Privacy Policy

Payslip data

The names, DNI/NIE and CIF numbers, salary figures, and company details you type into the app are used to calculate and render your payslip, on your device, and are saved there so you can download that payslip again later (see “Your saved payslips” below). They are not transmitted anywhere, not backed up to a server we control, and not visible to us. The calculation and the PDF are produced entirely on your device.

The generated PDF is written to the app’s private cache directory just long enough to hand it to the iOS share sheet, so you can save it to Files, print it, or send it wherever you choose. What happens to it after that is up to you and governed by whichever app you send it to.

What the app stores on your device

• Your language preference, and whether you have accepted the first-launch terms screen.
• A count of how many payslips you have generated, and how many purchased generations remain. This is what enforces the one-free-payslip limit.
• The payslips you generate, so you can find and download them again later without filling the form in from scratch. See the next section.

The generation count is kept in the iOS Keychain rather than ordinary app storage. Two consequences worth stating plainly, because one of them may surprise you:

• It survives deleting and reinstalling the app. That is deliberate — otherwise the free payslip could be claimed repeatedly by reinstalling. Erasing your device removes it.
• It does not sync to iCloud and is not shared between your devices. It holds the counts plus the IDs of purchases already credited, so a pack is never counted twice. No IDFA or IDFV is read by the app.

Your saved payslips

The app keeps a list of the payslips you have generated so you can re-download them from the Home screen. Each saved entry holds the details you typed: the worker’s name and NIF/NIE, the company’s name, CIF and address, the salary figures, and the date you generated it. The PDF itself is not stored — it is re-created from those details each time you download it again.

This is saved in the app’s own local storage on your device. It is never transmitted anywhere, never backed up to iCloud or to any server of ours, and there is no account or login through which we or anyone else could see it. Analytics never include these details, and on-screen text is masked in session recordings. Up to 50 payslips are kept; beyond that the oldest are dropped automatically.

You can delete any saved payslip individually, or clear the whole list at once, from the Home screen and its menu. Deletion is immediate and permanent — there is no server copy to recover, and no undo. Deleting the app also removes everything it has saved.

If you generate payslips for other people — employees, for instance — remember that their details are then stored on your phone, and that clearing the list is how you remove them.

Purchases

Buying additional payslips or the unlimited unlock is paid through Apple’s App Store. We use RevenueCat (RevenueCat, Inc.) to process and validate those purchases: the app sends RevenueCat an anonymous app user ID and your App Store transaction details (which product, when, and its status), so it can confirm the purchase and tell the app what you are entitled to. RevenueCat also receives the anonymous analytics ID described below, so purchases can be counted in our analytics. We never see, receive, or store your payment details, your Apple ID, or your name. See RevenueCat’s privacy policy.

The unlimited unlock is a purchase recorded against your Apple ID, which is why “Restore Purchases” works on any device you sign into — Apple tells the app whether the purchase exists. Purchased payslip packs are counted on the device itself and, as Apple specifies for consumable purchases, are not restorable across devices.

Apple’s handling of the transaction is governed by Apple’s privacy policy, not ours.

Analytics

To understand how the app is used and improve it, Nomina Generator sends anonymous usage analytics to PostHog, hosted in the European Union (eu.i.posthog.com). Analytics are part of using the app and are accepted on the first-launch terms screen. What is sent:

• Usage events such as opening the app, moving through the form steps, generating, exporting or sharing a payslip (with the number of months, not its contents), viewing the paywall, and purchase outcomes (which product).
• Session recordings of how screens are used, with all text and every input field masked before anything leaves the device, so names, NIF/NIE, salaries and company details are never recorded.
• A random analytics ID created by the app, plus basic device information (model, iOS version, language, app version). No name, email, Apple ID, advertising ID or payslip content. No person profiles are built.

Analytics are not used for advertising and are never sold or shared for tracking. See PostHog’s privacy policy.

What the app does not do

• No account, sign-up, email address, or login of any kind.
• No sending of payslip data (names, NIF/NIE, salaries, company details) anywhere.
• No advertising, and no advertising identifiers.
• No tracking as defined by Apple’s App Tracking Transparency framework. The app never asks for permission to track, because it never does.
• No location, contacts, photos, microphone, or camera access.

Network access

Calculating a payslip and producing the PDF never needs an internet connection. The app connects only to PostHog (analytics), RevenueCat and Apple (purchases). This is checked automatically on every build: the build fails if the app contains any other network destination.

Children

Nomina Generator is a payroll calculator with no social features, no user-generated content, and no advertising. It is not directed at children, and its analytics are anonymous.

Deleting your data

Everything the app stores is on your device. Deleting the app removes your preferences, your saved payslips, and the generated PDFs in its cache. You can also delete saved payslips individually, or clear them all, from the Home screen without uninstalling anything. As noted above, the generation count in the Keychain persists through a reinstall by design; erasing the device clears it. Analytics are anonymous and cannot be linked back to you; if you want the analytics for your device removed, email us and we will delete what we can identify.

Changes to this policy

If a future version of the app changes what it stores or introduces any network feature, this page will be updated before that version ships, and the date at the top will change.

Contact

Questions about this policy or the app: nomina@pro7ocol.com.