Privacy policy

What data does this site collect?

Nothing you type into a calculator. Every figure stays in your browser. The site asks for an email address only if you want the one-pager, and keeps cookieless page counts. If you message us on WhatsApp, we see that.

Verified 27 August 2026 by fetching every page and every asset on this site and reading the one server endpoint, /api/subscribe, line by line.

Does PayslipIQ UAE use cookies?

No. Every page and asset served from this origin was fetched on 28 August 2026 and not one returned a Set-Cookie header. Nothing across the fourteen pages or the scripts they load reads or writes localStorage, sessionStorage or IndexedDB.

Regulation 6 of PECR requires consent only for storing or accessing information on your device. Nothing here does, so there is no consent banner. Section 5 sets out the check.

What happens to my email address?

Today, nothing. The mail provider key is not set on this deployment, so the address is validated, held in memory for the length of one request and discarded. It is never written to a database.

A live POST to /api/subscribe on 27 August 2026 returned "emailed":false with the note RESEND_API_KEY is not set on this deployment. Section 2a sets out what changes when it is set.

1. Who we are and who controls your data

PayslipIQ ("we", "us", "our") is a trading name of GoldPaid Ltd, which operates PayslipIQ UAE (currently served at payslipiq-ae-pro.vercel.app) and is the data controller for any personal data processed through this site. PayslipIQ UAE is part of the wider PayslipIQ family, which also runs payslipiq.co.uk for the UK. For data protection enquiries, contact privacy@payslipiq.co.uk, or our data protection contact at dpo@payslipiq.co.uk.

Data Controller (UK GDPR Article 13(1)(a))

Controller	GoldPaid Ltd (company 17382540), trading as PayslipIQ
Registered office	179 Whiteladies Road, Clifton, Bristol, England, BS8 2AG, exactly as it appears on the Companies House register for company 17382540
Data protection registration	Data protection registration ZC214216, Information Commissioner’s Office. That registration is held in the name of an individual, not by GoldPaid Ltd. Nothing on this site should be read as a claim that GoldPaid Ltd itself holds an ICO registration. GoldPaid Ltd is the controller for this site and answers for it. Because GoldPaid Ltd is named here as the controller, whether the company also requires a data protection registration and fee of its own under the Data Protection (Charges and Information) Regulations 2018 — a duty an individual’s registration would not discharge — is a question we have put to a solicitor and have not yet settled. We would rather state that openly than imply the position is resolved. This notice will be updated as soon as it is.
Service this notice covers	payslipiq-ae-pro.vercel.app (PayslipIQ UAE)
Data protection contact	dpo@payslipiq.co.uk
Privacy enquiries	privacy@payslipiq.co.uk
General enquiries	hello@payslipiq.co.uk
Supervisory authority	Information Commissioner's Office (ICO), ico.org.uk/make-a-complaint

2. What the calculators do with the figures you enter

This is the most important thing on the page, so we will put it plainly. The UAE gratuity calculator, the take-home and gratuity calculator, the UK-vs-UAE relocation calculator and the decode-my-offer tool — the four calculator pages, the same four counted in section 5 — run entirely in your browser. The arithmetic happens on your own device, in JavaScript that is part of the page. Your salary, basic pay, allowances, years of service, rent, school fees and every other figure you type stay on your device.

We do not transmit those figures. No form submission, no API call, no background upload and no analytics event carries them. There is one qualification, and section 2a sets it out in full: if you ask for the one-pager, the request carries the single headline figure already on screen — your offer score, or your gratuity total — alongside your email address. Nothing else you typed goes with it. The site’s only server-side endpoint is that guide request, and the page’s Content-Security-Policy restricts outbound connections to this site’s own origin. When you close or refresh the tab, the numbers are gone. We do not store them, we do not sell them, we do not share them, and we could not produce them if you asked us to, because we never had them.

2a. If you ask for the one-pager

On the offer decoder and the gratuity calculator there is an optional form offering a two-page PDF, Your Dubai offer, decoded. It is the only form on this site and you never have to use it: the same PDF downloads directly, with no email, from the link beside the form. What follows describes the endpoint as it is coded today, not in general terms.

2a.1 What the form sends

Submitting the form makes one POST from your browser to /api/subscribe. The request body carries five fields and nothing else.

Every field in the request body, as coded today

email	The address you typed, with spaces trimmed off.
source	The path of the page you asked from, for example /decode-job-offer. Not the full URL and no query string.
context	The text of the single headline figure already on screen: your offer score out of 100 on the decoder, or your gratuity total on the calculator. This is personal data, because it is derived from figures you entered. It is sent so that any reply we give can be useful, it is the only calculator output that ever leaves your browser, and the endpoint cuts it off at 300 characters.
company	A hidden field. It is empty for every human being, because you cannot see it. Section 2a.3 explains why it is there.
elapsed	The number of milliseconds between the form script loading and you pressing the button. Section 2a.3 explains why.

We do not take your name, your employer, your salary inputs, your visa position or anything else you have not typed into that box.

2a.2 What is validated

Your browser checks only that the address contains an @ with a dot after it. The endpoint does the real check. It trims the address and puts it into lower case, rejects anything longer than 254 characters, and tests it against a deliberately conservative pattern that requires a plausible domain and a top-level domain of two to twenty-four letters. Anything that fails gets a 400 response and is not processed further.

2a.3 The honeypot and the timing trap

Two checks run before validation, and both are silent. The honeypot is the hidden company field. A person never sees it, so a person never fills it, while automated form-fillers fill everything. If it arrives with any value at all, the endpoint returns the download link and stops: the address is not validated, not rate-limited and not passed anywhere. The timing trap does the same when a submission arrives less than 1,200 milliseconds after the form script loaded, which is faster than the form can be read and typed into. Neither check uses a CAPTCHA and neither loads a third-party script, so nothing about you is shared with a bot-detection service.

2a.4 The rate limiter, and what it holds

The endpoint keeps a table in the memory of the single serverless instance handling your request. The key is the first IP address in the X-Forwarded-For header, or the word unknown when there is none. The value is the list of times that address submitted this form. Times older than 60 minutes are dropped on every request, and more than five submissions from one address inside a rolling hour is refused with a 429. The whole table is emptied when it passes 5,000 addresses, and it disappears when the instance is recycled. Nothing in it is written to disk, sent anywhere, or used for any purpose other than slowing a flood.

2a.5 What is stored: nothing

The endpoint has no database, no file write and no log of its own. Your address exists in the memory of one function for the length of one request, and then the function returns and it is gone. Its responses are sent with Cache-Control: no-store so that no cache holds a copy.

2a.6 What happens today

Today the address goes nowhere. Sending is gated on an API key that is not set on this deployment. With no key, the send routine returns before it makes any outbound request, so no email is composed, no provider is contacted, and no copy reaches us. The endpoint says so rather than pretending otherwise: a live POST on 27 August 2026 returned "emailed":false with the note RESEND_API_KEY is not set on this deployment, and the status line under the form tells you the address could not be recorded. You still get the PDF.

2a.7 What changes when the mail provider is switched on

The provider will be Resend, operated by Resend, Inc. in the United States, acting as our processor under Article 28. Two emails will then be sent for each request: one to you, carrying the link to the one-pager, and one to our own address, carrying your email address, the source page, the context figure described in 2a.1 and the time of the request. From that point your address rests in our mailbox and in Resend’s sending records, and section 8 sets out for how long. Section 9 covers the transfer out of the UK.

Nothing else in this section changes on that day. The endpoint still stores nothing of its own, still runs the same honeypot, timing trap and rate limiter, and still takes nothing you have not typed into that box. This notice already describes both states, so it will not need rewriting when the key is set. If we ever change provider, we will name the new one here before the change goes live.

2a.8 Lawful basis, withdrawal and deletion

Our lawful basis is your consent under Article 6(1)(a), given by submitting the form, together with consent under regulation 22 of the Privacy and Electronic Communications Regulations for the email itself. Withdraw it at any time by replying STOP to any email from us, or by writing to privacy@payslipiq.co.uk. We delete the address within 30 days of being asked. Withdrawing does not affect anything done before you withdrew.

3. What we do not collect

For the avoidance of doubt, PayslipIQ UAE does not:

• Set cookies of any kind, first-party or third-party. There is no consent banner because there is nothing to consent to.
• Write to localStorage, sessionStorage or IndexedDB.
• Operate user accounts, logins or registration.
• Run a newsletter, a mailing list or a marketing sequence. The only email we ever take is the one you type into the optional guide form in section 2a, and it is used to send you that guide and answer you — nothing else.
• Run advertising networks, retargeting pixels, session-replay tools or heatmaps.
• Sell, rent or trade any data about you to anyone.

4. What is collected when you visit

Four things process data when you load a page here. We describe each accurately below rather than in general terms.

4.1 Vercel Web Analytics

We load Vercel Web Analytics from a first-party path on this domain (/_vercel/insights/script.js). Vercel's published documentation states that it uses no cookies and that visitors are instead identified by a hash created from the incoming request, with the visitor session discarded after 24 hours. It is designed so that data points are not tied to an individual or an IP address, and it does not store information that would let a browsing session be reconstructed across other websites.

Vercel documents the following as the data stored with each data point: event timestamp, the URL and the dynamic route pattern, the referrer, filtered query parameters, approximate geolocation (country, region, city), device operating system and version, browser and version, device type, and the analytics script version. None of that includes the figures you enter into a calculator.

4.2 Vercel Speed Insights

We also load Vercel Speed Insights from a first-party path (/_vercel/speed-insights/script.js). It measures real-user page performance using the browser's native Web Vitals APIs. Vercel documents it as anonymous, not tied to any individual visitor or IP address, and states that it does not collect or store information that would enable a browsing session to be reconstructed across pages.

The data points Vercel documents for Speed Insights are: route and URL, network speed class, browser, device type, device operating system, country as a two-letter ISO code, the web vital measured and its attribution (the element the browser blamed), the SDK version, and the time the event was received.

4.3 Interaction events we ask for

Our own script records a small number of named interaction events and passes them to Vercel Web Analytics as custom events. These are things like whatsapp_click when someone taps a WhatsApp button, a named identifier for which call-to-action was pressed, and scroll_depth at the 25, 50, 75 and 100 per cent marks. An event may carry the visible text label of the element that was clicked, truncated to 40 characters. It never carries anything you typed into a calculator, and it never carries anything that identifies you.

4.4 Hosting

This site is hosted on Vercel. Like any web host, Vercel necessarily processes the connection data required to deliver a page to you, including your IP address, at the point of the request, and for security and abuse prevention. That processing is Vercel's as our hosting processor; we do not operate an application-level access log of our own, and we do not build visitor profiles from it.

5. Cookies, browser storage, and why there is no consent banner

This site sets no cookies and writes nothing to your device. Checked on 28 August 2026: every page and asset served from this origin was fetched and not one response carried a Set-Cookie header. The fourteen pages load one shared script, /main.js, and the two Vercel analytics scripts described in section 4; four of the pages add an inline calculator script of their own. None of those scripts reads or writes document.cookie, localStorage, sessionStorage or indexedDB. The Vercel analytics are cookieless by design and their script source was checked the same way.

That is why you do not see a consent banner. Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 requires consent before storing information on, or gaining access to information stored in, a visitor’s device. This site does neither, so there is nothing for a banner to ask you about, and a banner would only train you to click through one. If that ever changes, we will put a consent mechanism in place before the change goes live, not after, and this page will say so first.

6. If you contact us

The contact routes we offer are WhatsApp, telephone, and the email addresses listed in section 15.

6.1 WhatsApp

If you message us on WhatsApp, we will see your message, your WhatsApp display name and the mobile number you send it from, together with anything you choose to tell us about your salary, offer or circumstances. You control what you share, and you do not need to share figures to get help.

WhatsApp is operated by Meta. Message content is end-to-end encrypted in transit, but Meta processes the associated account and metadata under its own terms as an independent controller, and it may process that data outside the UK. We have no control over Meta's handling of it. If you would rather not use Meta's platform, telephone us instead, or email hello@payslipiq.co.uk.

6.2 Telephone

If you call +44 7944 014111, your number will appear on the handset and in its call history unless you withhold it. We keep a WhatsApp or call thread only for as long as we need it to answer you and to have a record of what we said.

7. Lawful bases for processing

Under the UK General Data Protection Regulation we rely on the following, purpose by purpose.

• Consent (Article 6(1)(a)), together with consent under regulation 22 of the Privacy and Electronic Communications Regulations for the message itself, for the optional guide email in section 2a. You give it by submitting the form. You can withdraw it at any time, and withdrawal does not affect anything done before you withdrew.
• Legitimate interests (Article 6(1)(f)) for cookieless, aggregate analytics and page-speed measurement. Our interest is in knowing which tools are used and whether the site performs acceptably. Because the measurement is anonymous, cookieless and not used to profile anyone, the impact on you is minimal and does not override your interests. You can object at any time using the details below.
• Legitimate interests (Article 6(1)(f)) for the security, availability and abuse-prevention functions performed by our host, and for the honeypot, timing trap and rate limit described in section 2a. Our interest is in keeping a free public tool usable and unflooded. The rate limiter holds an IP address for at most 60 minutes, in memory, and is used for nothing else.
• Legitimate interests (Article 6(1)(f)), or steps taken at your request before entering into a contract under Article 6(1)(b), for answering you when you contact us on WhatsApp, by telephone or by email.

We do not process special category data within the meaning of Article 9, and we do not knowingly process criminal offence data. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you within the meaning of Article 22. The calculators score and total the figures you type, on your own device, and produce no decision about you that we ever see.

8. How long we keep things

• Calculator figures: never received, so there is nothing to retain. They exist in your browser’s memory until you close the tab.
• Your email address, today: held in the memory of one serverless function for the length of one request, under a second, then discarded. Nothing is written down. See section 2a.5.
• Your email address, once the mail provider is switched on: kept for 24 months from our last contact with you, then deleted. Deleted sooner if you ask, within 30 days of asking.
• Rate-limiter entries: an IP address and the times it submitted the form, in memory only, discarded 60 minutes after the last submission and lost whenever the serverless instance is recycled.
• Vercel Web Analytics: the visitor session hash is discarded after 24 hours. What remains is aggregate counts carrying no identifier for you, retained by Vercel under the retention that applies to this project’s plan.
• Vercel Speed Insights: the same arrangement, holding performance measurements rather than visits.
• WhatsApp and telephone conversations: kept for 12 months after the conversation ends, then deleted. Ask us and we delete a thread sooner, within 30 days.
• Our own server logs: there are none. Our host processes connection data to deliver pages and to defend the site, under its own retention, and we do not build visitor profiles from it.

9. International transfers

Vercel Inc. is a United States company and processes some data outside the UK. Meta, which operates WhatsApp, also processes data outside the UK. Where personal data is transferred out of the UK, it is protected by the UK Addendum to the EU Standard Contractual Clauses, the UK extension to the EU-US Data Privacy Framework where the processor participates in it, or another transfer mechanism recognised as adequate by the UK Government. The analytics data described in section 4 is designed to be anonymous, so in normal operation there is little or no personal data in it to transfer.

10. Data security

All traffic to and from this site is served over HTTPS. The site sends a Content-Security-Policy that restricts scripts, styles, fonts, images and outbound connections to this origin, a strict transport security policy, and standard protections against content-type sniffing and clickjacking. Because we hold no salary data and operate no database for this site, there is no store of your financial information to breach.

11. Children

PayslipIQ UAE is aimed at working adults and is not intended for use by anyone under 13. We do not knowingly process personal data relating to children. If you believe a child has sent us information, email privacy@payslipiq.co.uk and we will delete it.

12. Your rights under UK GDPR

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• Access a copy of any personal data we hold about you, with an explanation of why we hold it.
• Rectification of anything inaccurate or incomplete.
• Erasure of your personal data, where one of the Article 17 grounds applies.
• Restriction of how we use it while a dispute about it is resolved.
• Data portability, receiving what you gave us in a structured, commonly used, machine-readable format.
• Object to processing carried out on the basis of legitimate interests, including our analytics.
• Withdraw consent for the guide email at any time. Reply STOP to any email from us, or write to the address below.
• Not be subject to a decision based solely on automated processing with legal or similarly significant effects. We do not make such decisions.

How to exercise any of them. Email privacy@payslipiq.co.uk, name the right you want, and give us the email address or WhatsApp number we would know you by. That is the whole process. There is no form, no account and no charge, and we ask for identification only where we cannot otherwise be sure we are answering the right person. If you would rather not email, message the same request to us on WhatsApp and we will treat it identically.

Our deadline. We answer within one month of receiving the request, as Article 12(3) requires. If a request is unusually complex, or you have made several, we may extend that by up to two further months; we will tell you inside the first month if we do, and why. If we decide not to act on a request, we will tell you why within one month and tell you how to complain.

In practice the only personal data we are likely to hold about you is a WhatsApp or telephone conversation, and, once the mail provider in section 2a is switched on, the email address you gave for the one-pager. The calculators send us nothing, so there is nothing there to access, correct or erase.

13. Your right to complain to the ICO

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office, at any time.

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

The ICO asks you to raise the matter with us first, and it will normally expect you to have done so, but you can go to it at any time. Complaining to the ICO does not affect any other legal remedy available to you, including a claim for compensation under Article 82. Link checked 27 August 2026.

14. Changes to this policy

We may update this policy as the site changes. The current version always sits at this address with the review date at the top and bottom of the page. If we ever begin to collect something material that we do not collect today, we will say so here before we start.

15. Contact

• Privacy enquiries and rights requests: privacy@payslipiq.co.uk
• Data protection contact: dpo@payslipiq.co.uk
• Everything else: hello@payslipiq.co.uk or WhatsApp
• How the calculators work and where our figures come from: How We Work
• The terms you use this site on: Terms of Use and Disclaimer

GoldPaid Ltd is not authorised or regulated by the Financial Conduct Authority, and nothing on this site is regulated financial advice or a personal recommendation. Our Disclaimer explains that boundary in full. Last reviewed: 29 August 2026. This notice is written to be read and understood, not to impress a lawyer. It describes what the site does today, checked against the live endpoint and the live response headers on the date above. It is not legal advice and it is not a substitute for taking your own.