Privacy Notice
Last updated: 28 May 2026
1. Who we are
MySalaryPal is operated by Gary Curran, a sole trader based in Ireland. We act as the data controller for personal data processed through the Service. For payroll-admin accounts, the employer is the controller of employee payslip content; we act as processor on their behalf.
2. What we collect & why
| Category | Purpose | Legal basis |
|---|---|---|
| Account data (name, email, password hash) | Create and secure your account | Contract |
| Payslip files & extracted figures (gross, net, PAYE, PRSI, USC, pension, employer) | Provide the dashboard and AI explanations | Contract |
| Company / employer membership records | Route payslips to the right employee | Contract / legitimate interests |
| Passkey credentials (public key, device label, last-used time) | Phishing-resistant biometric sign-in (Face ID, Touch ID, Windows Hello, device PIN) | Contract |
| Push notification endpoints (browser-issued URL, user agent) | Notify you when a new payslip or message arrives — only if you opt in | Consent |
| Support messages | Help you when you contact us | Legitimate interests |
| Usage logs, device & IP data | Security, fraud prevention, debugging | Legitimate interests |
| CAPTCHA signal (Cloudflare Turnstile token) | Block automated sign-up and login abuse | Legitimate interests |
| Cookies (essential only) | Keep you signed in | Strictly necessary |
Payment data (card details, billing address) is collected directly by our payment provider Paddle and is not stored on our systems.
3. Who we share data with
- Hosting & infrastructure: Supabase (EU region) for database, authentication and file storage.
- Edge delivery & abuse protection: Cloudflare for CDN, DDoS mitigation and Turnstile CAPTCHA.
- Transactional email: Resend for account, payslip and notification emails.
- AI processing: Google (Gemini) and OpenAI to generate payslip explanations. Payslip text may be sent to these providers; outputs are not used to train their models.
- Payments: Paddle, our Merchant of Record, for sales, subscription management, tax compliance and invoicing.
- Professional advisers (accountants, legal) where strictly needed.
- Authorities where required by law.
4. International transfers
Some processors (e.g. OpenAI, Google) are based outside the EEA. Transfers are protected by Standard Contractual Clauses or adequacy decisions where applicable. Copies of applicable transfer safeguards are available upon request.
5. Data retention
We align retention with statutory payroll record-keeping rules in each jurisdiction we serve. Where the law sets a longer period, the longer period applies.
- Payslip and payroll records: retained for 7 years after the end of the tax year they relate to (covers Revenue IE 6-year rule, HMRC UK 6-year rule, German GoBD 10-year rule applied per-tenant where relevant).
- Tamper-evident audit logs: retained for 7 years to support payroll and compliance investigations.
- Account & profile data: retained while the account remains active.
- Support enquiries: retained for up to 24 months.
- Authentication and security logs: retained for 12 months.
- Encrypted backups: retained for 30 days (point-in-time recovery).
If you delete your account, we delete or anonymise your personal data within 30 days, except for records we are legally required to keep (statutory payroll records and the tamper-evident audit log). Those are kept locked-down and used only to respond to lawful requests from tax authorities or to defend legal claims.
6. Your rights (GDPR)
You have the right to access, rectify, erase, restrict, port, or object to processing of your personal data, and to withdraw consent at any time. You can also lodge a complaint with the Irish Data Protection Commission. To exercise any right, email hello@mysalarypal.com — we'll respond within one month.
7. Security
Access to payslip content is restricted according to role-based permissions and least-privilege principles. Users only have access to data required for their role. We use encryption in transit (TLS), encryption at rest, row-level access controls, and least-privilege service accounts.
8. Cookies
We only use strictly-necessary cookies (session and authentication). We do not use advertising or third-party analytics cookies.
9. Data Protection Officer
MySalaryPal is not required to appoint a Data Protection Officer under Article 37 GDPR. Privacy enquiries can be directed to hello@mysalarypal.com.
10. Contact
MySalaryPal · hello@mysalarypal.com