Privacy notice

Who we are

PayDocs (“we”, “us”) decides how the personal data described here is used. Questions about privacy, and requests about your data, go to support@paydocs.co.

Using PayDocs without an account

The generators and calculators work in your browser. The figures you type stay on your device while you work and aren't sent to us or stored unless you sign in and save, or pay for a document without signing in.

If you pay without signing in, we store the document you prepared with your order. Once Stripe confirms the payment, we save the document, and any credits you bought, to the PayDocs account for the email address you gave Stripe, creating that account if there isn't one. You can sign in with that email address at any time to download the document again or use your credits.

What we collect and why

• Account: your email address and password. Passwords are stored only in hashed form by our authentication provider; we never see them. Used to create and secure your account. If you buy a document without signing in, we create the account from the email address you give at checkout; it has no password until you set one.
• Workspace: what you save — your organization's name, employer names and addresses, employee names and references, pay figures, notes, the documents you create, and the confirmations you give before saving (that you're authorized and the figures are accurate), with the version of the wording you saw. Used to provide the service.
• Purchases: what you bought, the amount, currency, date and status. Payments are handled by Stripe; we don't receive your full card number. Used to release what you paid for and to keep accounting records.
• Emails: we send account emails (such as confirming your address) and, after a purchase, a message that your document is ready. These contain no names or amounts from your documents.
• Security: your IP address, used in a keyed, pseudonymous form to limit repeated attempts at signing in, saving, ordering and downloading, and in our hosting provider's short-lived server logs.
• Support: the messages you send to support@paydocs.co and our replies.

Email lists

If you ask us to tell you when checkout opens, we store your email address, the list you chose, the country and page you asked from, when you agreed, and a keyed hash of your IP address (not the address itself). We keep them until you unsubscribe, or for two years after the last email we sent you.

We send nothing until you confirm your address from the first email, and then only the emails the form described: one the day checkout opens and one reminder a week later. Every email has an unsubscribe link. Nothing you type into a generator is stored for this; drafts stay in your browser as before.

The form uses Cloudflare Turnstile to check that a person, not a script, is asking; Cloudflare receives technical details about your browser and IP address for that check.

Details about other people

When you enter an employee's or someone else's details, you decide what is entered and why, and you confirm you're authorized to prepare their pay records. We process those details only to provide PayDocs to you. Please don't enter full Social Security numbers, National Insurance numbers or bank details; PayDocs doesn't need them.

Legal bases (UK and EU)

• Contract: to provide your account, workspace, documents and purchases.
• Legitimate interests: to keep the service secure and prevent misuse, and to answer support messages.
• Legal obligation: to keep purchase and accounting records.

Consent: for the email lists you join. You can withdraw it at any time with the unsubscribe link in any email.

Who processes data for us

• Vercel — hosts the website and application.
• Supabase — database, sign-in and private file storage.
• Stripe — takes payments.
• Resend — sends account and document-ready emails.

• Resend also sends the email-list messages you asked for.
• Cloudflare — runs the Turnstile security check on sign-in and on the email form.

We don't sell personal data, and we don't use it for advertising. Some of these providers are based in the United States; where data leaves the UK or EU, they rely on the safeguards the law requires, such as standard contractual clauses.

How long we keep it

• Your account and workspace: while your account is open. If you ask us to close it, we delete them within 30 days.
• Issued documents: kept unchanged in your workspace so you can download them again, and deleted with your account.
• Purchase records: 6 years, for tax and accounting.
• Security records: only as long as needed to limit repeated attempts.

Email lists: until you unsubscribe, or two years after the last email we sent you.

Your rights

Depending on where you live, you can ask for a copy of your data, for it to be corrected or deleted, to restrict or object to how it's used, or to receive it in a portable form. Email support@paydocs.co from the address on your account. We'll reply within one month.

In the UK you can complain to the Information Commissioner's Office (ico.org.uk); in the EU, to your local data protection authority. We'd like the chance to help first.

Cookies

We use the cookies needed to keep you signed in and to complete sign-in securely. We don't use advertising cookies.

We use Google Analytics, with Google Consent Mode, to understand how visitors find and use the site. If you're in the UK, the European Economic Area or Switzerland, Google Analytics sets cookies (so it can recognise a returning browser) only if you choose Accept in the cookie banner; until you do, or if you decline, no analytics cookies are set and Google receives only anonymous, cookieless signals (such as a page being viewed) that don't identify you or your browser. Elsewhere, Google Analytics cookies are on unless you choose Decline, which turns them off. Page addresses are sent without query strings or reference numbers, and Google never receives document contents, names, amounts or order details. You can change your choice at any time with Cookie settings at the bottom of any public page; declining removes Google Analytics cookies set earlier.

We also count, on our own servers, the steps visitors take through PayDocs (such as opening a generator, saving a draft or starting checkout), so we can see where the site is hard to use. Each count holds only the step, the page address (without reference numbers), the kind of site that sent you (such as a search engine) and your country, tied to a random number that lasts until you close the tab. It sets no cookie, doesn't depend on your cookie choice, and holds no name, email, IP address, account or document detail. We keep these counts for up to 400 days.

Children

PayDocs is for adults preparing pay records. It isn't intended for anyone under 18.

Changes

If we change this notice, we'll update the date below and, for significant changes, tell account holders by email. This notice takes effect on 26 October 2026.