ERP Star is operated by MSNW Group, LLC (“we”, “us”). It is business software for facility services companies: timekeeping, payroll preparation, job costing, invoicing and financial reporting. This policy explains what it collects, why, and what we do not do with it.
ERP Star is not a consumer product. It is used by employees and administrators of companies that have an account with us, in the course of their work.
Information we collect
- Employee and payroll records. Names, employee numbers, pay rates, hours worked, job assignments, time off and related records, entered by an employer or imported from their existing systems.
- Timekeeping and location. When a worker clocks in or out on a phone, we record the time, the job or site, the device’s reported position and its stated accuracy, and whether a posted site tag was scanned. Position is recorded only at the moment of a punch. We do not track location between punches, and there is no background location collection.
- Device and sign-in data. A random token generated on the device, stored only as a hash, plus a coarse label such as “iPhone · Safari”. Passwords and PINs are stored only as hashes and cannot be read back by anyone, including us.
- Customer and financial records. Customers, properties, contracts, work orders, invoices, vendor bills and general ledger entries belonging to the employer.
- Usage records. Which pages an account opened and when, and sign-in events, kept so an employer can audit access to their own data.
QuickBooks Online
Where a company connects its QuickBooks Online account, we read a limited set of accounting data through Intuit’s official API, using credentials that company authorises and can revoke at any time from within QuickBooks or from ERP Star.
- What we read. Company information, the chart of accounts, and Profit and Loss reports.
- Why. QuickBooks holds general ledger and overhead figures that the company’s other systems do not. We use them to produce that company’s own internal financial reports inside ERP Star.
- How it is stored. In our database, isolated to that company’s account by row-level security, in the same way as the rest of their data.
- What we do not do. We do not sell QuickBooks data, share it with third parties for their own purposes, use it for advertising, or use it to train machine learning models. It is used only to serve the company it came from.
- Disconnecting. Revoking the connection stops all further access immediately. On request to the address below, we will delete the data already retrieved.
Other connected systems
With a company’s authorisation, ERP Star also exchanges data with Aspire (field operations), Paylocity (payroll) and Fleetio (fleet). It also reads publicly published county assessor records for property research. Each connection is optional and carries only the data needed for the function it serves.
How we protect it
- Each company’s data is isolated at the database level by row-level security, so a query made for one company cannot return another company’s rows.
- Traffic is encrypted in transit.
- Passwords, PINs, device tokens and site tag codes are stored only as hashes.
- Sign-ins are rate limited and lock after repeated failures.
- Changes to records are written to an append-only audit log with a hash chain, so an alteration to the history is detectable.
- Sessions expire, and an administrator can revoke access immediately.
- Data is hosted on Amazon Web Services in the United States (Ohio region).
No system is perfectly secure, and we do not claim otherwise. We hold no third-party security certification at this time.
Sharing
We do not sell personal information. We do not share it for advertising. We share it only with the infrastructure and integration providers needed to run the service, with the employer whose records they are, and where the law requires it.
Retention
Business records are retained for as long as the employer’s account is active, and afterwards for as long as employment, tax and accounting law requires. Location readings attached to punches are kept with the timekeeping record they belong to.
Your choices
If you are an employee of a company using ERP Star, that company controls your records. Ask them first, and they can act directly. You can also contact us at the address below and we will help, or pass the request to your employer where the law makes them responsible for answering it.
Location can be switched off on the device. Clocking in still works with location off; the punch is simply recorded as unconfirmed.
Children
ERP Star is not directed at children and we do not knowingly collect their information.
Changes
If this policy changes materially we will update the date at the top and notify account administrators.
Contact
MSNW Group, LLC
[email protected]