Privacy Policy

One Click Onboard (“we”, “us”, or the “Service”) is software that helps employers run new-hire onboarding: employees enter their information once, required employment forms are generated and signed electronically, and the employer reviews and stores the completed records. This policy explains what information the Service handles, how it is protected, and the choices available to you.

Our role: service provider to your employer

When you complete onboarding paperwork through the Service, your employer is the business that decides why and how your information is used (the “controller”). One Click Onboard acts as the employer’s service provider / processor under the California Consumer Privacy Act (CCPA/CPRA). We process employee information only to provide the Service to the employer, never for our own marketing, and we do not sell personal information or share it for cross-context behavioral advertising.

Information we collect

Employer account information— name, work email, sign-in credentials (email/password or Google sign-in), company details you enter (legal name, address, EIN, workers’ compensation carrier, pay policies), and billing records. Payments are processed by Stripe; we do not store card numbers.

Employee onboarding information(collected on your employer’s behalf) — identification and contact details (name, date of birth, address, phone, email), Social Security number, tax withholding elections (Form W-4, DE 4), work-authorization information and images of the identity documents you choose to upload (Form I-9), emergency contacts, policy acknowledgments, and your electronic signatures.

Signature and audit metadata — timestamps, IP address, and browser information recorded when you consent, sign, or when records are accessed. Federal rules for electronic Form I-9 systems require this audit trail.

Cookies — we use only essential cookies (sign-in session, active company, onboarding session). We do not use advertising or analytics tracking cookies.

How information is used

• Generating, routing, signing, and storing employment forms
• Legal compliance, including Form I-9 retention rules and tamper-evident audit trails
• Security, fraud prevention, and account support
• Billing and service communications (never marketing to employees)

How information is protected

Social Security numbers and dates of birth are encrypted at rest (AES-256-GCM) in addition to full-database encryption. All traffic is encrypted in transit (TLS). Access is restricted by company and by role, document files are served only through short-lived signed links, and access to identity documents and signed forms is audit-logged. Signed documents are tamper-evident (cryptographic hashing with version history).

Who we share information with (subprocessors)

We share information only with the infrastructure providers needed to run the Service, each bound to process it solely for us:

• Supabase — database, authentication, and encrypted file storage
• Vercel — application hosting
• Stripe — subscription billing (employer accounts)
• Resend — transactional email delivery
• Google — optional sign-in for employer accounts

We may also disclose records when the employer directs us to, or when required by law (for example, a government Form I-9 inspection).

How long information is kept

Employee records are kept for as long as your employer’s account requires and as the law requires. Form I-9 records must by law be retained until the later of three years after the date of hire or one year after employment ends. Other records are deleted or returned on the employer’s instruction, subject to legal retention duties.

Your California privacy rights

California residents have rights to know, access, correct, and delete personal information. For information collected through onboarding, please direct requests to your employer, who is the controller of your employment records — we support employers in fulfilling these requests. You may also contact us directly at samorj16@gmail.com and we will assist or forward your request. We do not sell or share personal information, and we do not use it for automated decision-making or profiling.

Data breaches

If a security incident affects personal information, we will notify affected employers without undue delay so that legally required notices can be made, and we will cooperate fully in the response.

Children

The Service is used for employment records at an employer’s direction, which may include records of legally employed minors. We do not knowingly collect information from anyone except as part of an employer-directed onboarding.

Changes and contact

We will post any changes to this policy on this page with a new effective date. Questions or requests: samorj16@gmail.com.

See also our Terms of Service.