Privacy policy

1. Who is responsible for your data

Paperswift is operated by Paperswift Solutions, registered in Ontario, Canada. For the purposes of Canada's PIPEDA and the EU and UK GDPR, Paperswift Solutions is the controller of the personal information described here. Contact: stefan@paperswift.io. This policy covers paperswift.io and app.paperswift.io.

2. What we collect

• Account data. Your email address, and a hashed password if you sign up with one. If you sign in with Google, we receive your name and email address from Google.
• Billing data. Handled by Stripe. We see your subscription status, invoices, and the last digits of your card; full card details never reach us.
• Your files. On the Free and Pro plans, files are processed in your browser and are not uploaded to our servers. On the Teams plan, files you choose to save are stored encrypted with Supabase.
• Questions you ask. The question text plus your column names and whether each column holds text, numbers, or dates — never the values in your rows, sent to the AI provider to produce the answer. The demo on the website sends only your question and a public sample's schema — never your data. We also store the demo question itself: the text you typed, which public sample it was asked of, whether it was answered, and a random id your browser generates so we can group your questions — so we can see what people ask and make the samples better. No IP address, no account.
• Analytics. paperswift.io uses Plausible: cookieless, aggregate statistics that do not identify you. As well as counting page visits it counts a few actions — a question asked of the demo, a waitlist form submitted, a click through to the app — as totals only. The question you typed is never part of that count. The app currently runs no analytics; if that changes, we will update this policy first.
• Logs. Our host keeps standard request logs (IP address, user agent) for security and debugging, retained briefly.
• Waitlist. If you join the waitlist for a plan that is not released yet, we store the email address you type, which waitlist it was, which page you joined from, the date, and how you got here: the campaign tag on the link you clicked, the name of the site that linked you (the site, such as news.ycombinator.com — never the page or what you were reading), and the first page of ours you landed on. That last part is how we learn which writing is worth doing. No IP address, no device fingerprint, nothing about anywhere else you have been, no account is created, and joining is not signing up.
• Correspondence. Emails you send us.

3. Why we process it

Under the GDPR each purpose needs a legal basis; here they are, and the same list is the whole of what we do with your data under PIPEDA:

• Running the service — accounts, saved Teams files, answering your questions, support. Basis: performing our contract with you.
• Billing — payments, invoices, tax records. Basis: contract and legal obligation.
• Security and debugging — request logs, abuse prevention. Basis: legitimate interest in keeping the service working and safe.
• Improving the demo — storing the questions typed into the website demo, which are asked of public samples and not of your data, so we can see what people ask and improve the samples and the product. Basis: legitimate interest in improving the site.
• The waitlist — telling you once when the plan you asked about is available. Basis: your consent, given by typing your address into that form. We do not add waitlist addresses to any other mailing.
• Product-update emails — occasional news about the product to account holders, with an unsubscribe link in every message. Basis: consent or legitimate interest, as your jurisdiction requires; transactional emails (receipts, security notices) are sent regardless because the service needs them.

We do not sell personal information, run advertising, or use your data to train AI models.

4. Cookies and browser storage

The app sets essential cookies to keep you signed in; nothing else. The marketing site sets no cookies at all, which is why there is no cookie banner: there is nothing here that follows you.

It does keep one small thing on your device, and we would rather spell it out than let “no cookies” do work it has not earned. If you arrive from a tagged link or another site, your browser holds on to the campaign tag and the name of the linking site until you close the tab. It is session storage rather than a cookie, so it is gone when the tab is; it is read in exactly one place, when you submit the waitlist form, and never sent anywhere otherwise; and it describes a link, not a person.

5. Subprocessors

6. Where your data lives

Account data and saved Teams files are stored with Supabase in the United States. Because we are a Canadian business using subprocessors abroad, your information may be subject to the laws of the countries where it is stored. Transfers from the EEA, UK, and Switzerland rely on our subprocessors' data-processing agreements incorporating Standard Contractual Clauses.

7. How long we keep it

• Account data: while your account exists, then deleted on request.
• Saved Teams files: until you delete them or your account is deleted.
• Request logs: days to a few weeks.
• Waitlist addresses: until the plan launches and we have written to you, or until you ask us to remove yours — whichever comes first.
• Demo questions: kept while they are useful for improving the demo, then cleared; ask us and we will remove yours.
• Billing records: as long as tax law requires (in Canada, generally seven years).

8. Your rights

Email stefan@paperswift.io to access, correct, export, or delete your personal information, or to object to or restrict processing. Account deletion currently works by email; we confirm and complete requests within 30 days. You can withdraw consent at any time, and unsubscribe from product-update emails with the link in any of them.

If you are unsatisfied with our answer you can complain to a regulator: in Canada, the Office of the Privacy Commissioner; in the EEA or UK, your local supervisory authority. Residents of some US states have similar rights, and we honor the requests above for everyone regardless of where they live.

9. Security

Traffic uses TLS 1.2+; stored account data and Teams files are encrypted at rest. The larger safeguard is architectural: on most plans your file contents never reach us, so they cannot leak from servers they were never on. We are not SOC 2 certified yet. If a breach creates a real risk of significant harm, we will notify affected people and the required regulators without undue delay, within 72 hours where the GDPR applies.

10. Children

The service is not directed at children and requires you to be the age of majority where you live. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this policy

Updates appear on this page with a new date above; for material changes we will email account holders before they take effect.

12. Contact

Paperswift Solutions, Ontario, Canada — stefan@paperswift.io.