ROBLAR INNOVATION LLC
RootsPayroll Privacy Policy
How RootsPayroll collects uses discloses and protects personal information
Roblar Innovation LLC (“Roblar,” “we,” “us,” or “our”) provides RootsPayroll to business customers. This Privacy Policy explains how we handle personal information through RootsPayroll, its QuickBooks and other integrations, hosted components, product pages, and support services. It also explains the choices available to customers, authorized users, and other individuals whose information is processed.
Our principal privacy practices
- We use personal information to provide, secure, support, and administer RootsPayroll and the features a customer chooses to use.
- We do not sell personal information or QuickBooks Data, and we do not disclose it for cross-context behavioral advertising.
- Business customers control the payroll, workforce, patient, and operational data they submit. Individuals should usually direct requests about that data to the relevant employer or health-care organization.
- A customer can disconnect its QuickBooks connection to stop future access. Disconnection does not reverse transactions already posted or automatically erase records that must be retained for reconciliation, security, backup, or legal purposes.
This Policy does not replace a health-care provider’s Notice of Privacy Practices, a business associate agreement, or a customer-specific privacy notice. Those documents may provide additional rights or terms.
1 Scope and privacy roles
1.1 Scope. This Policy applies when Roblar collects or processes personal information through RootsPayroll, related hosted services, product or support pages, implementation and support activities, and integrations selected by a customer. It does not govern a third party’s independent privacy practices, including Intuit’s handling of information in QuickBooks or Intuit Enterprise Suite.
1.2 Business customers. RootsPayroll is designed for employers, payroll and administrative teams, home-health-care providers, and related organizations. A customer determines what workforce, patient, vendor, accounting, and operational information it enters, which users may access it, and which integrations it enables.
1.3 Roblar as service provider or processor. When Roblar processes Customer Data to provide RootsPayroll under a customer’s instructions, Roblar generally acts as the customer’s service provider, contractor, or processor. The customer remains responsible for its notices, permissions, legal bases, retention instructions, and responses to individuals, except where law or a written agreement assigns responsibility to Roblar.
1.4 Roblar as business or controller. Roblar may act as an independent business or controller for account administration, licensing, billing, support relationships, product security, fraud prevention, legal compliance, and Roblar’s own business records. The role depends on the information and context.
2 Information we collect
The information RootsPayroll processes depends on the customer’s configuration, the user’s role, and the features and integrations the customer enables. The principal categories are summarized below.
| Category | Examples | Primary purposes |
|---|---|---|
| Account and identity | Name, business contact details, organization, job role, username, user identifiers, authentication and authorization records. | Create and administer accounts, authenticate users, assign access, communicate, and support the service. |
| Payroll and workforce | Employee and contractor identifiers; contact details; taxpayer and government identifiers; dates of birth; employment, compensation, time, deduction, benefit, leave, garnishment, banking, check, and tax information. | Run customer-directed payroll and workforce workflows, create records and reports, and support compliance activities. |
| Health-care administration | Patient, clinician, payer, referral, scheduling, service, documentation, and health-related information entered by a customer when using home-health-care features. | Provide customer-selected administrative and operational functions under customer instructions and applicable agreements. |
| QuickBooks and Intuit | Intuit user and company identifiers, realm ID, permitted profile details, company information, Chart of Accounts records, account mappings, sync status, journal-entry and printed-check data, and transaction responses. | Connect the selected company, synchronize accounts, prepare or post authorized accounting records, reconcile activity, and diagnose integration errors. |
| Integration credentials | OAuth access, refresh, and identity tokens; authorization status; token expiration times; and non-secret application configuration. The Intuit client secret is obtained from Azure Key Vault and is not stored in RootsPayroll settings. | Maintain authorized connections, refresh access, prevent unauthorized use, and protect application credentials. |
| Technical and audit | Application and device information, timestamps, feature activity, sync and posting history, error details, Intuit transaction IDs, security events, and diagnostic records. | Operate, secure, troubleshoot, audit, and improve the service and maintain transaction integrity. |
| Support and business | Support messages, attachments supplied for support, implementation details, orders, invoices, and business relationship records. | Respond to requests, implement and support RootsPayroll, administer contracts, and maintain business records. |
2.1 Sensitive personal information
Some categories above may qualify as sensitive personal information under applicable law, including government identifiers, financial account information, precise health information, credentials, and information about employment or compensation. We use sensitive information only for the services and purposes described in this Policy, to protect people and systems, and as otherwise permitted by law. We do not use sensitive information to infer characteristics for advertising.
2.2 Information we do not intentionally collect
RootsPayroll does not require users to provide full payment-card numbers or card security codes to Roblar for the QuickBooks accounting functions described in this Policy. If a supported payment feature is enabled, payment details should be collected through the authorized provider’s tokenization workflow. Customers and users must not place passwords, raw payment-card data, access tokens, or other unsupported secrets in notes, free-text fields, attachments, or support messages.
3 Sources of information
3.1 Customers and users. We receive information directly from customers, administrators, authorized users, and individuals who contact us. Customers may import or create records from their own systems and source documents.
3.2 Connected services. We receive information from Intuit and other services only when a customer or authorized user enables an integration or directs a transfer. The information depends on the permissions granted and the data the third party makes available.
3.3 Product operation. RootsPayroll and its service providers generate technical, security, synchronization, and audit records when users sign in, use features, connect services, transmit records, or request support.
3.4 Administrators and organizations. A customer’s administrators, managers, payroll personnel, clinicians, or other authorized representatives may provide information about users, employees, contractors, patients, vendors, and other people as part of the customer’s operations.
4 QuickBooks and Intuit information
4.1 Authorization and permissions. RootsPayroll uses Intuit’s OAuth authorization process. An authorized user selects an Intuit account and company and grants specific permissions. Depending on the permissions enabled, RootsPayroll may access QuickBooks accounting data and Intuit profile information such as name, email address, phone number, postal address, and Intuit user identifier when Intuit returns those fields.
4.2 Accounting information. RootsPayroll may retrieve company information and active or inactive Chart of Accounts records, including account names, identifiers, numbers, types, classifications, hierarchy, status, and synchronization metadata. When a customer enables posting, RootsPayroll may send customer-approved journal entries, printed-check transactions, payee references, dates, amounts, descriptions, account references, and stable request identifiers to the selected QuickBooks company.
4.3 Local cache and audit history. RootsPayroll stores a company-specific account cache and synchronization history in the customer’s RootsPayroll database so users can continue working when Intuit is unavailable and can identify renamed, inactive, removed, mismatched, or orphaned account mappings. Cached information may be stale until the next successful synchronization.
4.4 Credentials. OAuth tokens are stored in an encrypted settings file associated with the current Windows user. The Intuit application client secret is retrieved from Azure Key Vault when needed and cached only in process memory. We do not intentionally include OAuth tokens, the client secret, or raw payment-card data in application logs.
4.5 Disconnection. A customer may disconnect RootsPayroll through available RootsPayroll connection controls or Intuit’s connected-app controls. After disconnection takes effect, RootsPayroll will no longer retrieve new QuickBooks Data under that authorization. Disconnection may disable integration features and does not reverse transactions already sent to QuickBooks.
4.6 Intuit’s privacy practices. Intuit independently handles information under its own terms and privacy notices. For information about Intuit’s practices and choices, see the Intuit Global Privacy Statement at https://www.intuit.com/privacy/statement/. Information collected by RootsPayroll is governed by this Policy and applicable customer agreements.
5 How we use information
We use personal information for the following business and service purposes:
- Provide and administer RootsPayroll, including customer configuration, licensing, access control, data storage, payroll and home-health-care workflows, reporting, and customer-selected integrations.
- Authenticate users and maintain authorized connections, including obtaining and refreshing integration tokens and confirming that a QuickBooks realm matches the selected RootsPayroll company.
- Synchronize QuickBooks accounts, maintain mappings, prepare and transmit customer-authorized accounting records, prevent duplicate submissions, and support reconciliation.
- Provide implementation, training, maintenance, troubleshooting, and customer support and communicate about service, security, billing, and policy changes.
- Protect RootsPayroll, customers, users, data, credentials, and connected systems; detect misuse; investigate incidents; and maintain audit records.
- Comply with law, enforce agreements, establish or defend legal claims, and respond to valid legal process.
- Analyze product performance and improve reliability, usability, and security using information that is aggregated or de-identified where reasonably practicable.
6 How we disclose information
6.1 Customer and authorized users. We disclose information within the customer’s environment according to the customer’s configuration, permissions, roles, and instructions. Customer administrators may access user activity, business records, and audit information associated with their organization.
6.2 Connected services. We disclose information to Intuit and other connected services when a customer directs RootsPayroll to synchronize, post, transmit, or retrieve information. The connected provider processes that information under its own terms and privacy practices.
6.3 Service providers. We may use service providers for cloud hosting, databases, identity and credential management, communications, document delivery, monitoring, security, implementation, and support. They may process information only to provide contracted services to us, subject to confidentiality and data-protection obligations appropriate to their role.
6.4 Legal and safety purposes. We may disclose information when we reasonably believe disclosure is required by law or legal process or is necessary to protect rights, safety, property, systems, or users; investigate fraud or security events; or enforce agreements.
6.5 Business transactions. We may disclose information in connection with a proposed or completed merger, financing, reorganization, sale of assets, acquisition, bankruptcy, or similar transaction. We will use appropriate safeguards and require the recipient to handle personal information consistently with applicable law.
6.6 Direction and consent. We may disclose information for another purpose when the customer or affected individual directs us to do so or gives valid consent.
6.7 No sale or targeted advertising. We do not sell personal information or QuickBooks Data for money or other valuable consideration, and we do not share personal information for cross-context behavioral advertising. We do not use QuickBooks Data to advertise third-party products or build marketing profiles unrelated to providing RootsPayroll.
7 Retention and deletion
7.1 Retention criteria. We retain personal information for as long as reasonably necessary to provide and secure RootsPayroll, maintain the customer relationship, follow customer instructions, reconcile transactions, meet contractual and legal obligations, resolve disputes, enforce agreements, and maintain appropriate business, security, and audit records. Retention varies by record type and customer requirements.
7.2 QuickBooks information. OAuth tokens are retained while the connection remains authorized and may remain in protected backups for a limited period after replacement or disconnection. Chart of Accounts cache records, account mappings, transaction references, synchronization history, and error or audit records may be retained after disconnection when needed for continuity, reconciliation, security, support, or legal compliance.
7.3 Customer-controlled records. Customers control many RootsPayroll retention settings and decisions. Customer legal obligations may require payroll, tax, employment, accounting, patient, or health-care records to be retained even after a user leaves or an integration is disconnected.
7.4 End of service. Subject to the customer agreement, applicable law, and technical feasibility, a customer may request an export or deletion of Customer Data. We may delete or de-identify information after the applicable retention period. Data may remain temporarily in protected backups and may be retained when required by law or necessary for security, fraud prevention, audit integrity, or legal claims.
8 Security
8.1 Safeguards. We use administrative, technical, and physical safeguards designed for the nature of the information and the service. These may include access controls, role restrictions, encryption in transit, protected credential storage, Azure Key Vault for application secrets, Windows data protection for user-bound OAuth settings, logging controls, backup practices, and monitoring.
8.2 Shared responsibility. No security program can prevent every incident. Customers are responsible for supported devices and operating systems, network security, user administration, appropriate permissions, strong authentication, timely removal of access, and secure handling of exports, reports, checks, and credentials.
8.3 Incident response. We investigate suspected security incidents and provide notices when required by law or an applicable customer agreement. Customers and users should promptly report suspected unauthorized access and should not send passwords, access tokens, full financial account numbers, or protected health information through unsecured support channels.
9 Health information
9.1 Customer responsibility. A home-health-care customer may submit protected health information or other health-related information to RootsPayroll. The customer determines the purposes of that processing and is responsible for its own HIPAA, HITECH, state health-privacy, notice, authorization, minimum-necessary, and record-retention obligations.
9.2 Business associate agreement. When Roblar processes protected health information for a covered entity or business associate in circumstances requiring a business associate agreement, the parties must execute a separate agreement. That agreement controls Roblar’s handling of protected health information if it conflicts with this Policy.
9.3 Individual requests. This Policy is not a health-care provider’s Notice of Privacy Practices. Patients and workforce members should direct requests concerning records controlled by a RootsPayroll customer to that customer. We will assist the customer as required by applicable agreements and law.
10 Privacy choices and rights
10.1 Account information. Authorized users may review or update certain information in RootsPayroll or through their customer administrator. Customers are responsible for maintaining accurate payroll, workforce, patient, and accounting records and for correcting information in the appropriate system of record.
10.2 QuickBooks choices. Customers may limit future QuickBooks access by disconnecting the integration. A user may also manage connected apps through Intuit. Revoking access does not delete information already imported into RootsPayroll or transactions already written to QuickBooks.
10.3 Legal rights. Depending on residence and applicable law, an individual may have rights to request access, correction, deletion, portability, restriction, or objection; to appeal a decision; or to withdraw consent where processing relies on consent. Some information or contexts may be exempt, and we may retain information when permitted or required by law.
10.4 Requests involving Customer Data. If information was submitted by an employer, health-care provider, or other RootsPayroll customer, the individual should contact that organization first. We generally act on the customer’s instructions and will refer the request to the customer or assist it as required.
10.5 Verification and authorized agents. We may verify identity, authority, and the request’s relationship to a customer before responding. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and direct verification with the individual. We will not discriminate against an individual for exercising a privacy right.
11 Children and minors
RootsPayroll is a business service and is not directed to children for their own use. We do not knowingly create end-user accounts for children. A health-care customer may process information about minor patients or dependents as part of its operations. In that context, we process the information under the customer’s instructions and applicable agreements, and the parent, guardian, or other authorized person should direct requests to the customer.
12 Product pages communications and tracking
12.1 Product pages. A RootsPayroll product, documentation, or support page may collect basic request and security information needed to deliver the page, protect it, and understand service performance. RootsPayroll desktop software does not use browser advertising cookies.
12.2 Service communications. We may send administrative messages about accounts, security, support, transactions, maintenance, or policy changes. These are part of the service and may continue while an account or customer relationship remains active.
12.3 Marketing communications. If we send optional marketing communications, recipients may opt out using the method in the message. An opt-out does not stop operational, security, billing, or legal communications.
13 United States and international processing
13.1 Processing locations. Roblar is based in the United States. Information may be processed in the United States and other locations where authorized service providers or connected services operate. Privacy and data-protection laws in those locations may differ from those in the individual’s location.
13.2 International safeguards. Where applicable law requires a transfer mechanism or other safeguards for international transfers, we will use an appropriate mechanism. Customers are responsible for determining whether their use and instructions require additional contractual or regulatory measures.
13.3 Legal bases. Where a law requires a legal basis, our processing may be necessary to perform a contract or provide requested services, comply with law, protect legitimate interests in operating and securing RootsPayroll, or carry out instructions based on valid consent. The applicable basis depends on the purpose and context.
14 Changes to this Policy
We may update this Policy to reflect changes in RootsPayroll, connected services, law, or our privacy and security practices. We will post or provide the revised Policy with a new effective date. When required by law, we will give additional notice or obtain consent before a material change takes effect. Prior versions may be retained for reference.
15 Contact us
Privacy questions and requests may be submitted to Roblar Innovation LLC through the Help or Support function provided with RootsPayroll or through the privacy or support contact published on the RootsPayroll product page, customer order, or invoice. A request should identify the requester, organization, relationship to RootsPayroll, contact information, and the nature of the request. Do not include a Social Security number, password, OAuth token, full bank or payment-card number, or protected health information in an unsecured message.
Roblar Innovation LLC | RootsPayroll Privacy Policy | Version 1.0