Privacy Policy
This policy explains what personal information we collect, why, and what we do with it. It covers the Brawta website at brawta.app and the Brawta desktop application.
The short version. Your payroll data — your employees’ names, TRNs, salaries, deductions — is stored on your own device and is never sent to us. We cannot see it. We could not hand it over if we were asked to.
What we do collect is small and ordinary: what you type into the enquiry form on this website, and basic technical information created when any browser visits any website. If you switch on cloud backup or team seats, we also hold encrypted files we cannot read — alongside one identifier that is not encrypted, the client company’s TRN, which we set out plainly in section 4. All of it is below.
1. Who we are
Brawta is owned and operated by RKhan Investment Limited, a company registered in Jamaica (company number 106187). In this policy, “we”, “us” and “Brawta” mean RKhan Investment Limited.
For the information described in section 3 of this policy (what you send us through this website), we are the data controller.
Contact: WhatsApp (876) 848-9513. Any privacy question, request or complaint can be sent to that number and will be answered by a person, not a form.
2. Your payroll data never reaches us
This is the most important thing in this policy, so it comes first.
Brawta is a local-first desktop application. When you run payroll, everything you enter — employee names, TRNs, NIS numbers, addresses, salaries, deductions, pay history, filed returns — is written to a database on the computer you are sitting at. It is encrypted at rest using Windows’ own data-protection facility, and sensitive employee fields are additionally encrypted with AES-256-GCM.
None of it is transmitted to us. There is no Brawta account, no sign-in, and no server holding your books.
What that means under the Data Protection Act
Because your employees’ personal information stays with you, you are the data controller for it under Jamaica’s Data Protection Act, 2020 — exactly as you were before you installed Brawta, and exactly as you are for your paper files and spreadsheets. We are not a processor of that information, because we never receive it.
Your responsibilities as controller include keeping that information secure, keeping it accurate, keeping it no longer than you need it, and answering your own employees’ requests about it. Brawta gives you backup, restore and encryption tools to help; using them is your decision and your duty.
If you are an employee of a business that uses Brawta and you want to see, correct or ask about your payroll information, please contact your employer. They hold it; we do not, and we have no way to look it up.
3. What this website collects
3.1 The enquiry form
If you fill in the enquiry form on our home page, we receive what you typed:
- Your name and email address (both required — we need them to reply)
- Your WhatsApp number (optional)
- Roughly how many people you pay (a range you pick from a list)
- Anything you write in the message box (optional)
We use this only to reply to you and to follow up about Brawta. We do not sell it, rent it, or pass it to anyone for their own marketing. We do not add you to a bulk mailing list. If you would rather we deleted it, say so and we will.
Our form provider, Netlify, also records technical details alongside each submission: the IP address it was sent from, the browser user-agent string, the referring page, and the date and time. This is Netlify’s standard spam-prevention behaviour and it happens automatically. We do not use those details for anything else.
3.2 Website analytics
Every page of this website loads Cloudflare Web Analytics, which counts page views and tells us which pages people read and roughly where in the world they are. It is cookieless and does not fingerprint or track individual visitors across websites. We use it to understand which of our guides are useful, nothing more.
3.3 Fonts
Our pages load typefaces from Google Fonts. To serve them, Google receives your IP address and browser user-agent. We have no control over what Google does with that; their handling is governed by Google’s own privacy policy.
3.4 Cookies
We set no cookies and no advertising trackers of our own, and there is nothing on this site that follows you to other websites. That is why you have not been shown a cookie banner — there is nothing to consent to.
The in-browser demo (see below) uses your browser’s own local storage to hold the figures you type. That data stays in your browser and is never transmitted.
3.5 The in-browser demo
The demo at brawta.app/app runs entirely inside your browser. Any figures you enter are held in your browser’s local database and are never sent to us or to anyone else. Clearing your browser data deletes them. Please do not put real employee information into the demo — use the desktop application, which is built to protect it.
4. What the desktop application sends
The desktop application contacts the internet in four situations, and only these four. Two happen automatically; two only if you switch them on. It contains no analytics and no usage telemetry of any kind.
| When | Where it goes | What is sent |
|---|---|---|
| Checking for updates (automatic) |
GitHub | An ordinary download request. GitHub sees your IP address and user-agent, as any website would. We receive no report of who updated. |
| Refreshing statutory rates | GitHub | The same — it downloads a small signed file of current PAYE, NIS, NHT and Education Tax rates. Nothing about you is sent. |
| Cloud backup (off by default — you must switch it on) |
Cloudflare R2, via our own service | Encrypted data only. Your backup is encrypted on your machine before it leaves, and we hold only the ciphertext. We cannot read it, and neither can Cloudflare. If you lose your passphrase, we cannot recover your backup — that is the trade for us not being able to read it. |
| Team seats (only if you use multi-user features) |
Our own service on Cloudflare | An account reference, a seat identifier, the role, when the invitation was redeemed, a one-way hash of the spent invitation code, a coarse last-seen time, and whether the seat has been revoked. No employee names and no payroll figures — those travel encrypted between your own devices and our service never sees them. Your IP address is used momentarily to rate-limit abuse and is not stored. |
4.1 One identifier is not encrypted, and we would rather say so
We want to be precise about a point that the word “encrypted” could otherwise gloss over. The contents of your payroll are encrypted and unreadable to us. But the TRN of each client company is not — it is used to keep one set of books separate from another in storage, so it appears in file paths and in seat records, and it is visible to us.
A TRN normally identifies a business rather than a person. For a sole trader it can identify a person, because a sole trader files under their own TRN. We state this plainly rather than let “encrypted” imply more than it does.
4.2 Two things people expect on that list, which are not
- Emailed payslips. When Brawta emails a payslip, it connects directly from your computer to the mail server you configured, using your own credentials. The email and its attachment never pass through us.
- Sharing by WhatsApp. This opens WhatsApp on your own device with a message you send yourself. Nothing is routed through us.
5. Who else is involved
We use a small number of established service providers to run Brawta. They process information on our behalf, under their own security obligations:
- Netlify — hosts this website and receives enquiry-form submissions.
- Cloudflare — website analytics, and the storage that holds encrypted cloud backups and seat records.
- GitHub — distributes the installer, application updates and the statutory rates file.
- Google Fonts — serves typefaces to this website.
Some of these providers operate servers outside Jamaica, so information described in this policy may be processed abroad.
We do not sell personal information, and we never will. We will disclose information only where we are legally required to — for example under a court order — and we note again that this could never include your payroll data, because we do not have it.
6. How long we keep things
- Enquiry-form submissions — kept while we are in contact with you and for a reasonable period afterwards, so we can pick up the conversation. Ask us to delete yours at any time and we will.
- Analytics — retained by Cloudflare according to their own retention schedule; it is aggregate, not tied to you.
- Encrypted cloud backups — kept until you delete them or your account ends. They are unreadable to us throughout.
- Seat records — kept while the licence is active, so seats can be counted and revoked.
- Your payroll data — kept by you, on your machine, for as long as you keep it. Note that Jamaican law requires employers to retain payroll records for a period; check that before you delete anything.
7. Your rights
Under Jamaica’s Data Protection Act, 2020, you have rights over personal information we hold about you. These include the right to ask what we hold, to have it corrected if it is wrong, to ask us to delete it, and to object to us using it — including telling us to stop contacting you.
To exercise any of these, message (876) 848-9513. We will not charge you and we will respond as quickly as we reasonably can.
If you are not satisfied with how we have handled a privacy matter, you may complain to Jamaica’s Office of the Information Commissioner.
8. Security
On your machine, Brawta encrypts its database at rest and applies field-level AES-256-GCM encryption to sensitive employee details, with an idle auto-lock. Backups you create with a passphrase are encrypted with that passphrase. Cloud backups are encrypted before they leave your device.
On our side, the information in section 3 is held by the providers named in section 5 under their own security controls.
No system is perfectly secure, and we will not pretend otherwise. What we can say precisely is that the most sensitive information in this picture — your employees’ pay — is not in our custody at all.
9. Children
Brawta is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 18 through this website.
10. Changes to this policy
If we change how we handle personal information, we will update this page and change the effective date at the top. Material changes will be pointed out on the website rather than made quietly.
11. Contact
Privacy questions, access requests, deletion requests, or complaints: WhatsApp (876) 848-9513.
Brawta is owned and operated by RKhan Investment Limited, registered in Jamaica, company number 106187.
See also our End User Licence Agreement.