Privacy Policy

Version 2.0 · Last updated October 31, 2026

The short version

We don't keep your paystub. Whether you upload a PDF, a screenshot, or a photo, it is read to run your audit and is not saved on our servers. To keep each account to one person, we keep a few details from it: your first initial and last name, coded forms of your name, employee number and paycheck amounts, the pay period date, and the rank, step, hourly rate, pay range, and retirement plan name shown on it.
Your position is saved to your account (department, rank and step, service start date, education, bonuses, assignment) so it follows you between devices.
Paystubs and contracts are read by our AI provider, Anthropic, whose business process is to delete them within 30 days, and which does not use them to train its models.
We don't sell your information, don't use it for advertising, and don't give it to your employer or union.
Test cases only with your permission. If you agree, we keep your paystub's pay lines, without your name, employee number or other identifiers printed on it (it stays linked to your account so you can withdraw permission), to check our accuracy for your department.
You can black out your Social Security number, home address, bank details, or anything else private before you upload a paystub. The app doesn't remove them for you: anything left visible on the pages you upload is sent to our AI provider to be read.
Two kinds of information handled differently. Your personal information is kept to a minimum and deleted when you ask, except records we must keep (section 7). Public contract rules you upload or verify are licensed to us to power the Service (section 1A).

1. Who we are

Hero Audit LLC, a California limited liability company ("we"), operates heropayaudit.com, the Hero Pay Audit app, and its free calculators (the "Service"). This policy explains what information we collect, how we use and share it, and your choices. Questions: info@heropayaudit.com.

1A. Data minimization and data bifurcation

We separate the information in the Service into two kinds and handle them differently.

Your personal information. Your account, saved position, account link record, subscription, and anything taken from your paystub are kept to the minimum needed to run the Service. Your paystub is read to run your audit and is not stored on our servers; its pages pass through our AI provider, whose business process is to delete them within 30 days (section 4). You can see and change your saved position, and you can delete your account and personal information at any time (section 9), except records we must keep (section 7).

Public labor documents. Collective bargaining agreements, memorandums of understanding, department policies, pay schedules, and the pay formulas, overtime rules, and text read from them are not personal information. When you upload or verify one, you give us the license described in section 9 of our Terms of Service to use those documents and the rules read from them to power our calculators and department information. That license covers only the public labor documents and the rules taken from them, never your personal or identifiable payroll information, and it continues after your subscription ends and your account closes.

2. Information we collect

Account information. Your email address and password (stored only in hashed form by our sign-in provider), sign-in records, whether you confirmed your email, and the version of the Terms and Privacy Policy you accepted, when, and the IP address and device or browser information it was accepted from. We also keep your email settings and a record of the emails the Service sends for your account, so none is sent twice. If you opt out of arbitration, we keep your opt-out email and our confirmation. If we offer Google sign-in and you use it, we receive your Google account identifier and email address.

Subscription information. Your plan and its price, subscription status, trial and renewal dates, the customer and subscription identifiers Stripe assigns, whether you used an access code or have a complimentary membership, and a record of your consent to automatic renewal (the time, the plan, the price, and the exact terms shown to you). Your card details go directly to Stripe; we never receive or store your full card number.

Your position (saved to your account). Your department, classification and step, service start date or years of service, education level, appointed assignment, bargaining unit, and the bonuses and premiums you receive or don't qualify for, including answers the app filled in from your paystub (for example, a bonus that appears on it) and your answers to "Did we miss anything?", all of which you can change. We do not store pay amounts in your saved position.

Your paystub (read, not stored). When you upload a paystub as a PDF, screenshot, or photo, or paste its text, its pages or text pass through our servers to our AI provider to be read into pay lines and that period's retirement contribution amounts (used only to confirm bonuses your paystub groups together), and the result is shown in your browser for your audit. If the lines read from a screenshot or photo don't add up to the printed gross pay, the same images are read a second time. So Leave Bank can show your balances, the same pages are also read once more for their leave section. We do not save the paystub file, its images, its text, its pay lines, or its retirement contribution amounts on our servers. A password-protected PDF is unlocked on your device; the password is never sent to us.

Account link record. To keep each account to one person and enforce the yearly paycheck limit, we keep these details from each paystub you audit, separately for each department (the pay period date is also used to skip a payday reminder for a pay period you've already checked):

your first initial and last name as printed, so we can tell you which person an account is linked to;
coded forms of the name and employee number, made with a secret key; we do not store the employee number itself, but because a person holding the key could test a guessed number against its code, we treat these codes as personal information and protect them accordingly;
the department, the pay period end date, and the date you ran the audit;
a coded fingerprint of the paycheck's amounts and gross pay, so re-running the same paycheck doesn't count against your limit (like the coded name and number, it's made with a secret key, and a person holding the key could test a guessed amount against it, so we treat it as personal information too);
the classification, step, and hourly rate shown on or matched from the paystub, the top of that classification's pay range, and the retirement plan name printed on it; and
a note when a paycheck's rank or retirement plan doesn't match your earlier paychecks, which helps us detect shared accounts.

Test cases (only with your permission). If you give separate, express permission, we keep the pay lines from one of your paystubs as a test case to check that the Service calculates correctly for your department: pay line names, hours, rates, amounts, gross pay, the pay period, and your classification, step, years of service, and education. We do not keep your name, Social Security number, address, bank details, employee number, deductions, taxes, or net pay with it. Test cases are visible only to us, are never shown to other users, and are deleted if you withdraw permission or delete your account. It stays linked to your account so it can be deleted when you withdraw permission. We also keep a record of your permission, including what you agreed to, when, and the IP address and device or browser it came from.

Union representatives. We do not collect your union representative's name or contact details. "Send to my rep" opens your own email app with a summary of your report and no recipient filled in; you choose the recipient and send it yourself, so we never receive your representative's address.

Information saved in your browser. Some information is saved in your browser's storage on your device, not on our servers: your department selection, your answers and per-department settings, your service start date, your own base hourly rate and your department's rate tables, contract text you loaded, paystub label names, the extras you enter (overtime shifts, assignments, leave), and your layout choices. If you add an earlier paycheck for an FLSA check, that paycheck's pay lines are also saved in your browser, and so are the leave balances read from your paystub for Leave Bank and any leave you mark as used. If you agree to the notice on a free calculator, that choice is saved in your browser for 60 days; signing out does not clear it. Signing out clears this information from that browser, and you can clear it at any time with Reset saved data.

Contracts and department information. Contract text uploaded for a department; the pay rules, pay schedules, rate tables, promotion rules, corrections, and paystub label names read from it or added by administrators; and the working files from reading the contract (its sections and the AI's raw responses). If you add a department yourself, we record that your account added it, and your confirmation that you're allowed to share the document, with the time and the IP address and device or browser it came from. Department information is not personal information, and it is shared as described in section 5.

Usage and security records. The time of each paystub or contract read (not its content), used to enforce daily limits; which departments your account has opened, used to enforce the department limit; and ordinary technical logs kept by our hosting provider, such as the page requested, IP address, response status and timestamps, used for security and troubleshooting. These logs do not capture the content you upload.

Messages you send us. If you email us, or send feedback from the feedback box in the app, we keep your message and our reply. Feedback from the app reaches us by email with your account email and department; the app itself does not store it. The same goes for "Ask us to add it" requests for a new department, which reach us by email with the details you enter. Mail sent to our addresses passes through an email forwarding service to our inbox, which Google hosts.

What we don't want. The Service is not designed to collect Social Security numbers, bank or direct-deposit details, home addresses, or dates of birth. Paystubs often show these, so you may black them out before uploading. The app doesn't remove them for you: anything left visible on the pages you upload is sent to our AI provider to be read.

3. How we use information

We use information to:

run your audits and show your reports;
save your position so it follows you between devices;
process payments and manage your subscription;
keep each account to one person and enforce usage limits;
check the Service's accuracy, using test cases only where you gave permission;
protect the Service, prevent fraud and abuse, and keep it secure;
answer your questions and fix problems; and
send service messages, such as email confirmation, password resets, receipts, trial confirmations, notices that your free trial is ending (3 to 4 days before, and again within a day of its end), yearly reminders, notices when your department's pay schedule changes, payday reminders to check your new paystub, skipped when you've already checked that pay period (you can turn off trial-ending notices, pay schedule notices and payday reminders with one tap), and notices of price or policy changes.

We do not send marketing email without your permission, we do not show ads, and we do not sell your information.

Automated processing. AI reads your documents, and fixed calculations produce your report. The report is information for you; the Service does not make decisions about your employment, pay, or benefits.

4. Who we share information with

Anthropic (AI provider) receives paystub and contract content to read it and return structured data. Under Anthropic's commercial terms, this content is not used to train its models without our permission, and Anthropic's business process is to delete it within 30 days. It may keep content longer only if the content is flagged for violating its usage policy or as required by law.
Lovable Cloud (hosting, database, sign-in, and email delivery, built on Supabase) stores and processes the information described in this policy on our behalf. Its own providers for database, hosting and email are listed at trust.lovable.dev/subprocessors.
Stripe (payments) receives your email address and account identifier when you start a free trial or subscribe, processes your payments, and stores your payment details.
Google serves the fonts our pages use, so it receives your IP address and browser information when a page loads.
Google hosts our support inbox, and provides sign-in only if we offer Google sign-in and you choose to use it.
Other users with audit access can see department information (pay rules, pay tables, label names), and our public calculators use reviewed departments' pay schedules. A department added by a member is visible only to that member and to us until it is reviewed. No other user can see your paystubs, your position, your answers, your test case, or your reports.
Union or department plans. If a union or department pays for your membership, we share only what's needed to run that plan, such as whether your account is active. We never share your paystubs or results with them unless you choose to.
Legal and safety. When required by law or valid legal process, or when needed to protect the rights, safety, or security of our users, the public, or the Service.
Business transfers. If the Service is sold or merged, information may transfer to the new owner, who must honor this policy. We will notify you.

We do not share your information with your employer, and we do not provide it to data brokers or advertisers.

5. Department information is shared

Department information is available to users of the Service who have audit access, and it is maintained by department administrators and by us. Contract text itself is shown only to the department's administrator, the member who added the department (while it is unverified), and us. Reviewed departments' pay schedules and promotion rules are also used by our free public calculators. Never enter personal information into department information. Department information stays with the department if you close your account, but we remove the record that your account added it.

6. Selling, sharing, and Do Not Track

We do not sell personal information and do not share it for cross-context behavioral advertising. We do not use advertising trackers or third-party analytics that follow you across websites, and we do not allow other companies to collect information about your online activities over time and across different websites through the Service (the font service in section 4 receives your IP address and browser information when a page loads). Because we do not track you across websites, the Service works the same way whether or not your browser sends a "Do Not Track" or Global Privacy Control signal.

7. How long we keep information

Paystub files, images, text, and pay lines: not stored on our servers.
Records of your Terms acceptance and any arbitration opt-out: 4 years after your account is deleted, so we can show what you agreed to if a dispute arises. We keep these records even if you ask us to delete your information, because they are needed for that purpose.
Account, position, account link record, and subscription information: while your account exists. When your account is deleted, we cancel any active subscription and delete this information, except records we must keep for legal, tax, accounting, or dispute purposes, such as payment records and records of your consent to automatic renewal, which California law requires us to keep for at least three years (or one year after your subscription ends, if longer).
Test cases: until you withdraw permission or delete your account.
Usage and security records: read logs for 12 months, then deleted automatically; hosting logs for as long as our hosting provider keeps them; it does not publish a fixed period.
Information saved in your browser: until you sign out, use Reset saved data, or clear your browser's site data. A calculator notice you agreed to is remembered for 60 days, even after you sign out.
Department information: as long as the department remains in the Service.

8. Security

We use encryption in transit (HTTPS) and at rest, database rules so each account can reach only its own personal records, server-only writes for your saved position and account link record, coded forms made with a secret key for identifiers, secret keys kept outside our code, and limited administrative access. No system is perfectly secure, and the Service has not been independently audited. You can add protection by blacking out identifiers before uploading and, on a shared computer such as a station computer, by signing out when you're done. If a security breach affects your personal information, we will notify you as required by law.

9. Your choices and rights

See and change your information. Your saved position is shown and editable in the app, and you can remove it with "Remove my saved position."
Correct how a paystub was read. Each report's "How we read your paystub" section lists every line as it was read and lets you correct how a line is classified.
Cancel your subscription online at any time under Manage or cancel subscription.
Delete your account in the app at any time.
Withdraw test-case permission at any time by emailing info@heropayaudit.com.
Access, correction, and deletion. Email info@heropayaudit.com to get a copy of your information, correct it, or delete your account and personal information. We will confirm the request comes from your account's email address and respond within 45 days.
California residents. We honor the rights California law gives consumers: to know what personal information we collect and how we use and share it, to delete it, to correct it, to opt out of its sale or sharing (we do neither), to limit use of sensitive personal information (we use it only to provide the Service), and not to be treated differently for using these rights. We do not disclose personal information to third parties for their own direct marketing.
Other states. We honor the same requests from users anywhere.

10. Children

The Service is for adult employees and is not directed to anyone under 18. If we learn we have information from someone under 18, we will delete it.

11. Where information is processed

The Service is operated from the United States. Our database is hosted in the western United States (Oregon), and our requests to our AI provider are set to be processed in the United States. Our payment, email, and other service providers handle information under their own terms, which may include processing outside the United States.

12. Changes to this policy

We may update this policy. For material changes, we will email you at least 14 days before they take effect. The "Last updated" date shows the current version.

13. Contact

Hero Audit LLC · 2108 N St, Ste N, Sacramento, CA 95816 · info@heropayaudit.com · Legal notices: legal@heropayaudit.com