Privacy
The Firm File sets no cookies, runs no analytics, loads no third-party scripts and uses no web fonts. Nothing is stored about you when you read a salary page. The only personal data this site holds is what you type into the offer form yourself, and this page lists every field of it.
Last updated 13 November 2026. This policy covers the website only.
Who is responsible
The data controller is Gaudas Palubaitis. Privacy questions and any request about your own data go to gaudas@palubaitis.com, which is the contact point for every right listed below.
Reading this site collects nothing
Every salary page is built in advance and served as a static file. There is no cookie banner because there are no cookies to consent to. There is no analytics script, no advertising pixel, no embedded video, no commenting widget, no social button and no externally hosted font. The page you are reading makes no request to any third party.
The server that delivers the page sees your IP address, as every web server must in order to send you a reply. It is written to the host’s request log, it is not written to our database, and it is not used to build a profile.
What the offer form collects
Submitting an offer is voluntary. Nothing on this site is withheld from people who do not submit. If you do submit, this is the complete list of what is stored:
| Field | Required | What it is |
|---|---|---|
firm_slug | yes | Which firm, chosen from a fixed list |
role_slug | yes | Which level, chosen from a fixed list |
city | optional | The office city, if you type one |
offer_year | yes | The year of the offer |
base | yes | Base salary |
signing | optional | Signing bonus |
bonus | optional | Performance bonus |
bonus_status | optional | Whether that bonus is paid or expected |
evidence | yes | Whether you hold an offer letter, a payslip or neither. The document itself is never requested or accepted |
email | optional | Only if you choose to give one, so a figure can be checked before it counts |
ip_hash | yes | A salted one-way hash of your IP address, for rate limiting. The address itself is not stored |
There is no account, no password and no login. We do not ask for your name, your employer’s internal identifiers, your job start date or any document. Never upload or paste an offer letter, a payslip or any other document. The form asks only whether you hold one, and there is nowhere on this site to send a file.
Why, and on what legal basis
| Data | Purpose | Basis under the GDPR |
|---|---|---|
| The offer figures, firm, level, city and year | Published only as an aggregate, so that the next candidate can see a real number instead of an estimate | Consent, Article 6(1)(a), given by sending the form |
| Your email address, if you give one | To come back to you if a figure needs checking before it is counted | Consent, Article 6(1)(a) |
| A salted one-way hash of your IP address | Rate limiting, so one person cannot flood the dataset with invented offers | Legitimate interest, Article 6(1)(f), in keeping the data honest |
The IP hash is salted with a secret the database never sees and then truncated. It cannot be reversed into your address, and it is never displayed anywhere. The raw address is not stored.
You can withdraw consent at any time, and withdrawing it is as easy as giving it: one email. Withdrawal does not affect anything already published as an aggregate, because an aggregate is no longer your data.
What actually gets published
Aggregates, never your row. A figure appears on this site only when at least five separate submissions sit behind it, so no published number can be traced back to one person. Below that threshold nothing is shown at all, not a count, not a range and not a rounded hint. This is enforced once, in the export step, and the website is never given the data it would need to break the rule.
Your email address is never published, never used for a newsletter and never passed to anyone.
How long it is kept
| Data | Deleted after |
|---|---|
| The salted hash of your IP address | 7 days |
| Your email address | when the submission has been reviewed, and at most 90 days |
| A submission that is rejected | 30 days |
| A submission that is counted | 24 months, after which only the aggregate remains |
These are not intentions. They run as a scheduled database job, and the aggregate that survives contains no personal data.
Who else touches it
Two processors, both bound by a data processing agreement, and no one else. Your data is never sold, never licensed and never shared with any firm named on this site.
- Vercel hosts the website and holds request logs.
- Supabase hosts the database the form writes to. The project runs in an EU region.
Both are United States companies, so a transfer outside the European Economic Area is possible through their support operations. Both rely on the European Commission’s Standard Contractual Clauses for that, and the data itself is stored in the EU.
No automated decision-making and no profiling of any kind takes place. Submissions are reviewed by a person.
Your rights
You may ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, ask for its use to be restricted, object to its use, ask for it in a portable format, or withdraw your consent. Email gaudas@palubaitis.com and you will have an answer within 30 days. There is no fee.
Because there is no account, say which firm and level you submitted and roughly when. That is enough to find the row. If it cannot be found with certainty, nothing will be deleted on a guess, and you will be told.
If you are unhappy with the answer you can complain to the data protection supervisory authority where you live. Every country in the European Economic Area has one.
Children
This site is for people applying to graduate and experienced-hire roles and is not directed at anyone under 16. No submission is knowingly kept from a child.
Security
The form is validated on the server, not only in the browser. The database table holding submissions has row level security on with no public policy, so nothing reaches it except the one server route that writes to it. Nobody browsing this site can read anyone’s submission, including their own.
Changes
If this policy changes in a way that affects data already collected, the change will not be applied to it retroactively without asking you first.