordance with our obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal private-sector privacy law.
2. What we collect
Account data: your name and email address, collected and authenticated through AWS Cognito.
Payroll data entered by the customer: employer and employee information needed to run payroll, including employee names, addresses, Social Insurance Numbers (SIN), banking and direct-deposit details, and compensation records.
About Social Insurance Numbers. We collect Social Insurance Numbers only because they are legally required for T4 slips and Records of Employment (ROEs). SINs are used solely for those purposes, are never used as an account identifier, are accessible only to a restricted set of authorized personnel, and are encrypted at rest.
Billing data: your subscription and payment details are handled by Stripe, our payment processor. Card numbers never touch our servers.
Operational logs: technical logs generated by normal use of the Service — sign-in activity, error logs — used to operate and secure the Service.
3. Why we collect it
We use personal information to calculate payroll and generate paystubs, T4s, and ROEs; to bill for the Service; to provide customer support; and to meet our own legal and regulatory obligations. We do not sell personal information, and we do not use it for advertising. Our marketing website does not use cookies or third-party analytics or advertising trackers.
4. Where and how it's stored
Onest is hosted on Amazon Web Services (AWS) in Canada (the ca-central-1 region). Sensitive fields — SIN and banking/direct-deposit details — are encrypted at rest using application-level field encryption, in addition to disk-level encryption on the underlying database. Data in transit is protected with TLS encryption.
Payment and billing information is processed by Stripe and may be stored and processed outside Canada, including in the United States, where it is subject to the laws of those jurisdictions. All payroll and employee data remains hosted in Canada.
5. Subprocessors
We share personal information with the following subprocessors, only as needed to provide the Service:
Amazon Web Services (AWS) — hosting, authentication (Cognito), and transactional email.
Stripe — payment processing and billing.
We do not share personal information with any other third party, except with your direction or consent as described in this policy, or as required by law.
6. Retention
We retain your account and payroll data for as long as your account is active. Payroll records are subject to statutory retention requirements under Canadian tax and employment law — including 6 years under the Income Tax Act and 3 years under the Ontario Employment Standards Act — so certain records may be retained after account closure to meet those obligations. Following closure of your account, we make your Customer Data available for export for at least 60 days (see our Terms of Service), and delete data we are not required to retain within 90 days of closure. You can request deletion of your data at any time, subject to these legal retention duties.
7. Your rights
You have the right to access and correct the personal information we hold about you. To make a request, contact us using the details below.
Breach response. If we become aware of a breach of security safeguards involving personal information, we will: notify the affected employer customer without undue delay; report the breach to the Office of the Privacy Commissioner of Canada and notify affected individuals where the breach creates a real risk of significant harm, as required by PIPEDA; notify any other organizations or authorities where required by law; and maintain records of all breaches of security safeguards, whether or not reportable.
7A. If your employer uses Onest
If you are an employee or contractor whose information appears in Onest because your employer uses the Service, your employer decides what information is entered and instructs Onest on how it is processed. For access, correction, or other requests about your personal information, contact your employer first; Onest will assist your employer in responding. You are also welcome to contact us directly with any questions.
8. Privacy Officer and contact
Onest has designated a Privacy Officer responsible for our compliance with this Privacy Policy and applicable privacy law. Questions about this Privacy Policy, or requests relating to your personal information, can be sent to support@onest.so, attention Privacy Officer.
9. Updates to this policy
We may update this Privacy Policy from time to time; the effective date above reflects the most recent version.