Privacy Policy
Last updated 24 August 2026
We collect what we need to match you to studies, confirm you are one real person, and pay you. We do not sell your data, we run no advertising or analytics trackers, and researchers see your answers without your name attached.
This policy explains what PaidSay (“PaidSay”, “we”, “us”) does with information about you. It covers the PaidSay website and everything you do inside it.
1. What we collect
Account details
Your name, email address, and password (stored only as a cryptographic hash — we cannot read it). If you sign in with Google, we receive your Google account ID, name, email address, and profile picture from Google instead of a password. Optionally, a phone number.
Your participant profile
Your legal name, date of birth, gender, country, address, city, state or region, and postal code, together with the demographic answers you give during onboarding. This is what researchers screen on when deciding who a study is for.
Identity verification
When you verify your identity we collect and store images of your government-issued document (front and back), a selfie, the document type and issuing country, and your date of birth. We record that you consented, when, and from which IP address.
Your ID number is never stored in readable form. We keep only a one-way hash of it — enough to tell that two accounts presented the same document, not enough to reconstruct the number.
Technical and connection information
Each time your account is created and used we record the IP address, the country it resolves to, your internet provider and network operator, the type of connection, and whether that address is a known VPN, proxy, or Tor exit, along with a risk score. We keep this because paying strangers real money attracts people running many accounts, and the connection is usually the first place that shows.
Study activity
Your answers, how long you took, screening outcomes, attention-check results, and whether a submission was approved or rejected.
Payment information
Your chosen payout method and the cryptocurrency address you give us, your balance, and a record of each withdrawal. We never ask for and never hold bank details or card numbers.
2. Why we hold it, and on what basis
| What | Why | Basis |
|---|---|---|
| Account and profile | To run your account and match you to studies | Performance of our contract with you |
| Identity documents | To confirm you are one real adult before paying you | Your explicit consent, and our legitimate interest in preventing fraud |
| IP and connection data | To detect duplicate accounts and misrepresented locations | Legitimate interest in protecting the platform and honest participants |
| Study responses | To deliver research to the commissioning researcher and to pay you | Performance of our contract with you |
| Payment records | To pay you and to keep accurate financial records | Contract, and legal obligation |
Where we rely on your consent — identity verification in particular — you may withdraw it at any time. Withdrawing it does not undo what was done beforehand, and it does mean we can no longer verify you, which is a condition of withdrawing earnings.
3. What researchers see
Researchers receive the answers given to their study, together with the demographic characteristics the study screened on. They do not receive your name, email address, contact details, identity documents, or payout address. Results are presented to them in aggregate.
A study may itself ask you for personal information in a question. That is the researcher asking, not us, and you can decline to answer or leave the study. Researchers are contractually barred from asking for passwords, payment details, or identity documents.
4. Who else processes your data
We do not sell your personal information, and we do not share it for advertising. We use these providers to run the service:
| Provider | What they receive | Why |
|---|---|---|
| Didit | Your identity documents and selfie | Identity verification |
| ProxyCheck.io | Your IP address | Country, network, and VPN or proxy detection |
| Nothing, unless you choose to sign in with Google | Sign-in | |
| Binance | Your payout address and the amount | Sending withdrawals |
| Komoot (Photon) | What you type into the address field | Address autocomplete while you fill in your profile |
| Our email provider | Your email address | Account, verification, and payout emails |
| Our hosting provider | Data stored on our servers | Running the platform |
We may also disclose information where the law requires it, or to establish or defend a legal claim.
5. Cookies and tracking
We use cookies only to keep you signed in and to protect forms against cross-site request forgery. There is no advertising network, no analytics tracker, and no third-party pixel anywhere on this site. Nothing follows you to other websites. This is why you are not asked to dismiss a cookie banner.
Our fonts are served by Bunny Fonts, chosen over the more common alternative because it does not log visitor IP addresses or set cookies.
6. How long we keep it
- Account and profile data: while your account is open.
- Identity documents: retained after verification so that a later dispute or duplicate-account check can be resolved, and deleted when your account is closed unless we are required to keep them for longer.
- Connection logs: kept as an anti-fraud history for as long as the account exists.
- Payment records: kept after account closure where financial and tax record-keeping requires it.
- Study responses: retained by the commissioning researcher for their research purpose; our own copy is retained while your account is open.
7. Your rights
Wherever you live, you can ask us to:
- show you what we hold about you, and give you a copy;
- correct anything wrong — most profile fields you can edit yourself;
- delete your account and the data attached to it;
- restrict or object to a particular use, including anything based on our legitimate interests;
- withdraw consent you previously gave.
Email support@paidsay.com and we will answer within 30 days. We will ask you to confirm it is really you before acting, which is itself a protection.
Some data survives a deletion request where the law requires it — payment and tax records in particular — and we will tell you specifically what was kept and why.
If you are in the UK or EU you also have the right to complain to your data protection authority. If you are in California, we confirm that we have not sold or shared personal information in the preceding twelve months, and that you will never be treated differently for exercising a privacy right.
8. How we protect it
Traffic is encrypted in transit. Passwords are hashed and cannot be recovered, only reset. ID numbers are stored as hashes. Identity documents are held outside the public web root and are reachable only through an authenticated, access-controlled route. Administrative actions on accounts are logged. Changing your payout address triggers an alert to you and pauses withdrawals for 24 hours.
No system is perfectly secure. If a breach affects your personal data we will tell you and the relevant regulator as the law requires.
9. International transfers
PaidSay operates internationally, and the providers listed above may process data in countries other than yours. Where data leaves a region that restricts transfers, we rely on the safeguards available for that transfer, such as standard contractual clauses.
10. Children
PaidSay is for adults. You must be at least 18 to hold an account, and we do not knowingly collect information about anyone younger. If you believe a minor has created an account, email support@paidsay.com and we will remove it.
11. Changes to this policy
We may update this policy. The date at the top always shows the current version, and material changes are notified by email or in the platform before they take effect.
12. Contact
PaidSay
2153 S Union St, Stockton, CA 95206
support@paidsay.com
See also our Terms of Service.
Questions about this page? Email support@paidsay.com.