Privacy Policy

1. Who is responsible for your data

Eugen Ciur, Trusetaler Straße 90, 12687 Berlin, Germany ([email protected]) is the controller responsible for the processing described in this Policy, unless stated otherwise below. See our Impressum for further details. Given the small scale of our operation, we are not required to appoint a Data Protection Officer.

2. What data we collect

• Account data: your email address and name, entered directly or provided by Google if you choose "Sign in with Google". Authentication is handled by our own, self-hosted identity system, running on our servers in Frankfurt, Germany.
• Your documents: the files and metadata you upload to the Service, stored on Cloudflare R2 object storage in the EU and processed on our servers in Frankfurt, Germany.
• Payment data: when you choose a paid plan, you enter a payment card, which is charged for the subscription. Card details are entered directly with our payment provider, Stripe. We never see or store your full card number; we receive only limited information, such as the card brand, the last four digits and the payment status, plus the billing details you enter.
• Signup answers: when you create a Team workspace, you answer three short questions — how you heard about Papermerge, how you manage your documents today and the size of your team. We store the answers with your workspace.
• Emails sent to your workspace: if you use your workspace's inbound email address, we receive those emails, including the sender's address and the attachments, and add the attachments to your documents.
• Usage and log data: technical information such as IP address, browser type, and timestamps, collected automatically to keep the Service secure and reliable.
• Cookies: a small number of essential and functional cookies — see our Cookie Policy for the full list.

3. Why we process your data

• Operating your account and providing the Service — performance of a contract (Art. 6(1)(b) GDPR).
• Processing payments for a paid plan — performance of a contract (Art. 6(1)(b) GDPR).
• Sending you service emails, such as invitations, sign-in emails, trial reminders and important announcements about the Service — performance of a contract (Art. 6(1)(b) GDPR) and legitimate interest (Art. 6(1)(f) GDPR).
• Keeping the Service secure and preventing abuse — legitimate interest (Art. 6(1)(f) GDPR).
• Evaluating the answers from the signup form, to understand how customers find us and what they need, and to improve our offer — legitimate interest (Art. 6(1)(f) GDPR).
• Complying with legal obligations, such as keeping billing records under German tax law or responding to lawful requests from authorities — legal obligation (Art. 6(1)(c) GDPR).

4. Your documents and your role as controller

Documents you upload may contain personal data about third parties — for example, names on an invoice. In relation to that data, you act as the data controller, and we act as your data processor, processing it only on your instructions to provide the Service. If you require a formal Data Processing Agreement, contact us at [email protected].

5. Who we share data with

• DigitalOcean — hosting provider, servers located in Frankfurt, Germany (EU).
• Cloudflare — object storage (R2), EU-region storage.
• Stripe — payment processing. Our contract partner is Stripe Payments Europe, Ltd. (Ireland). Stripe may process data in the United States; Stripe is certified under the EU–U.S. Data Privacy Framework.
• Amazon Web Services (AWS) — receives emails sent to your workspace's inbound address, in the AWS region Frankfurt, Germany (EU).
• Resend — delivers the emails we send you, such as invitations, sign-in emails and trial reminders. Resend is based in the United States.
• Brevo (Sendinblue SAS, France) — sends service announcements by email to our users.
• GlitchTip — receives technical error reports from the Service, so we can find and fix errors.
• Google LLC — only if you choose to sign in with your Google account, for authentication purposes. Google is certified under the EU–U.S. Data Privacy Framework.
• We do not sell your personal data and do not use it for advertising.

6. International data transfers

Hosting, document storage and the processing of inbound emails take place within the European Union. Some of our service providers are based in the United States or may process data there: Stripe (payments), Resend (email delivery), and Google (only for the optional "Sign in with Google" feature). These transfers take place only under the EU–U.S. Data Privacy Framework or other appropriate safeguards, such as the EU Standard Contractual Clauses.

7. How long we keep your data

• Account and document data: for as long as your account is active. If you delete your account, we delete Your Content and account data within 30 days, unless a longer period is required by law.
• Billing records: kept for up to 10 years, as required by German tax law.
• Log and security data: retained for a limited period, typically up to 90 days, before deletion or anonymization.

8. Your rights

Under the GDPR, you have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion of your data, request restriction of processing, receive your data in a portable format, and object to processing based on our legitimate interest. You also have the right to lodge a complaint with a data protection supervisory authority — in Berlin, this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit. To exercise any of these rights, contact us at [email protected].

9. Security

We use technical and organizational measures appropriate to the size and nature of our service — including encrypted connections (TLS), access controls, and EU-based hosting — to protect your data against unauthorized access, loss, or misuse. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children.

11. Changes to this Policy

We may update this Privacy Policy from time to time. We will announce material changes on the Service or by email.

12. Contact

Questions about this Privacy Policy or your data? Contact us at [email protected].