What happens to your payslip.

Short version: your payslip is processed in memory, personal details are removed where we can, it is sent to an AI provider for analysis and then discarded. We keep no copy, no account and no profile. Last updated: 26 October 2026.

1. Who is responsible

The data controller is [Your full name], [address], Luxembourg. Contact: hello@payslop.com. (Replace these placeholders before going live.)

2. What we process and why

Your payslip (when you upload one)

• What: the file you upload and the text and numbers on it, which can include your name, employer, salary, deductions, tax class, national identification number and bank details. A payslip can also reveal health information (sick leave), trade-union membership (union dues) or religion (church tax). These are special categories of data under GDPR art. 9.
• Why and on what basis: to produce the explanation and checks you asked for. Legal basis: performance of the service you request (GDPR art. 6(1)(b)) and, for special categories, your explicit consent (art. 9(2)(a)), given with the consent box before each upload. We record which version of the consent wording was accepted together with the anonymous usage counters below, never who accepted it.
• Withdrawing consent: use “Withdraw” next to the consent box, or simply stop uploading. Because we keep no copy of your payslip, there is nothing left to delete afterwards; withdrawal does not affect analyses already delivered.
• How: the file is held in server memory only. Photos are re-encoded, which strips embedded metadata such as GPS position. For PDFs with a text layer (exports from HR portals and payroll software), your name, identification numbers (social security, tax and staff numbers), bank details, e-mail and street address are located and blacked out on our server, and the day and month of your birth date are removed (the year is kept, because some rules depend on age). Only these redacted page images and the redacted text are sent to Anthropic's API (section 4); the original PDF is not. Scanned PDFs and photos cannot be redacted automatically: you can black out details on a photo on your own device before uploading with “Hide personal details”. The file is dropped as soon as the result is produced. It is never written to disk, logged or backed up.
• The result is sent to your browser and stays there (in the tab's session storage) until you close the tab or press “Delete everything”. An encrypted copy of the result is also kept in your browser so that questions, comparisons and Plus can work without uploading again; only our server can read it, and it expires after 48 hours.
• Masking: the AI is instructed not to repeat your name, identifiers or bank details and never to comment on health, union membership or religion; our server masks IBAN and national ID patterns in the result as a second safeguard.

Details you add for Plus and questions

If you use Plus or ask a question, the details you type (job title, years of experience, sector, country of residence, household, number of children, the optional note, your question) are sent with the encrypted result to Anthropic to produce the answer, and are not stored by us. Please do not write health or other sensitive details in the note or in questions. Legal basis: performance of the service you request (art. 6(1)(b)).

Rules research

Before decoding, we look up the statutory payroll rules of the country and year of your document with Anthropic's web search tool. These searches contain only the country name and the year; for the Plus salary benchmark they also contain the job title, sector and experience band you entered. They never contain your document, your name, your employer or any amount. The notes and source links we obtain are general information, shared by everyone who decodes a payslip from the same country and year, and are deleted after 14 days at the latest.

Anonymous usage counters

For each decode we store: timestamp, detected country, output language, model used, number of pages, token counts, number of web searches, duration, outcome (success, not a payslip, error) and the version of the consent wording. No amounts, names, IP addresses or file content, so a counter cannot be linked to you. Purpose: running the service and keeping its costs under control.

Interest in Plus (while it is not on sale)

Plus is not on sale yet. While we test whether people want it, the result page shows its prices, and we count how often the Plus offer is displayed and which option is chosen. Each count holds only the day, the event (shown or chosen), the option, the country of the payslip, the type of Plus report for that country and the page language. No IP address, no identifier, no exact time and no cookie are stored, so these counts are not personal data. Choosing an option charges nothing.

Payments (once Plus is on sale)

Payments will be handled by Stripe. We never see your card number. We will store the Stripe session reference, the plan bought, the amount, the pass code and how many reports remain on it, but not your name or e-mail address: Stripe holds them as the payment provider and prints your pass code on its receipt so you can recover it without an account. Legal basis: contract and legal accounting obligations. Retention: 10 years for accounting records as required by Luxembourg law.

Waitlist and professional contact form

If you leave your e-mail address on the waitlist, we store it with the country you selected and the page it came from, to send you one message when something ships. Legal basis: consent (art. 6(1)(a)). If you use the form for professionals, we store your e-mail, company, role, company size and message to reply and to contact you about the pilot. Legal basis: steps taken at your request (art. 6(1)(b)). Both are deleted automatically 24 months after you sent them, or earlier when you ask: write to us and we erase every entry for your address.

E-mails you send us

We keep your e-mail as long as needed to answer it and for at most 24 months. Please do not send payslips by e-mail; use the decoder instead, which removes personal details and keeps nothing.

Server logs and abuse protection

Our edge server logs requests (IP address, path, status, timestamp, browser type) for security and debugging, kept for 14 days and then deleted automatically. Credentials and payment references are stripped from the log before it is written. The application server keeps no request log. Rate limiting uses your IP address in memory only (IPv6 addresses are grouped by network), and repeated uploads of the same file are recognised by a one-way fingerprint of the file held in memory for 24 hours. Legal basis: legitimate interest in keeping the service secure and affordable (art. 6(1)(f)).

Storage on your device

The site stores a few things in your own browser, only to provide what you ask for: your consent choice, theme and language (local storage); the current result, Plus details, questions and comparison (session storage, cleared when you close the tab or press “Delete everything”); a payslip waiting during a hand-off between pages (IndexedDB, deleted as soon as it is decoded); and, once Plus is on sale, your pass code (local storage). None of this is sent to us except when you use the feature, and none of it is used for tracking.

3. What we do not do

• No advertising, no analytics trackers, no cookies of our own, no fingerprinting.
• No accounts and no profiles. We cannot look up “your” payslips because we do not have them.
• No selling or sharing of data, and no use of your data to train AI models.
• No automated decisions about you: the analysis is information for you, it decides nothing (GDPR art. 22 does not apply).

4. Processors and transfers

• Anthropic (AI analysis and rules research). The redacted payslip and the details above are sent to Anthropic's API. Under Anthropic's commercial terms, API data is not used to train models. By default Anthropic deletes API inputs and outputs within 30 days; content flagged by its automated safety systems can be kept for up to 2 years to enforce its usage policy. Processing takes place in the USA; the transfer is covered by Anthropic's Data Processing Addendum with the EU Standard Contractual Clauses.
• Stripe Payments Europe, Ltd. (payments, once Plus is on sale), Ireland. Stripe also receives your IP address and browser details for fraud prevention when you pay.
• Cloudflare, Inc. (anti-bot check), only if the “Turnstile” challenge is shown on the upload page: it processes your IP address and browser signals to tell humans from bots and sets no tracking cookies. (Remove this line if Turnstile is not enabled.)
• OVH SAS, France, hosting the Payslop servers in an EU data centre.
• OVH SAS, France, for the hello@ mailbox.

5. How long we keep things

• Payslip file: seconds, in memory only. Result: in your browser only.
• Server logs: 14 days. Rules research notes: 14 days at the latest.
• Waitlist and professional contacts: 24 months, or until you ask us to delete them.
• Payment records (once on sale): 10 years (accounting law).
• Anonymous counters: kept, as they contain no personal data.

6. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, to withdraw consent at any time, and to lodge a complaint with the Luxembourg supervisory authority (CNPD, cnpd.public.lu) or the authority of your country. Since we keep no payslips and the counters cannot be linked to anyone, requests mostly concern the waitlist, the professional form and payment records. Write to hello@payslop.com; we answer within one month. Payslop is meant for people aged 16 and over.

7. Security

HTTPS everywhere, strict content security policy, files validated by content rather than file name, uploads parsed in an isolated process, no file ever written to disk, the application server reachable only through the edge proxy, secrets kept out of the images. If a breach ever puts your data at risk, we notify the CNPD within 72 hours and tell you without delay when the law requires it. Report security issues to security@payslop.com.

8. Changes

We update this page when anything above changes and note the date at the top. A change to what the consent box covers asks you for consent again.