The payroll data is controlled jointly by Ville Poikolainen and Henna Poikolainen, as joint data controllers under a written agreement between them. They run the app. Privacy questions: privacy@poikolainen.me, or the form below.
The employee is employed jointly by four households (the co-employers) under a written employer ring agreement. By a power of attorney signed by all four, Ville Poikolainen and Henna Poikolainen together handle for them the payment of the salary and its duties (such as pension contributions and income register reports), the insurance and the occupational health care. In the app the other households review the extra hours, confirm absences and accept vacation requests.
Payroll data in the households' own Excel workbooks: hours, salary, deductions, vacations, leave, sick days, the weekly working plan, payslips, the costs paid from the payroll account beside the salaries and each household's share of them, and the employee's tax card rates (she enters them, or the app reads them from the tax card PDF on her iPhone).
Sign-in: the email and account ID of the Microsoft account or Apple ID (with Sign in with Apple, the email may be a private relay address) of each person given access, or their email when they sign in with a code sent to it, and which of these are linked to the same person.
Agreements: the signed employment agreement and any other agreement kept in the payroll folder. The app shows them to the employer households and the administrators, and the employment agreement to the employee, each behind Face ID or the device passcode. An administrator can add an agreement from the app; it is saved in the payroll folder like the others, and the app keeps no other copy.
Email: the address each person chooses for payslips, notices and alerts, and any other address they verified with a code. Emails are sent from no-reply@payroll.poikolainen.me.
With the account holder's consent, transactions of the bank account used for the payroll, read through Enable Banking: amount, date, payer or payee with their account, reference and message.
For notifications, the device's push token. Messages typed in the app's chat are understood on the iPhone itself (Apple Intelligence) and aren't sent anywhere; dictation is recognised on the iPhone where it can be, and Finnish or Filipino speech may go to Apple to be recognised. What they lead to is saved only when you confirm it.
To keep the app working: when each person last used it and on how many days of the last 30, the app version, iOS version and device model, and errors the app or service ran into (with email addresses masked).
Sick days are recorded without any reason or diagnosis.
Who changed what: each change in the workbooks records the email address of the person who made it, their IP address and the time, to protect the security and integrity of the payroll data.
Salary reviews: the salary an administrator proposes for the coming year, what it's based on and a link to the collective agreement, and each household's approval or note. An approved salary goes into the workbooks, with its decision on their Salary history sheet.
To pay the employee and give her payslips: the employment contract, and the employers’ legal duties on salary, tax withholding and pension insurance.
To keep the payroll and accounting records, including who changed what: the employers’ legal duty to keep records, and their legitimate interest in a record that can be trusted and protected.
Sick days (dates only, never a reason or a certificate): the employers’ obligations under employment law.
To check that the payments were made and the households’ shares came in, using the bank data: the consent of the account holder, which can be withdrawn at any time.
To let only the right people in, keep the app secure and working, and see how it is used: the legitimate interest of the employers in a secure and working payroll.
Notifications: your own choice in the iPhone’s notification settings.
The workbooks stay in the households’ OneDrive and are the record. Each year’s workbook is kept for ten years from the end of the year in which the wages were paid, and in any case for at least two years after the employment ends, which covers the longest periods the law sets for an employer’s pay records, corrections to the income register and claims arising from the employment. A copy of each workbook is saved monthly in the payroll’s Azure storage as a backup; copies older than two years are deleted automatically. The payroll account’s transactions are kept as monthly statements in the same OneDrive folder, in the bank’s own export format, as accounting records.
Sign-ins, chosen email addresses, notification devices and app use are kept in the payroll’s Azure Key Vault until the person deletes their account in the app or an admin removes their access. Use of the app covers the last 30 days; errors and the service’s request logs are kept for 30 days. Codes sent by email expire within 30 minutes, invite codes after 14 days. Bank access ends when the consent expires or is withdrawn.
Who has access is decided by the households, so a person stays on the access list until an admin removes them.
The entries of who changed what are part of the payroll record and stay with it: if you delete your account, your email address and IP address stay in the entries made before.
Salary reviews (the latest 20) are kept in the same Key Vault; their outcome stays in the workbooks.
Nobody outside the households and the employee, except the services the app runs on: Microsoft (sign-in, OneDrive, Azure, email), Apple (Sign in with Apple, notifications, speech recognition for dictation, the App Store and TestFlight) and Enable Banking (bank access).
To look up the collective agreement's published pay tables or the year's published pension (TyEL) rates, an administrator can open ChatGPT, Claude or Gemini with a question ready. The question holds only figures published by the agreement's parties and the authorities, nothing about the people in the payroll, and the assistant is used under the administrator's own account.
The app’s backend, its secrets vault, its storage, its backups and its logs are all hosted in Microsoft Azure in Sweden (the Sweden Central region).
The payroll workbooks are kept in the controllers’ personal Microsoft OneDrive. Microsoft does not publish a data centre region for personal OneDrive accounts.
In any case, Microsoft and Apple apply the EU’s standard contractual clauses to any transfer of data outside the EEA.
While the app is developed, its developer uses an AI coding assistant under an enterprise agreement. It works on anonymised or made-up payroll data, and the provider does not use the content to train models.
You can see your data in the app and in the workbooks, ask to correct it, withdraw the bank consent at any time, and delete your account in the app (Settings → Delete my account): your sign-ins, notification devices, email choices and use of the app are deleted at once and you are signed out everywhere. Payroll records the law requires the employer to keep are kept. To be removed from the access list, ask an admin.
You can also ask for the processing of your data to be restricted, object to processing that rests on a legitimate interest, receive the data you gave in a usable format, and withdraw a consent at any time. No decision about you is made by automated means: the app’s assistant only pre-fills entries that a person confirms.
You can also write to privacy@poikolainen.me or use the form below, or complain to the Data Protection Ombudsman (tietosuoja.fi).
Questions about your data, or a request to see, correct or remove it: write here. The payroll administrators answer by email.
Last updated 2 November 2026.