Privacy for contractors

What we hold about people we pay, and why

This page is for people we pay.

Contractors, and staff who are paid through the panel. If you are a customer, the customer notice is the one that applies to you — it is a different relationship and we hold different things.

Who we are

Misschevious Development, trading as Misschevious Marketplace, a sole trader in the United States. We are the controller of the data on this page. Contact us at privacy@misscheviousmarketplace.com.

What we hold

Your payment record

The name we call you day to day, your legal name exactly as it appears on your W-9, your entity type, your email, and your postal address. Plus the last four digits of your tax identifier, the date we received your W-9, and a note of where the signed W-9 itself is kept.

We never store a complete tax number.

Only the last four digits go in the database. The full number is on the signed W-9, which is held outside this system and is only needed once a year, at filing. A database of complete tax numbers is a different category of risk from anything else we hold, and we decided not to build one.

You enter these yourself, in your own account. That exists so nobody has to send a legal name, a home address and a tax number through a chat message.

What we paid you

Each payment: the date, the amount, what it was for, the category it falls under, any note attached, and which of us recorded it. Your payee record is linked to those rows so the year's total is per person rather than one undifferentiated number.

Your login, if you have one

If you have a staff account: your username, a hash of your password — never the password — your authenticator secret, when you last signed in, and failed sign-in counts. Signing in creates a session record holding the IP address and browser you signed in from. Staff sessions expire after 12 hours and are deleted within an hour of expiring.

Why we hold it, and on what basis

To pay you. Performing our agreement with you.
To meet US tax law. Anyone we pay $600 or more in a calendar year needs a 1099-NEC, and that form requires a legal name, an address and a tax identifier. This is a legal obligation, not a choice.
To keep the books. Our legitimate interest in accurate accounts and in being able to answer a tax authority.
To secure the account. Where you have a login.

Who else sees it

The IRS, on a 1099-NEC, if we pay you $600 or more in a year.
ZAP Hosting — the server this runs on.
Cloudflare — DNS and the tunnel in front of the site.
Fastmail — our mailbox, if you email us.
An accountant or tax preparer, if we engage one to file.

That is the whole list. We do not sell your data, we do not share it for marketing, and this system sends you no email at all. The only other disclosure is a valid legal obligation.

How long we keep it

Seven years, because that is how long US tax and accounting records have to be available. Nothing deletes them automatically once that has passed — if you want your record reviewed after seven years, ask and we will.

When we stop working together your record is marked archived rather than deleted. The payments you were already paid still have to be accounted for.

Your rights

Access, rectification, erasure, restriction, portability and objection, plus the California equivalents. We apply them to everyone wherever you live.

Erasure has a real limit here, and we would rather say so than promise otherwise: while a tax record is inside its seven years, we cannot delete it, because we are required to hold it. We can correct anything wrong in it, and we can delete anything not needed for that purpose.

To use any of these, email privacy@misscheviousmarketplace.com. We answer within 30 days. If we cannot do what you asked, we tell you why. You can also complain to your data protection authority.

How it is protected

Only the owner can see or edit the full payee list. Other staff can enter and see their own payment details, and nobody else's.
Passwords are hashed; staff accounts require an authenticator app.
Sessions are HttpOnly, SameSite=Lax, Secure over HTTPS, and expire in 12 hours.
No complete tax identifier is stored, so there is none to lose.

Changes

If this notice changes materially we will tell you directly, because there are few enough of you that posting it somewhere would not be good enough.

Last updated: 30 August 2026.