Privacy Policy

PayStandards Inc. is an enterprise software company that helps organizations plan and review pay and achieve pay equity.

We take your privacy seriously. This Privacy Notice describes PayStandards Inc.’s policies and practices regarding its collection and use of your personal data, and sets out your privacy rights. Information privacy is an ongoing responsibility, so we will update this Privacy Notice from time to time as we adopt new personal data practices or privacy policies. The date of the current version appears at the top of this page.

This Privacy Notice covers three groups of people:

1. 1Visitors to our website and prospective customers.
2. 2People who use the PayStandards platform on behalf of a customer (managers, approvers, Reward and HR teams, and administrators).
3. 3Employees, job candidates and other individuals whose compensation or HR data our customers process in the PayStandards platform. This group is described in the section “Customer data processed on the PayStandards platform” below. If you are in this group, your employer or prospective employer decides how your data is used, and you should contact them first with any question or request.

PayStandards Inc. is a Delaware corporation headquartered in New York, United States. We have designated a privacy lead whom you can contact with any question or concern about our personal data practices, or to exercise your privacy rights: privacy@paystandards.com.

Website visitors and prospective customers

We collect business contact information about website visitors, prospects and customer contacts. With few exceptions, this is limited to name, job title, employer name, work address, work email and work phone number. We use it to respond to enquiries, schedule and run demonstrations, provide and support our services, and send service and marketing communications that you can opt out of at any time. We do not sell personal information, and we share it only with service providers that help us deliver our services.

From time to time we receive personal information about individuals from third parties, typically further details about your employer or industry, and we may collect business contact details from public professional sources such as LinkedIn.

Platform users

If you use the PayStandards platform on behalf of a customer, we also process:

• Your account details (name, work email address, role, and the organization and reporting line you belong to), usually received from your organization’s single sign-on or directory provider.
• Your sign-in and authentication records.
• A record of the actions you take in the platform (for example recommendations viewed, edits, approvals, overrides, exports and changes to settings). This record forms part of the customer’s audit trail and is visible to the customer’s administrators.

Notification emails we send to platform users contain links and context, never an individual’s pay figures.

PayStandards support staff can open a time-limited “sign in as user” session on a platform user’s account only to resolve a support request, with a stated reason. Such sessions are visibly labelled, are logged under both the support engineer’s and the user’s identity, and are reportable to the customer. PayStandards has no standing access to a customer’s tenant.

Our customers use the PayStandards platform to plan and review pay: annual merit, bonus and long-term incentive planning; new-hire offer recommendations; off-cycle adjustments, promotions and counter-offers; and pay equity and pay transparency analytics. To do this, a customer provides employee compensation and related HR data, and, for the new-hire features, limited data about job candidates.

What we process

Typically: employee identifiers, name and work email; role, job level, job family, department, location, manager and reporting line; base pay, bonus and long-term incentive amounts and targets; performance information; comparable market data; and, for candidates, the requisition, the candidate’s name and email and the offer or target salary under consideration. This data reaches PayStandards only through an HR system connection authorised by the customer, or through authenticated upload or file transfer by the customer’s own users.

What we do not need

PayStandards does not require, and asks customers to keep out of the connection and any file they supply:

• Government identification and tax numbers
• Bank account and payroll payment details
• Date of birth
• Marital status
• Nationality
• Dependants and beneficiaries
• Benefits enrolment
• Health and absence data
• Immigration data
• Background checks
• Disciplinary records
• Photographs
• Street-level home addresses
• Personal telephone numbers

The platform does not run payroll and holds no payment details.

Protected attributes

No special category or protected attribute data (for example ethnicity or gender identity) is required by any PayStandards feature. If a customer chooses to supply such data for pay equity (adverse impact) testing, it is held in a separate, access-restricted store apart from the employee record, is never used as an input to the pay model or the recommendation engine, is never shown to managers or included in any language-model prompt, and is reported only in aggregate with minimum cohort sizes applied. PayStandards never assigns or infers a protected attribute.

Who decides

The customer is the data controller for its employees’ and candidates’ data; it decides why and how the data is used. PayStandards is a processor and acts only on the customer’s documented instructions under a Data Processing Agreement. We do not sell this data, we do not use it for marketing, we do not use one customer’s data or models for another customer, and we do not use it for any purpose other than providing the service to that customer.

Automated decision-making

Pay recommendations produced by the platform are not solely automated decisions. Every compensation action is reviewed and approved by a person at the customer before it takes effect, and overrides are recorded. If you want to contest a decision, request an explanation of the factors behind a recommendation, or obtain human intervention, contact your employer; PayStandards assists customers with these requests.

Your requests

If you are an employee or candidate of one of our customers and want to access, correct or delete your data, or have questions about how your employer uses it, please contact your employer first. We assist our customers in responding to these requests, and you may also email privacy@paystandards.com.

PayStandards Inc. collects certain information automatically when you visit our website and stores it in log files. This may include internet protocol (IP) address, the region or general location from which your device accesses the internet, browser type, operating system and other usage information, including the pages you view. We use this information to design our site to better suit visitors’ needs, to diagnose problems with our servers, to administer the website and to analyse trends. PayStandards Inc. has a legitimate interest in understanding how visitors, prospects and customers use its website so that it can provide relevant products and services and staff its support appropriately.

We use Vercel Analytics to understand how visitors use our website, such as which pages are viewed and how the site performs. Our demo page embeds a HubSpot meeting scheduler; if you book a meeting, the details you enter (for example name, work email address and company) are received and stored by HubSpot on our behalf, and HubSpot also serves as our customer relationship management system for prospect and customer contact records.

Our website uses a limited set of cookies and similar technologies. Our analytics provider (Vercel) measures page views and site performance without identifying individual visitors. The HubSpot meeting scheduler embedded on our demo page may set its own cookies, which are governed by HubSpot’s cookie policy. You can block or delete cookies at any time through your browser settings, although parts of the website, such as the scheduler, may not work as a result. Where required by law, we ask for your consent before setting non-essential cookies.

Our website contains links to third-party sites, such as LinkedIn. If you follow one of these links, you leave our website and that site’s own privacy policy applies.

Parts of the PayStandards platform use artificial intelligence to explain pay recommendations and to answer questions about them. Recommended figures come from a deterministic calculation engine and a statistical model fitted on the customer’s own data; a language model describes those figures and answers questions, and never sets a figure. Every recommendation is advisory: no compensation action is carried out without explicit approval by a person, and overrides are recorded. The conversational and analyst assistant surfaces, and the Microsoft Teams surface, are optional and enabled by each customer.

Language-model providers

When we use a third-party language-model provider (OpenAI by default; Anthropic or Google at the customer’s election), we send requests to that provider’s API under commercial terms that prohibit the provider from using the data to train its models, with zero data retention where the provider offers it. Customers can exclude any field, including names and email addresses, from AI processing, and the AI features do not need names or email addresses to work. Customers can also use their own provider account and key, in which case AI requests run under the customer’s own provider agreement and region and the provider acts as the customer’s processor rather than ours.

Predictive models

A customer’s predicted-pay model is trained on PayStandards-operated infrastructure using only that customer’s data, and is never shared with or used for another customer. Customer data is never used to train shared or third-party models.

AI records

We keep a record of every AI request (for example the model used, usage and cost) so that customers can audit how AI was used. Whether the content of prompts and responses is also stored is a per-customer setting: by default it is stored for 90 days and then purged daily; the customer’s administrators can turn it off or shorten the period.

We use a limited number of service providers (sub-processors) to run our services. They may access personal information only to provide their services to us, under written terms that protect it to a standard equivalent to this Privacy Notice and our customer Data Processing Agreement.

We give customers at least 30 days’ notice before a new sub-processor processes their data. The current list, with contracting entities and transfer mechanisms, is available on request and is attached to each customer’s Data Processing Agreement.

We do not otherwise disclose your personal data to persons or businesses outside PayStandards Inc. for their independent use unless:

1. 1You request or authorise it.
2. 2The disclosure is required to comply with the law (for example a search warrant, subpoena or court order), to enforce an agreement we have with you, or to protect our rights, property or safety or those of our employees or others.
3. 3The information is provided to our agents, vendors or service providers who perform functions on our behalf.
4. 4It is needed to address an emergency.
5. 5It is needed to address a dispute or claim, or is provided to a person demonstrating legal authority to act on your behalf.
6. 6It is transferred to a successor of PayStandards Inc. by way of merger or sale of all or substantially all of its assets, provided the successor agrees to restrictions on use and disclosure substantially consistent with this Privacy Notice.

We may produce aggregated, de-identified statistics about use of our website and services that identify no individual and no customer, and use them to operate, secure and improve our services. Data our customers process in the PayStandards platform is used only to provide the service to that customer; it is never shared with advertisers or used for marketing.

PayStandards Inc. is headquartered in the United States, and the PayStandards platform is hosted in the United States by default: the data tier on Amazon Web Services and the web tier on Render. Personal data we collect from website visitors and prospects is stored and processed in the United States.

Customers whose data is subject to European Union or United Kingdom law can ask for their PayStandards environment to be hosted in an EU or UK region, with the application, database, storage and backups for that environment kept in the chosen region. Some supporting services operate in the United States regardless of the chosen region: identity federation (WorkOS), monitoring (Datadog) and, unless the customer uses its own provider key, the language-model provider. These services process account, sign-in and telemetry data, not compensation records.

Where personal data is transferred from the European Economic Area or the United Kingdom to the United States, the transfer is governed by our Data Processing Agreement, which incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, and is supported by a transfer impact assessment that we make available to customers on request. Personal data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256), and we use pseudonymized identifiers wherever possible.

If you have questions about international transfers of your personal data, please email privacy@paystandards.com.

European Union and United Kingdom

The General Data Protection Regulation (GDPR), the UK GDPR and other countries’ privacy laws give data subjects rights, including:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to data portability
• Right to object
• Rights related to automated decision-making including profiling

If you wish to confirm that PayStandards Inc. is processing your personal data, or to have access to the personal data we may hold about you, please contact us. You may also request information about the purpose of the processing; the categories of personal data concerned; who outside PayStandards Inc. has received the data; the source of the information (if you did not provide it directly); and how long it will be stored. You have a right to correct the record of your personal data if it is inaccurate, to request that we erase it or cease processing it, subject to certain exceptions, and to ask us to stop using your data for direct marketing. When technically feasible, we will provide your personal data to you in a portable format at your request.

Reasonable access to your personal data is provided at no cost. We respond within one month of a verified request; if we cannot provide access within that time, we will tell you when the information will be provided. If access is denied, we will explain why. You also have the right to lodge a complaint with your national data protection authority or, in the UK, the Information Commissioner’s Office.

California and other US states

For data our customers process in the platform, PayStandards acts as a service provider (processor) under the California Consumer Privacy Act as amended by the California Privacy Rights Act, and under comparable state privacy laws; your employer or prospective employer is the business responsible for that data, and requests should be directed to them. For personal information we collect directly from website visitors and prospects, California residents have the right to know what personal information we collect, use and disclose; to request deletion or correction; and to not be discriminated against for exercising these rights. PayStandards does not sell personal information and does not share it for cross-context behavioural advertising, so there is no opt-out to offer. We respond to verified requests within 45 days.

Where the data belongs to a customer

Requests about data held for a customer are passed to that customer, who decides how to respond; we assist within the timescales in our Data Processing Agreements.

For questions, requests or complaints concerning the processing of your personal data, email privacy@paystandards.com.

Your personal data is stored on servers operated for PayStandards Inc. by the cloud service providers listed above, in the United States or, for customers who have chosen one, in an EU or UK region.

Customer data

We retain customer data for the duration of the customer’s subscription. On termination we delete it on the customer’s instruction: immediately, or after a retrieval window of up to 90 days that the customer may elect in order to export its data. We confirm deletion with a written certificate. Deletion covers the tenant database, object storage, model artefacts, derived outputs and AI interaction logs; the tenant’s encryption keys are destroyed, so any remaining backup copies are unreadable as they age out under our point-in-time recovery policy; and our sub-processors are instructed to delete their copies within their published periods. Customers can also instruct deletion of any dataset, population or individual at any time.

Decision records and audit trail

Decision records (recommendations, edits, overrides, approvals and final decisions) and the application audit trail, which records who did what in the platform, are kept for the subscription term so that past recommendations remain reproducible, unless the customer’s retention schedule requires earlier deletion. They are exportable at any time and are deleted with the customer’s data.

Security and operational logs

Retained for one year by default; a customer can choose a shorter period, such as 30 days. Customers can also shorten retention for AI interaction logs, conversations, uploaded files and exports.

Prospect data

We retain prospect data until it no longer has business value, after which it is purged from our systems.

All personal data that PayStandards Inc. controls may be deleted upon verified request from data subjects or their authorised agents. For more information on where and how long your personal data is stored, contact privacy@paystandards.com.

We protect personal data with technical and organisational measures designed for sensitive compensation data. All data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256, and sensitive compensation fields receive an additional layer of application-level encryption. Encryption keys are managed in AWS Key Management Service, with a separate key for each customer, and customers can use their own keys with the ability to revoke them.

Each customer’s data is isolated from every other customer’s: each customer is provisioned a dedicated database with its own encryption keys and its own statistical model, and the shared identity and configuration store is protected by row-level security and tenant-scoped access in the application.

Access is role-based and follows least privilege. Production access is limited to named platform administrators, requires multi-factor authentication, is logged, and is reviewed. Customers sign in through their own single sign-on provider, and administrators can stream audit events to their own security monitoring tools.

Development and test environments use de-identified or synthetic data, or data from the customer’s own scrambled HR sandbox, never production data.

If a security incident affects a customer’s data, we notify the customer without undue delay and no later than 48 hours after becoming aware of it, and we do not withhold notification pending full investigation.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Our website and services are directed at businesses and their personnel. We do not knowingly collect personal information from children under 16.

We will post any changes on this page and update the revision date at the top. Where a change materially affects how we use personal data already collected, we will notify customers in advance through their account contacts.