Legal
Privacy policy
This policy explains what PayStub Desk collects when you create a pay stub, how long it is kept, who else sees it, and how to have it removed. Section 10 covers the emails we send to people who publish about payroll.
Effective October 17, 2026
1. What we collect
Pay stub data you type in. Employer and employee names and addresses, pay period dates, wages, hours, deductions and year-to-date figures. You choose what to enter, and the generator works with placeholder names if you prefer.
We never ask for a full Social Security number. The SSN field is optional and accepts only the last four digits, because that is all a pay stub displays. Anything longer is rejected by the form rather than stored.
Payment data: no card details. Your card is entered on Lemon Squeezy's own checkout, and no card or billing details of yours reach this site or anyone acting for us. What we store is an order identifier, the amount, the payment status, and when and how many times the paid file was downloaded, so that we can deliver the document and answer a refund request or a chargeback. The email address given at checkout is held by Lemon Squeezy and reaches us with each payment notice; we use it to send the download link and do not keep it in the order record.
Technical data. IP address, browser user agent and request timestamps appear in server logs. We use them to rate-limit PDF generation and investigate abuse, not to build a profile of you. Your browser may also send us a report when a script on one of our pages falls outside the security policy we are testing; the report names the page, the rule and the first characters of the script, nothing you typed, and goes to the same log.
Analytics. Aggregate usage events — a generator session started, a preview completed, a download taken. See section 5.
A withholding figure you tell us is wrong. If you use "My stub shows a different amount", we record the state, the tax year, the pay frequency, which line it was, our figure, your figure, the gross pay for the period and the filing status. Nothing else: no name, no address, no email, and nothing else you typed into the form. It goes to our own server log rather than to an analytics provider, we keep it for twelve months, and we use it to find errors in our tax tables. It does not change your document.
2. How long we keep it
- Generated PDFs and the data used to build them: 7 days free, 30 days paid. A free file is deleted automatically by a storage lifecycle rule seven days after it is created, and the pay stub content is removed from our records by a job that runs every night. A paid document, and the figures behind it, stay for 30 days from the payment, so that it can be corrected and downloaded again within that window. A download link is good for 24 hours. Once the window ends we cannot re-send or rebuild a document, so save your copy.
- Unfinished drafts: on your device only. The form autosaves to your browser's local storage so that a refresh does not lose your work. That draft never leaves your browser. Clearing site data removes it.
- Order records: retained after the document is deleted. We keep the order identifier, the amount, the status and the download times for accounting purposes and to answer chargebacks. The pay stub content is not part of that record.
- Analytics: events for one year, recordings for 30 days. Google Analytics 4 and PostHog keep the usage events described in section 5 for up to a year. A session recording, which exists only if you accepted it, is deleted by PostHog after 30 days.
- Server logs, security reports included: 30 days.
3. Why we process it
To produce the document you asked for, to take payment for it, to keep the service running and free of abuse, and to meet tax and accounting obligations. We do not sell personal information, and we do not use your pay stub data to train models or to advertise to you.
4. Who else sees it
- Lemon Squeezy — the merchant of record for the purchase: they sell the file to you, they handle the payment and any tax on it, and they hold the billing details entered at their checkout. What reaches us is that the payment succeeded, for how much, and the email address to deliver to.
- Google Cloud — hosts the application, the generated files and the order records, in United States regions.
- Google Analytics 4 — receives the usage events described in section 5.
- PostHog — receives the same usage events, the count of free pay stubs built and the purchase record described in section 5, and session recordings with every field masked and the document left out.
- Our email provider — delivers the download link to the address you gave at checkout.
We also disclose information where the law requires it. We do not share pay stub content with employers, lenders, landlords or anyone else, and we do not verify it to third parties.
5. Cookies and analytics
A banner asks before anything optional is set. Until you answer it, the only cookie stored is the one holding your answer, and Google Analytics 4 and PostHog set the cookies they use to tell one visit from the next only once you allow it. Declined, both still count events without a cookie and without storing anything else in your browser. Google Analytics then treats every visit as a new one. PostHog tells visitors apart one day at a time: its servers combine your IP address and browser details with a random key that changes every day, and use the resulting code in place of a cookie, so visits on the same day count as one visitor and a visit on another day as a new one. The pay stub you are working on is kept in your browser's local storage rather than in a cookie.
The events we send describe the shape of a session — generator started, preview completed, download pressed, download refused, checkout opened, purchase — and never carry the contents of your pay stub, names, addresses or the last four digits of an SSN. A refused download names the form field that stopped it, never what was typed into it. Page addresses are sent without their query string. Events for PostHog travel through our own server on the way, under the address /ingest on this site, and the server passes your IP address along so that the visit is placed in the right country rather than in our data centre and, if you declined cookies, so that PostHog can tell same-day visits apart as described above. PostHog keeps that IP address with every event it receives, whether or not you accepted cookies, for as long as it keeps the events (section 2).
Only if you accept, PostHog also records how the generator page is used, to find where the form is hard to fill in. Decline, and nothing is recorded at all: the recorder is never even loaded. In a recording every field is masked, and the pay stub itself and the heading that names the employee are left out entirely. After a purchase, the record of it — the order identifier, the amount and the address the payment was made under — is sent to PostHog from our server. If you accepted analytics cookies, it is joined to the session that opened the checkout. If you declined, it is not joined to your session, but the "checkout opened" event your browser sends carries the same order identifier, so we can tell that the checkout opened in that visit was paid for.
One count is not sent by your browser at all: when a free pay stub is built, our own server records that it happened, to PostHog only. It carries the state, the template, how many stubs were in the run and what that run would have cost — never your figures, and nothing that identifies you or joins the count to your session, so it says how many documents were made and never how many people made them.
You can change your answer at any time from the "Cookie preferences" link in the footer, and you can block the analytics your browser sends with a content blocker as well; the generator works without it. The server-side count above is the one thing a blocker does not stop, and it is why it carries nothing about you. We do not currently serve advertising, and this section will be updated before we do.
6. Your choices
- Ask us to delete a generated document before its window ends — seven days for a free document, 30 days from the payment for a paid one.
- Ask for a copy of the order record we hold about you.
- Clear your browser's site data to remove the local draft.
- Accept or decline analytics cookies, and change that answer whenever you like.
Write to support@paystubdesk.com and give the order identifier or the email address used at checkout, so that we can find the record.
7. California residents (CCPA/CPRA)
In the past twelve months we have collected these categories of personal information: identifiers (name, email address, IP address), commercial information (the order and its amount), internet activity (the page and event data described above), and — only if you choose to enter them — employment and compensation details about yourself or your employees.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past twelve months, and we do not knowingly collect information from anyone under 16.
You have the right to:
- know what we collect, use and disclose, and to receive a copy;
- have it deleted, subject to the records we must keep for tax and accounting;
- correct inaccurate personal information;
- limit the use of sensitive personal information;
- not be discriminated against for exercising any of these rights.
Send requests to support@paystubdesk.com with the subject line "California privacy request". We respond within 45 days and will say so if we need the further 45 days the statute allows. An authorized agent may act for you with written permission that we can verify. Because the service has no accounts, we verify a request by matching it against the email address or order identifier tied to the record.
8. Residents of other US states
Colorado, Connecticut, Virginia, Utah, Texas and a growing number of other states give residents comparable rights of access, correction, deletion and appeal. We handle those requests through the same address and on the same timelines.
9. Security
Traffic is encrypted in transit. Download links are signed and expire. Generated files sit in access-controlled storage and are deleted on schedule. No system is perfect, and a pay stub you download is yours to protect once it reaches your device.
10. Emails we send to people who publish about payroll
Now and then we write to someone whose published work touches on payroll: a payroll office that links its staff to calculators, the author of a review of pay stub tools, or a blog or law firm that writes about pay stub rules. If you received such an email, this section is about you.
Who writes and why. The email comes from PayStub Desk, the operator of this site. It tells you about one free resource here that we think fits a page you publish, and asks whether you would link to it. We send one email and at most one follow-up, and write again only if you reply. You can reach us by replying to it or at support@paystubdesk.com.
What we hold and where it comes from. Your name, your work email address, your role if the page gives it, and the page or organization where we found them; when we wrote to you and whether you replied; and the emails between us. We take your name, address and role from public pages published by your organization or by the site you write for.
Legal basis. Our legitimate interest in making our free resources known to people who publish about payroll, and in having them linked from pages where they fit (Article 6(1)(f) of the EU General Data Protection Regulation).
How long we keep it: six months. Whether or not you reply, we delete your details and our correspondence with you six months after the last message between us. The one exception is the do-not-contact list described below: an address on it is kept for as long as we send emails like these, because that is the only way to keep the promise not to write again.
Your rights. You have the right to object at any time: reply to the email ("no thanks" is enough) or write to support@paystubdesk.com. The email has no unsubscribe link; a message from you is how you tell us. We act on an objection as soon as we read it: we do not write to you again, and we delete what we hold about you, keeping only your email address on a list of people we must not contact. At the same addresses you can ask for a copy of what we hold about you, for its correction, for its deletion before the six months are up, or for us to restrict how we use it. If you think we have handled your details unlawfully, you can complain to a data protection supervisory authority, in particular in the EU country where you live or work or where you think the infringement took place.
Who else handles it. We do not sell these details or give them to anyone for their own use. They pass through the services that carry and store our email and our list: Zoho Mail sends our messages, our domain registrar Porkbun forwards your replies to us, and Google keeps the correspondence in our Gmail mailbox and our list of recipients in Google Sheets.
11. Changes
If this policy changes materially we update the effective date at the top and, where the change affects data we already hold, notify the email address on the affected orders.