Privacy Policy – PayAudit

Policy version: 2026-10-10 · Consent texts version: 2026-10-10.1

1. Who we are

The controller of the personal data described in this policy is PayAudit (“we”, “us”). Contact: info@payaudit.eu.

This policy covers the PayAudit website, the free tools that run on it, the waitlist, and the PayAudit web application during its free beta (together, the “Service”).

2. Payroll data you analyse with PayAudit

PayAudit is designed so that individual payroll records never reach our servers. When you load a payroll export in the PayAudit app or in a free tool, the file is read and processed by your browser, on your device. We do not receive, store or log the pay, hours, sex or category of individual workers. The free tools are built to work without sending your file anywhere.

What the PayAudit app does store on our servers, inside your workspace:

• your job architecture (job evaluation schemes, factors, levels, job titles, categories);
• aggregate report snapshots (for example, number of workers and average or median pay by sex and by category);
• joint pay assessment records (aggregates, reasons, corrective measures);
• a log of workers’ information requests under art. 7 of Directive (EU) 2023/970 (your internal reference, dates, status). No pay data.

Aggregates for very small groups (for example, a category with a single woman) can still relate to an identifiable worker. We treat all workspace content as data processed on your behalf: for it you, the employer, are the controller and we act as your processor under the data processing terms in the Beta Terms (art. 28 GDPR). Read-only users (for example workers’ representatives) do not see cells below the suppression threshold [TO CONFIRM: threshold and whether small cells are also suppressed before storage]. Workers who want to exercise their rights over this data should contact their employer; we will assist the employer.

3. What we process, why, on which legal basis, and for how long

3.1 Waitlist

Data	Purpose	Legal basis (GDPR)	Retention
Email, language, sign-up source, referral code and referrer, campaign parameters (UTM), dates	Send launch updates and beta invitations (launch_updates)	Consent, art. 6(1)(a); for promotional email also art. 130 of the Italian Privacy Code	Unconfirmed sign-ups are deleted after 30 days (the confirmation link expires after 7 days). Confirmed sign-ups: until you unsubscribe or ask for erasure, and at most [TO CONFIRM] after the end of the beta. After unsubscribing we keep your email with the “unsubscribed” status only to respect your choice [TO CONFIRM duration]
Survey answers (role, company size, country, tools, main problem, top features, price band, beta interest, website)	Personalise your invitation and the roadmap (personalisation)	Consent, art. 6(1)(a)	Until you withdraw consent (the linked answers are then deleted) or ask for erasure
Survey answers given without the personalisation consent	Aggregate product research	Not personal data: stored without any link to your email, with the date only (no time), website dropped	Kept for aggregate statistics
Your choice on transfer to an acquirer (transfer_to_acquirer)	Transfer of your waitlist data if PayAudit is sold (section 5)	Consent, art. 6(1)(a)	As for the waitlist data
Consent records: purpose, granted/withdrawn, policy version, hash of the exact text shown, language, IP address truncated (IPv4 /24, IPv6 /48), browser user agent (max 256 characters), form, date and time	Prove which consent you gave or withdrew	Legal obligation to demonstrate consent, art. 6(1)(c) and art. 7(1)	Append-only. After erasure only a pseudonymous record remains (it no longer points to your email)

Consent texts shown (English version; equivalent texts are shown in Italian, German, French and Spanish):

• launch_updates (required to join): “Email me launch updates and beta invitations about PayAudit. Unsubscribe anytime.”
• personalisation (optional): “Use my survey answers to personalise my invitation and the roadmap.”
• transfer_to_acquirer (optional, separate): “If PayAudit is sold, my data may be transferred to the new owner, who will keep using it only for the same purposes. I’ll be notified and can object.”
• beta_terms (required to join the beta): “I accept the Beta Terms (free, no warranty, assignable).”

No box is pre-ticked and no consent is bundled with another.

3.2 Beta accounts and workspaces

Data	Purpose	Legal basis	Retention
Email, name, language, sign-in dates; for GitHub/Google sign-in, the provider’s account identifier (we do not store provider access tokens)	Create and secure your account	Contract (Beta Terms), art. 6(1)(b)	Until you delete your account [TO CONFIRM: deletion process]
Sign-in links	Passwordless sign-in	Contract, art. 6(1)(b)	Valid 15 minutes, single use, stored only as a hash, deleted 1 day after expiry
Sessions: hash of the session token, truncated IP address, user agent, dates	Keep you signed in; let you review active sessions	Contract, art. 6(1)(b)	30 days from last use; deleted after expiry
Workspace membership, role, invitations (email of the invitee, role, dates)	Collaboration	Contract, art. 6(1)(b)	Until removal or workspace deletion; invitation links expire after 7 days
Acceptance of the Beta Terms	Evidence of the agreement	Contract, art. 6(1)(b)	As long as needed to document the agreement [TO CONFIRM]
Product usage events inside a workspace (e.g. “report generated”) and limits reached	Improve the product, measure activation	Legitimate interest, art. 6(1)(f)	[TO CONFIRM]
Audit log (sign-ins, invitations, role changes, exports, admin actions)	Security and accountability	Legitimate interest, art. 6(1)(f)	[TO CONFIRM, e.g. 12 months]

3.3 Everyone visiting the website

Data	Purpose	Legal basis	Retention
Page views with path, language, referring website (host only), campaign parameters, date only	Count visits without cookies or identifiers	Legitimate interest, art. 6(1)(f); no identifier is stored	Not linked to any person [TO CONFIRM retention]
Clicks on “Choose plan” on the pricing page (plan, period, language, source; if not signed in, a daily salted hash of the truncated IP address to count unique clicks)	Measure interest in planned prices. Nothing can be bought	Legitimate interest, art. 6(1)(f)	[TO CONFIRM]
Anti-abuse: rate-limit counters keyed by a peppered hash of the truncated IP address or email; Cloudflare Turnstile challenge on forms	Protect forms and sign-in from abuse	Legitimate interest, art. 6(1)(f)	Counters reset within 1 hour to 24 hours [TO CONFIRM purge]
Email delivery records (recipient, template, status, provider message id); the message content is removed from our queue once sent	Deliver transactional and waitlist emails within the daily quota	As for the email’s purpose	Queue rows [TO CONFIRM]; provider logs 30 days

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you (art. 22 GDPR).

4. Who receives your data

We use these providers as processors:

Provider	Service	Location / safeguards
Cloudflare	hosting of the website and application, API, DNS, email forwarding, Turnstile anti-bot	global network; US company [NOT VERIFIED: transfer safeguards]
Neon	Postgres database	database region [EU – TO CONFIRM]; US company [NOT VERIFIED]
Resend	sending emails	[NOT VERIFIED: location and safeguards]

If you choose to sign in with GitHub or Google, that provider processes your data as an independent controller under its own privacy policy; we receive only your account identifier, a verified email address and your name.

No payment provider is active: billing is switched off during the beta and nothing is charged.

We do not sell your data and we do not share it with advertisers. We have no advertising accounts.

5. If PayAudit is sold

PayAudit may be sold to a new owner (software, domain and waitlist). In that case:

• we will email you before the transfer, with the acquirer’s name where we can disclose it, the date of the transfer and a one-click link to object or unsubscribe;
• only confirmed subscribers who have not objected may be transferred; the acquirer becomes the controller and may use the data only for the same purposes described here, and will send you its own privacy notice within one month (art. 14 GDPR). Beta accounts and workspaces follow the assignment clause in the Beta Terms.

6. Security

Secret tokens (sign-in links, sessions, confirmation and invitation links, API keys) are stored only as SHA-256 hashes; IP addresses are truncated or hashed; database access is separated per workspace with row-level security; every email goes through a queue with a daily limit; individual payroll records stay in your browser.

7. Your rights

You can ask for access to your data (art. 15), rectification (art. 16), erasure (art. 17), restriction (art. 18), portability (art. 20), and object to processing based on legitimate interest (art. 21), including the transfer described in section 5. You can withdraw any consent at any time from the preferences link in every email, without affecting earlier processing (art. 7(3)). Every email has a one-click unsubscribe link.

Write to info@payaudit.eu. We answer within one month (art. 12(3)). To protect you, we may confirm your request by sending a link to the email address concerned.

You can lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali) or with the authority of the EU country where you live or work (art. 77).

8. Cookies

We use only technical cookies (sign-in session and a short-lived sign-in security cookie) and no analytics or advertising cookies. See the Cookie Policy.

9. Children

The Service is meant for businesses and is not directed at children under 16.

10. Changes

We will publish any change here with a new version date. If a change affects a purpose you consented to, we will ask for your consent again.