Privacy Policy

This policy explains what GetMyStub collects when you visit getmystub.com, join the waitlist, prepare and order pay stubs, recover or verify documents, ask for a refund, or contact us.

The data controller is GetMyStub (Legal Notice). Contact: hello@getmystub.com.

1. What we collect

When you visit the site

Our hosting provider receives your IP address and basic browser details with each request, as every website host does. We also count page views to see how many people visit and which pages they read. For each view we record the page address without anything after a question mark, the site that sent you, and your country, browser, operating system and device type. We do not count views of our admin pages.

When you join the waitlist

• your email address;
• which updates you asked for: the general launch, the 5 Pay Stubs pack, or the plan for businesses;
• if you choose to tell us: the state where you work, whether you are an employee or a contractor, and what you need pay stubs for;
• the date you joined each list, whether we sent you the launch email or you unsubscribed;
• a random code that makes your unsubscribe link work.

While you fill in the wizard

Your answers are saved in your own browser so you can come back later. Before saving, we remove the last four digits of the Social Security number, the EIN and the bank numbers. Nothing in the wizard reaches our servers until you go to payment.

When you order

We store what you entered in the wizard, which can include:

• employer name, address, phone number, EIN and logo;
• worker name, address, worker ID and the last four digits of the Social Security number;
• pay rate, hours, pay dates, earnings, deductions, earlier pay this year and tax settings (such as W-4 answers);
• if you add direct deposit: the bank name, the routing number, and only the last four digits of the account number, which is all the document prints;
• the email address for delivery, and your design choices.

We also store the calculation result, the PDF files with a fingerprint (hash) of each, the verification code, the price, the Stripe payment identifiers and status, which of our pages you came from, and the time you accepted our terms and which version you accepted.

Stripe handles payment. It collects your card or payment details directly, and we never see or store your full card number. We give Stripe your delivery email address. Stripe processes payment data under its own privacy policy.

Refunds, recovery and verification

If you ask for a refund, we store your reason and how we resolved it. If you ask for a recovery or refund link, we use your email address to find your orders and send it. If someone uploads a PDF on the verification page, we compute its fingerprint to compare it with ours and do not keep the file.

When you contact us

If you use the contact form or email us, we receive your email address, the topic you chose and your message. The form does not store them in our database: they arrive as an email in our support inbox, where we keep them while we need them to help you.

Abuse protection

To stop abuse of our forms, we count attempts using a hashed form of your IP address and, on some forms, your email address, never the originals. The counters expire automatically, in an hour or less.

2. Information about other people

A pay stub contains information about a worker and an employer, and the person ordering may enter information about someone else. We ask everyone who orders to have permission to use that information. We do not check it, and we use it only to produce, deliver and verify the document. If your information was entered by someone else, you can use the rights in section 8 by writing to hello@getmystub.com.

3. Why we use it, and on what legal basis

• To provide what you ordered (performing our contract with you): calculating, generating, delivering and recovering your documents, taking payment and handling refunds and support.
• With your consent: sending waitlist emails. You can withdraw it at any time with the unsubscribe link.
• To meet legal obligations: keeping accounting records of sales.
• For our legitimate interests, weighed against yours: keeping the service secure, preventing fraud and abuse, keeping issuance records so verification codes work, handling information about workers and employers that users enter, defending legal claims, and counting page views without cookies.

We do not sell personal information, use it for advertising, or make automated decisions about you with legal or similar effects.

4. Public verification

Anyone with a valid verification code can see, for 90 days after the documents are generated, the company name, the worker's name, the pay period and net pay of the most recent stub in the order, the issue date, the tax sources used, the document labels and whether the files are intact. The code is printed on each document, so whoever has the document can see this information. Share documents and codes only with people you want to see it. See the Disclaimer for what verification does and does not prove.

5. Who processes it

We use these providers, each only for its own task:

• Vercel hosts the website and counts page views (Vercel Web Analytics). Its request logs include IP addresses and browser details. According to Vercel, its analytics does not use cookies or store your IP address, and it tells visits apart with a code that changes every day.
• Supabase hosts our database and stores the PDF files, in the United States (US East).
• Stripe processes payments and refunds.
• Resend sends our emails, so it receives your email address and the message, including the PDF attachments of your order.
• Upstash stores the hashed abuse counters described above.

We may also share information when the law requires it, to answer a valid legal request, to resolve a payment dispute with Stripe or your bank, or to protect people from fraud.

6. International transfers

Our providers store and process data in the United States. For transfers from the European Union we rely on the safeguards they offer, such as the EU-U.S. Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses. Write to hello@getmystub.com for details.

7. How long we keep it

• Orders never paid: deleted 30 days after they were started.
• Completed or refunded orders: the PDF files, everything entered in the wizard and the calculation are deleted 180 days after completion. We then keep only the amount, the Stripe identifiers, the email address and the dates, for accounting.
• That accounting record, and any refund request linked to it: deleted 6 years after the order.
• Paid orders that could not be completed: kept until we resolve them, because money may have moved.
• Waitlist: kept until you ask us to delete it. Unsubscribing stops our emails but keeps the entry, marked as unsubscribed, so we know not to email you.
• Wizard answers in your browser: stay there until you clear them or your browser data.
• Abuse counters: expire in an hour or less. Vercel keeps its request logs and page view counts according to its own settings.

Emails we sent you, and their attachments, stay in your mailbox until you delete them.

8. Your rights

You can ask us to access, correct or delete your personal information, to restrict or object to how we use it, or to give you a copy in a portable format. You can withdraw consent at any time. Write to hello@getmystub.com. We may ask you to confirm your identity first, and we answer within one month. We may keep information the law requires us to keep, such as accounting records.

Every waitlist email has an unsubscribe link. Confirming on the page it opens takes you off every list you joined with that email address. If you join again, you are added back.

You can also complain to a data protection authority, such as the one where you live.

9. Cookies and browser storage

Our public pages set no cookies, and our page view counting works without cookies. After you pay, we set one cookie, gms_order, that lets you download your documents. It lasts 2 hours. The wizard saves your answers in your browser's storage as described in section 1. The Stripe payment page is run by Stripe and may use its own cookies. We do not use advertising or tracking cookies.

We do not track you across other websites, so we do not respond to browser Do Not Track signals differently.

10. Security

Row Level Security is enabled on all database tables and public roles have no database access. PDF files are kept in private storage and downloaded through short-lived links. Card details stay with Stripe, only the last four digits of a bank account are stored, and abuse counters use hashed values. No system is perfectly secure, so protect your documents, your mailbox, your links and your codes, and tell us at hello@getmystub.com if you think your information was exposed.

11. Children

GetMyStub is for people 18 and older. We do not knowingly collect information from children. If you believe a child gave us personal information, write to us and we will delete it.

12. Changes to this policy

When what we collect, why, or who processes it changes, we update this page and the date at the top.

13. Contact

GetMyStub. Email: hello@getmystub.com.