Kosechapp™
Privacy Policy
1. Who We Are
Kosechapp is the payroll and field-operations platform of Syndek Corp, a California corporation, doing business as Kosechapp ("Kosechapp," "we," "our," or "us"). We serve agricultural businesses in California. We provide payroll processing, tax withholding calculation, new-hire onboarding, crew time tracking, job costing, invoicing, and related back-office services through our software and staff.
2. Information We Collect
We collect only what is necessary to run payroll, meet federal and California requirements, and provide the services:
From employers and contractors (our clients):
- Business name, Employer Identification Number (EIN), and California employer payroll tax account number
- Contact information for authorized users (name, email, phone)
- Workers' compensation policy details, classification codes, and rates
- Bank account details used for paycheck printing (stored encrypted)
- Business records the client chooses to keep in Kosechapp: expense records and receipt images, equipment/asset records and purchase documents, invoices, and job-cost data
From workers — provided by the employer, or entered directly by the worker through Kosechapp's electronic onboarding:
- Full legal name, home address, phone, and Social Security Number
- Federal W-4 and California DE 4 withholding elections
- Electronic signature record for those elections: the typed legal name, date and time of signing, the network (IP) address used, and language preference
- Employment details: hire date, pay rate, job classification, workers' compensation class
- Work records: hours, work dates, ranches/locations, tasks, and production data (such as piece counts or harvest weights) recorded by the crew's foreman or through Kosechapp Time
- Sick-leave accrual and usage balances
- Signed W-4 / DE 4 forms — whether uploaded by the employer or generated by Kosechapp from the worker's electronic onboarding — stored encrypted
What we deliberately do not collect: Kosechapp does not accept or store I-9 forms or identity documents (IDs, Social Security cards, passports). Our onboarding collects tax-withholding information only.
Usage and technical data: login timestamps and IP addresses (for security), browser and device information.
3. Electronic Onboarding and Signatures
New hires may complete their own W-4 and California DE 4 elections on a device handed to them in the field or office, in English or Spanish. The worker signs by typing their legal name after being shown the applicable federal and state perjury statements. Kosechapp generates the official IRS and EDD forms from those entries and retains them (encrypted) so they can be reproduced for the worker, the employer, or a tax authority on request. The signature record (typed name, timestamp, IP address) is retained with the form.
4. How We Use Information
- Calculate wages — regular, California overtime and double-time, piece-rate, and sick pay
- Calculate federal and California withholdings, employer payroll taxes (Social Security, Medicare, FUTA, SUI, ETT), and workers' compensation premium calculations
- Prepare tax deposits and payroll tax filings — the applicable federal and California employment tax returns, wage reports, and year-end wage statements — from processed payroll
- Generate pay stubs, paychecks, and payroll records
- Provide the employer's own reporting: job costs by ranch/crop, invoicing, expense and asset records
- Send transactional messages (account invitations, password resets, operational digests) — we do not send marketing to workers
- Secure accounts, detect unauthorized access, and keep audit records
- Meet federal and California recordkeeping obligations
5. How We Share Information
We do not sell personal information. Ever.
Service providers: Kosechapp runs on Amazon Web Services (AWS). Application data, encrypted documents, and generated PDFs are stored in private, encrypted AWS storage; transactional email is delivered through AWS. AWS processes data on our behalf under its data processing terms.
Intuit (QuickBooks Online): if your business chooses to connect QuickBooks (Section 6), Kosechapp exchanges data with Intuit Inc. as directed by you — currently limited to reading your chart of accounts and company profile. Intuit processes that data under its own terms and privacy statement.
Your employer: if you are a worker, payroll and time data about you is available to the employer who engaged Kosechapp — that is the purpose of the service. Sensitive identifiers are not shown to field users: Social Security numbers appear to employer-side users only as the last four digits.
Kosechapp staff: access sensitive data only for payroll processing and support, under least-privilege access controls with multi-factor authentication, and every access to a Social Security number or bank detail is logged.
Legal requirements: we disclose information when required by law or lawful request from tax authorities (IRS, California EDD) or other government agencies.
6. QuickBooks Online Integration
If your business connects its QuickBooks Online account, Kosechapp accesses that account only with your explicit authorization through Intuit's secure sign-in (OAuth) — we never see or store your QuickBooks password. Today, Kosechapp reads two things from a connected account: your chart of accounts (account names, numbers, and types — used so you can choose which accounts your totals will correspond to) and your QuickBooks company profile (company name and settings). Kosechapp does not read your transactions.
Posting to your books: the purpose of the integration is for Kosechapp to write summarized accounting entries — payroll, expense, and invoice summaries — into your QuickBooks company, following an account mapping that you or your accountant configure and approve first. This posting capability is being rolled out; until it is enabled for your account, Kosechapp does not write anything to your books. Posting will never occur without a configured mapping, and only ever with summarized totals derived from data your business approved — never raw worker records, and never Social Security numbers or bank details.
A note on permissions: Intuit grants accounting access as a single combined permission that includes both read and write; Kosechapp currently exercises only the reads described above. We keep a copy of your chart of accounts (never transactions) while your account is connected so screens load without calling Intuit each time; it is deleted when you disconnect. The access tokens Intuit issues are stored encrypted so that only Kosechapp's payroll system can read them — the employer-facing and field-facing applications cannot access stored tokens. Every completed connection, disconnection, and account-mapping change is recorded in an audit log. You can revoke Kosechapp's access at any time from your Intuit account's connected-apps page, or by asking us; revocation stops all further access. Data you share with Intuit is governed by Intuit's own terms and privacy statement.
7. Data Retention and Disposal
Payroll and employment records are retained for at least four (4) years as required by federal and California law; certain evidentiary records are kept up to seven (7) years under our internal retention schedule.
When retention periods lapse, sensitive identifiers (such as the recoverable form of a Social Security number) are permanently destroyed on a documented disposal schedule with an auditable disposal log. Records subject to litigation or audit holds are preserved until the hold is released. Nothing is destroyed automatically — every disposal is human-reviewed.
You may request deletion of personal data not subject to legal retention through the "Delete my data" page at time.kosechapp.com/legal/delete-my-data or by emailing info@kosechapp.com.
8. Security
- Social Security numbers and bank details are encrypted at rest with field-level encryption; they are never stored in plain text
- Tax documents (W-4 / DE 4) are encrypted such that only Kosechapp's payroll system can decrypt them — the employer-facing and field-facing applications cannot read them, even in the event of an application flaw, because the database itself denies them access
- Multi-factor authentication is required for Kosechapp staff, with step-up verification to view any Social Security number or bank detail — and every such access is written to an append-only audit log
- Encrypted disks, HTTPS everywhere, hardened session controls, automatic lockouts on repeated failed logins, and continuous security monitoring with alerting
- Daily encrypted backups, a written incident-response procedure, and a documented information security program
No method of storage or transmission is 100% secure; we cannot guarantee absolute security.
9. Text Messages (SMS)
With their consent, we send workers transactional text messages only: account-invitation links and one-time security codes (sign-in and password reset). Consent is collected from the individual — when they request a text from their employer's office (the confirmation is recorded), or by requesting a sign-in code themselves on the worker-portal sign-in screen; message frequency varies with account activity; message and data rates may apply; reply STOP to any message to cancel or HELP for help. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are never shared with any third party. Full program details: kosechapp.com/sms.
10. California Privacy Rights (CCPA/CPRA)
California residents have the right to know what personal information we hold, to correct it, to request deletion (subject to legal retention), and to non-discrimination for exercising these rights. Contact us as described in Section 13. Because Kosechapp processes most worker information as a service provider under contract with the employer — to run legally required payroll — some requests may need to be directed to, or completed with, your employer. We do not sell or “share” personal information as those terms are defined by the CCPA/CPRA, so there is no sale or sharing to opt out of.
11. Children's Privacy
Kosechapp's services are directed to businesses, not children. Where a client lawfully employs workers under 18, Kosechapp processes their payroll information solely as the employer's service provider, as it does for all workers. We do not knowingly collect personal information directly from children under 13, and our services are not directed to them.
12. Changes to This Policy
We may update this policy from time to time and will notify affected parties of material changes by email or through the platform. Continued use after notice constitutes acceptance.
13. Contact Us
Syndek Corp d/b/a Kosechapp
Email: info@kosechapp.com