How EarnWell protects your data

EarnWell runs on Lovable Cloud, a managed backend service built on Supabase. Lovable Cloud provides the database, authentication, storage and edge infrastructure that powers the application. Data is held in cloud infrastructure operated by Lovable Cloud's underlying providers.

Payment processing is handled by Stripe. We do not store card numbers, CVV codes or full payment instrument details on our own systems. Stripe processes billing, tax, invoices and receipts on our behalf.

AI-generated answers in the “Ask EarnWell” assistant are produced by third-party model providers. Prompts are sent to those providers only to generate a response and are not used to train their models.

We apply the following technical and organisational measures to protect data:

• Encryption in transit and at rest for data held in the Lovable Cloud infrastructure.
• Row-Level Security (RLS) on every production database table, so users can only read or modify data they are authorised to access.
• Server-side enforcement of sensitive operations. Benchmarks, subscription checks, AI access, seat management and employer data access run through authenticated server functions, not direct client calls.
• Authentication via Supabase Auth with secure session management.
• Rate limiting on the AI assistant endpoint and other high-value surfaces.
• Audit logging of AI usage events and security-relevant actions.
• Least-privilege access to production infrastructure and service credentials.

Our most recent security scan returned no open findings across the database, connector and application layers. Security scans are run regularly, but scanning does not guarantee that no vulnerability exists.

Users sign in with email and password or Google OAuth. Sessions are managed securely through Supabase Auth. Employer subscriptions, team seats and bulk uploads are tied to authenticated user identities and verified server-side before any data is returned.

Team seats are invited by email and must be accepted by the invited user. Seat entitlements are checked against the active subscription on every request.

We collect the minimum data needed to operate the platform. For individuals, this is account information and voluntarily submitted compensation details (role, level, location, base, bonus, equity, tenure). For employers, this includes company profile information, seat assignments, and optionally bulk pay files used to generate internal analyses.

Compensation submissions are stored and then aggregated into de-identified statistical benchmarks. Individual submissions are not displayed to other users in a way that identifies the contributor.

Full details are available in our Privacy Notice.

We use strictly-necessary cookies for authentication and session management. We also use minimal first-party analytics to understand feature usage and improve the product. We do not use advertising cookies or third-party ad trackers.

We keep account data while your account is active and for a reasonable period afterwards to meet legal, tax and audit obligations. De-identified compensation submissions may be retained indefinitely within aggregated datasets because they can no longer be linked back to an individual.

Users can request deletion of their account and identifiable data through their profile page or by emailing us. We will action deletion requests in line with our legal obligations.

SpaceNation Pty Ltd uses Proton Mail as its preferred email provider for security and privacy correspondence. All security and privacy enquiries should be directed to spacenation@protonmail.com, which is protected by Proton Mail's encrypted email service.

If you discover a security issue or have a vulnerability to report, please email spacenation@protonmail.com. We will respond as quickly as we can and work with you to resolve the issue responsibly.

For privacy questions, data requests or general security enquiries, contact spacenation@protonmail.com.