Paply Ltd is the data controller for personal data collected through the Paply platform at paply.io. We are registered in England and Wales.
Data Controller: Paply Ltd
Contact: privacy@paply.io
Website: paply.io
Where we process employee data on behalf of our customers (employers), the employer is the data controller and Paply acts as data processor. Our Data Processing Agreement governs this relationship.
| Data type | What it includes | Why we collect it | Legal basis |
|---|---|---|---|
| Account data | Name, email address, company name, job title, phone number | To create and manage your account, send you the service | Contract |
| Employee data | Employee names, salaries, NI numbers, tax codes, start dates, departments | To provide payroll, benchmarking, and HR features | Contract / Legitimate interests |
| Usage data | Pages visited, features used, clicks, session duration, browser type | To improve the product and fix bugs | Legitimate interests |
| Payment data | Billing name, last 4 digits of card, subscription plan | To process your subscription payment | Contract |
| Lead data | Email, phone, company, headcount, role, calculator inputs | To contact you about Paply and book demos | Consent / Legitimate interests |
| Wellbeing data | Olive conversations, mood check-ins | To provide the employee wellbeing service | Consent (employee opt-in) |
| Survey data | Anonymous employee survey responses | To calculate happiness scores for employers | Legitimate interests |
We never sell your personal data. We never use employee data for advertising. Olive wellbeing conversations are completely private and never shared with employers.
We only share data with trusted sub-processors necessary to deliver the service:
| Sub-processor | Purpose | Location | Safeguards |
|---|---|---|---|
| Supabase | Database, authentication, storage | EU / US | Standard Contractual Clauses |
| Vercel | Hosting and content delivery | EU / US | Standard Contractual Clauses |
| Stripe | Payment processing | EU / US | Standard Contractual Clauses |
| Resend | Transactional email | US | Standard Contractual Clauses |
| Anthropic | AI features (Ada, Olive) | US | Standard Contractual Clauses |
We may also disclose data where required by law, court order, or to protect the safety of any person.
To exercise any right, email privacy@paply.io. We will respond within 30 days. If you are unhappy with our response you have the right to complain to the ICO at ico.org.uk.
We use a small number of cookies to make the platform work:
We do not use advertising cookies, tracking pixels, or third-party marketing cookies. You can manage cookies in your browser settings at any time.
We may update this policy from time to time. We will notify you of material changes by email at least 14 days before they take effect. The current version is always available at paply.io/privacy.