Privacy policy

1. What we collect

Pay stub data you type in. Employer and employee names and addresses, pay period dates, wages, hours, deductions and year-to-date figures. You choose what to enter, and the generator works with placeholder names if you prefer.

We never ask for a full Social Security number. The SSN field is optional and accepts only the last four digits, because that is all a pay stub displays. Anything longer is rejected by the form rather than stored.

Payment data: no card details. Your card is entered on Lemon Squeezy's own checkout, and no card or billing details of yours reach this site or anyone acting for us. What we store is an order identifier, the amount, the payment status and the email address given at checkout, so that we can deliver the document and handle refunds.

Technical data. IP address, browser user agent and request timestamps appear in server logs. We use them to rate-limit PDF generation and investigate abuse, not to build a profile of you. Your browser may also send us a report when a script on one of our pages falls outside the security policy we are testing; the report names the page, the rule and the first characters of the script, nothing you typed, and goes to the same log.

Analytics. Aggregate usage events — a generator session started, a preview completed, a download taken. See section 5.

A withholding figure you tell us is wrong. If you use "My stub shows a different amount", we record the state, the tax year, the pay frequency, which line it was, our figure, your figure, the gross pay for the period and the filing status. Nothing else: no name, no address, no email, and nothing else you typed into the form. It goes to our own server log rather than to an analytics provider, we keep it for twelve months, and we use it to find errors in our tax tables. It does not change your document.

2. How long we keep it

• Generated PDFs and the data used to build them: 7 days free, 30 days paid. A free file is deleted automatically by a storage lifecycle rule seven days after it is created, and the pay stub content is removed from our records by a job that runs every night. A paid document, and the figures behind it, stay for 30 days from the payment, so that it can be corrected and downloaded again within that window. A download link is good for 24 hours. Once the window ends we cannot re-send or rebuild a document, so save your copy.
• Unfinished drafts: on your device only. The form autosaves to your browser's local storage so that a refresh does not lose your work. That draft never leaves your browser. Clearing site data removes it.
• Order records: retained after the document is deleted. We keep the order identifier, the amount and the status for accounting purposes, and the billing email for chargebacks. The pay stub content is not part of that record.
• Analytics: events for one year, recordings for 30 days. Google Analytics 4 and PostHog keep the usage events described in section 5 for up to a year. A session recording, which exists only if you accepted it, is deleted by PostHog after 30 days.
• Server logs, security reports included: 30 days.

3. Why we process it

To produce the document you asked for, to take payment for it, to keep the service running and free of abuse, and to meet tax and accounting obligations. We do not sell personal information, and we do not use your pay stub data to train models or to advertise to you.

4. Who else sees it

• Lemon Squeezy — the merchant of record for the purchase: they sell the file to you, they handle the payment and any tax on it, and they hold the billing details entered at their checkout. What reaches us is that the payment succeeded, for how much, and the email address to deliver to.
• Google Cloud — hosts the application, the generated files and the order records, in United States regions.
• Google Analytics 4 — receives the usage events described in section 5.
• PostHog — receives the same usage events, the purchase record described in section 5, and session recordings with every field masked and the document left out.
• Our email provider — delivers the download link to the address you gave at checkout.

We also disclose information where the law requires it. We do not share pay stub content with employers, lenders, landlords or anyone else, and we do not verify it to third parties.

5. Cookies and analytics

A banner asks before anything optional is set. Until you answer it, the only cookie stored is the one holding your answer, and Google Analytics 4 and PostHog set the cookies they use to tell one visit from the next only once you allow it. Declined, both still count events without a cookie, so a returning visitor looks like a new one. The pay stub you are working on is kept in your browser's local storage rather than in a cookie.

The events we send describe the shape of a session — generator started, preview completed, checkout opened, purchase, free download — and never carry the contents of your pay stub, names, addresses or the last four digits of an SSN. Page addresses are sent without their query string. Events for PostHog travel through our own server on the way, under the address /ingest on this site, and the server passes your IP address along so that the visit is placed in the right country rather than in our data centre.

Only if you accept, PostHog also records how the generator page is used, to find where the form is hard to fill in. Decline, and nothing is recorded at all: the recorder is never even loaded. In a recording every field is masked, and the pay stub itself and the heading that names the employee are left out entirely. After a purchase, the record of it — the order identifier, the amount and the address the payment was made under — is sent to PostHog from our server and joined to the session that opened the checkout.

You can change your answer at any time from the "Cookie preferences" link in the footer, and you can block analytics with a content blocker as well; the generator works without it. We do not currently serve advertising, and this section will be updated before we do.

6. Your choices

• Ask us to delete a generated document before its window ends — seven days for a free document, 30 days from the payment for a paid one.
• Ask for a copy of the order record we hold about you.
• Clear your browser's site data to remove the local draft.
• Accept or decline analytics cookies, and change that answer whenever you like.

Write to support@paystubdesk.com and give the order identifier or the email address used at checkout, so that we can find the record.

7. California residents (CCPA/CPRA)

In the past twelve months we have collected these categories of personal information: identifiers (name, email address, IP address), commercial information (the order and its amount), internet activity (the page and event data described above), and — only if you choose to enter them — employment and compensation details about yourself or your employees.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past twelve months, and we do not knowingly collect information from anyone under 16.

You have the right to:

• know what we collect, use and disclose, and to receive a copy;
• have it deleted, subject to the records we must keep for tax and accounting;
• correct inaccurate personal information;
• limit the use of sensitive personal information;
• not be discriminated against for exercising any of these rights.

Send requests to support@paystubdesk.com with the subject line "California privacy request". We respond within 45 days and will say so if we need the further 45 days the statute allows. An authorized agent may act for you with written permission that we can verify. Because the service has no accounts, we verify a request by matching it against the email address or order identifier tied to the record.

8. Residents of other US states

Colorado, Connecticut, Virginia, Utah, Texas and a growing number of other states give residents comparable rights of access, correction, deletion and appeal. We handle those requests through the same address and on the same timelines.

9. Security

Traffic is encrypted in transit. Download links are signed and expire. Generated files sit in access-controlled storage and are deleted on schedule. No system is perfect, and a pay stub you download is yours to protect once it reaches your device.

10. Changes

If this policy changes materially we update the effective date at the top and, where the change affects data we already hold, notify the email address on the affected orders.

11. Contact

support@paystubdesk.com