Skip to main content

Trust and security

A payslip is one of the most sensitive documents you own. Here is exactly how we treat yours, with no fine print and no surprises.

What actually happens to your payslip

  1. Your browser re-encodes the image before it leaves your device. It is downscaled and re-saved as a JPEG, which discards EXIF metadata such as camera location, timestamp and device identifier. This happens in your browser, not on a server.
  2. The image is sent over HTTPS to a Vercel function and forwarded to Anthropic’s API for the reading step. It is held only for the duration of the request and is not written to any PayslipIQ database.
  3. We do not redact your payslip for you. Anything still visible in the image — your name, your employer, your PPS number — is visible to the model. That is why the upload page asks you to cover those fields first: the check only needs the figures.
  4. The figures are checked against published Revenue rules for PAYE, USC and PRSI, and the result is returned to your browser.
  5. Nothing is used to train an AI model. Anthropic does not train its public models on API traffic. Anthropic may retain inputs for a limited period for safety review; see the UK Trust Centre for the current retention position.

If you would rather send no image at all, use manual entry: it sends only the numbers you type.

What this page does not claim

There are no user accounts, so there is no dashboard, no saved history and no “delete my account” button — there is nothing stored to delete. There is no separate OCR service and no PayslipIQ infrastructure in Dublin: the site runs on Vercel and calls Anthropic. Nothing is sold yet, so no card processor holds anything of yours. If any of that changes, this page changes with it.

What we will never do

  • Sell your data to advertisers, recruiters, or banks.
  • Share your figures with employers, unions, or government departments without a court order.
  • Use your data for marketing without explicit opt-in.
  • Store your payslip image after the request that used it has finished.

What we will do

  • Report a personal data breach to the relevant supervisory authority within 72 hours of becoming aware of it, and tell affected people where the risk to them is high.
  • Answer a subject access request within one month.
  • Update this page whenever a sub-processor is added or removed.

Sub-processors

These are the third parties involved in running the service. The list is the same for the Irish and UK surfaces, because it is the same site.

  • Vercel Inc.: hosting, edge network and application logs.
  • Anthropic PBC: the model that reads the payslip image.
  • Upstash: rate limiting and request counters. No payslip content.
  • Cloudflare Inc.: Turnstile bot protection on forms.
  • Google (Analytics via Tag Manager) and Microsoft (Clarity): loaded only if you accept the cookie banner.

The full table, including the purpose and retention period for each, is on the Trust Centre.

Reporting concerns

Write to privacy@payslipiq.co.uk. PayslipIQ is not large enough to be required to appoint a Data Protection Officer and has not appointed one, so that address reaches the person who runs the site rather than a DPO function. If you are in Ireland you can also complain directly to the Data Protection Commission at dataprotection.ie.

Read our accessibility statement, our advertising policy, and our full privacy policy for the legal text behind these promises.

This page is informational. The full legal terms are set out in our Privacy Policy and Terms of Service.