🔒Privacy policy

NetSalaryApp is an independent project operated from Latvia, and is the controller for the purposes of the EU General Data Protection Regulation (GDPR).

For any question about this policy or about your data, write to the contact form. We answer privacy requests within 30 days, as Article 12(3) requires.

The tax engine is ordinary code that runs in your browser. When you enter a gross salary, choose a country, or set a marital status and number of dependants, that input is used to compute a result on your own device. It is not transmitted to us, not written to a database and not logged.

Four qualifications, so this claim is exact:

• Shareable result links. If you copy a URL containing ?gross=, the figure is in the address itself. Anyone you send it to can read it, and it appears in our server logs like any other URL. That is the nature of a shareable link, and it only happens when you deliberately create one.
• AI insights. If you ask for an AI insight on a result, the figures on screen are sent to Anthropic to generate the commentary. This only happens when you press the button.
• The AI advisor. Messages you type at /chat are sent to Anthropic to produce a reply. Do not put information in that box you would not want processed by a third party.
• Analytics events name the country, not the money. When a calculation completes, an event recording the country, the period (monthly or yearly) and the tax year is sent to Google Analytics, subject to the consent state described below. The salary amount is not included in it.

• Account data, if you create an account: your email address and the authentication identifiers from your sign-in method, including Google sign-in. Legal basis: performance of a contract, Art. 6(1)(b).
• Data you save to a wealth, cashflow or net-worth view while signed in. It is stored against your account so it is there next time, and it is yours to delete. Legal basis: Art. 6(1)(b).
• Billing data, if you buy a subscription, a guide or a job listing. Stripe handles the payment; we keep the subscription status and an invoice reference. We never see or store your card number. Legal basis: Art. 6(1)(b) and, for keeping invoices, Art. 6(1)(c).
• Job postings you submit as an employer, including the company details and logo, which are published by design. Legal basis: Art. 6(1)(b).
• Server logs kept by our host, containing IP address, user agent, and the URL requested. These are short-lived and used to keep the service up and to investigate abuse. Legal basis: legitimate interest, Art. 6(1)(f).
• Analytics and advertising data, but only after you consent. Legal basis: consent, Art. 6(1)(a).

The form on our contact page takes your name, email address and message and sends them to us by email so we can reply. That is the whole of it: the message is not stored in a database, not added to any mailing list, and not used for marketing. Legal basis: our legitimate interest in answering people who contact us, Art. 6(1)(f).

The form is protected by Cloudflare Turnstile, which checks that the sender is a person rather than a script. Turnstile was chosen over reCAPTCHA precisely because it sets no tracking cookie and does not profile you across sites; Cloudflare receives your IP address and basic browser signals solely to score that one check.

We also record the sending IP address in memory for an hour to limit how many messages one connection can send. It is not written to disk and not linked to anything else.

When you first arrive you are asked to accept or decline non-essential cookies. To be precise about what that does, because the distinction matters: the Google tags are present in the page from the first load, but they start in a denied state under Google Consent Mode v2 — ad_storage, ad_user_data, ad_personalization and analytics_storage are all denied by default. In that state no analytics or advertising cookie is written, no advertising identifier is read, and any ad shown is non-personalised. Accepting flips those signals to granted; declining leaves them denied.

So the honest description is “loaded but not permitted to store anything”, not “not loaded”. Your browser does contact Google on every page either way.

You can change your mind at any time by clearing this site’s data in your browser, which brings the banner back.

This site is free, and advertising is what pays for it. We use Google AdSense. Where you have accepted advertising cookies:

• Google and its partners may use cookies and similar identifiers to serve and measure ads based on your visits to this and other sites.
• You can opt out of personalised advertising by Google at Google Ads Settings, and opt out of third-party vendors at aboutads.info/choices.
• Google’s own description of how it uses data from sites that use its services is at policies.google.com/technologies/partner-sites.

If you decline advertising cookies, no personalised advertising is served to you and the calculators keep working exactly as before.

We do not sell personal data. The following processors and services are used, each for the stated purpose only:

Where a service processes data outside the EEA, that transfer relies on the European Commission’s Standard Contractual Clauses or an adequacy decision, as set out in each provider’s own policy linked above.

• Account and saved data: until you delete the account, then removed.
• Invoices and payment records: seven years, because tax law in the operating jurisdiction requires it.
• Server logs: a rolling window of no more than 30 days.
• AI advisor conversations: stored in your own browser only, so that your history is there when you come back. We keep no server-side copy — which also means clearing your browser data deletes them permanently, and we cannot retrieve them for you.
• Calculator inputs: never stored, so nothing to retain.

Under the GDPR you can ask us to give you a copy of your data (Art. 15), correct it (Art. 16), delete it (Art. 17), restrict or object to processing (Arts. 18 and 21), or send it to another provider in a portable form (Art. 20). Where processing rests on consent you can withdraw it at any time, without affecting what was done beforehand.

Write to the contact form. You can delete your account yourself at any time from your account page. If you think we have handled your data badly you may complain to your national data protection authority; the list is at edpb.europa.eu.

The site is intended for working adults and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, tell us and we will remove it.

When this policy changes materially the date at the top of the page changes with it. If you want to be certain nothing has changed since you last read it, that date is the thing to check.