Privacy

What Tip Reserve reads from Clover

Tip Reserve connects to a single Clover merchant through a read-only integration and reads five things: the merchant profile (business name, timezone, and closeout time, so figures land on the right business day); the employee list (to build the roster and match tips to the person who earned them); payments and their tips (to compute the nightly card-tip total and the set-aside for each employee); shift records (to calculate hours worked, for the wage-floor check); and orders (only to identify service charges and auto-gratuities, which are wages, not tips, and are excluded from every tip figure).

Every one of these is read only. Tip Reserve never writes anything back to Clover, and it cannot see anything beyond the scopes the merchant granted when they connected.

What Tip Reserve stores

Employee names and the contact information the owner enters for them (a phone number, an email address, or both); each business day's tip and set-aside figures per employee; standing tax-set-aside authorizations, together with the evidence of how each one was signed (a typed name, a timestamp, and either the device used or the manager who witnessed it); day records and pay-period records; and the access log those authorizations and confirmations are written to.

Tip and pay records are retained for seven years, matching federal employment-tax recordkeeping rules. They are not deleted when a merchant disconnects Clover.

What Tip Reserve never stores

Tip Reserve never stores card numbers or any other card data, not even the last four digits. It does not collect a Social Security number by default; if a merchant's own accountant later requires one for a specific statement, it is entered deliberately, encrypted, and never shown as more than its last four digits.

What Tip Reserve never does

Tip Reserve never moves money. It only computes figures and produces instructions; the owner and their payroll provider are the ones who move money. It never writes anything back to Clover, and it never sells data. Nothing here is sent automatically to any outside company: the owner may export payroll figures from Tip Reserve into their own payroll provider by hand, and each employee can see exactly which figures appear on their own statement.

Who can see the numbers

Each employee's set-aside figures are visible only to that employee and to the managers at the business where they work. No other employee sees them, and no outside party is given access to them.

The set-aside itself is money an employee furnishes toward their own tax, under a signed, standing authorization; see the Terms for the full description of how that authorization works and how to revoke it.

Ending Clover access

The owner can disconnect Tip Reserve from Clover at any time, either from Clover's own app dashboard or by asking secondledger to disconnect it. Disconnecting stops all new reading of Clover data immediately; records already stored remain under the retention period above.

Contact

Questions about this page, or about a specific employee's or merchant's data, can be sent to privacy@secondledger.io.