Privacy Policy

1. Controller

The controller responsible for processing your personal data is:

For all questions about data protection and to exercise your rights, write to me at [email protected]. I have not appointed a data protection officer.

Your right to object

2. Categories of personal data

Depending on how you use Paperarchive, it processes the following categories of personal data:

• Account data: Email address, name (optional), password, two-factor settings, sign-in method (password, Google or Apple), language, time zone and settings. Passwords are stored only as hashes, never in plain text.
• Document data: The files you upload, forward by email or import, with their content, the recognized text (OCR) and metadata. For documents that arrive by email, Paperarchive also keeps the original email as an .eml file (sender, recipient, subject, text and attachments).
• Data derived from your documents: What Paperarchive creates from your documents: document names, summaries, categories, senders, tags, amounts, dates and deadlines, events such as an open invoice, embeddings (numerical representations of the text for search) and patterns learned from your corrections, for example which category you prefer for a sender.
• Search data: Your search queries and questions, the AI answers with their sources and your ratings of answers.
• Payment data: Name, email address, billing address, subscription status, invoices and the payment method, processed by Stripe. Paperarchive does not store card numbers.
• Usage data: Features you use, number of documents, usage counters for AI features and, if you are a member of a shared space, your changes in that space. When you sign up: how you found Paperarchive (campaign parameters of the link, the referring website without path, the first page of the website you opened), the sign-up method and the platform.
• Technical data: IP address, browser, operating system, device information and access times in server logs. For the list of your active sign-ins, the sign-in service keeps the IP address and the browser of each session; you can end any session yourself in your profile. In the apps additionally the push token of your device.
• Communication data: Content of your emails to support and my replies.
• Marketing data: For the newsletter: email address, name, time of your confirmation (double opt-in) and campaign interactions. For the quiz result email you request: the email address and name you enter and your quiz answers; if you also give your marketing consent in the quiz, the time you confirmed it by email (double opt-in).

3. Purposes and legal bases

Paperarchive processes personal data only for the following purposes. The table names the legal basis for each processing activity. Where it says legitimate interest, the interest is stated, and you can object (see Your right to object).

4. Special categories of personal data

Documents you store can contain special categories of personal data under Art. 9 GDPR, for example health data in doctor's invoices or medical findings, religious affiliation on a payslip (church tax) or trade union membership. Paperarchive processes such data only to store, read, organize and find your documents as you instruct by uploading them, and for no other purpose: no profiling, no advertising and no training of AI models. For your own data, the legal basis is your explicit consent, which you give by deliberately uploading such a document (Art. 9(2)(a) GDPR); you can withdraw it at any time by deleting the document. Where you keep a document to establish, exercise or defend legal claims, Art. 9(2)(f) GDPR applies as well. If a document contains data of other people, you are responsible for being allowed to store it. For business customers, Paperarchive processes their documents on their behalf under a data processing agreement.

5. AI processing and automated decisions

Paperarchive uses Microsoft Azure OpenAI Service (Microsoft Ireland Operations Ltd.). The Azure resource is located in Frankfurt (Germany West Central), and the models run as EU Data Zone deployments, so the AI processing takes place in Microsoft data centers in the EU.

Paperarchive uses the AI to classify documents (type, category, sender), to extract details such as amounts, dates, deadlines and bank details, to write document names and summaries, to answer your questions in search with sources and to create embeddings for the semantic search. Only text is sent (the recognized text of the document or your question with relevant excerpts), not the file.

The results are stored with the document in Paperarchive and are deleted together with the document. Microsoft does not use the data to train models. To detect abuse, Microsoft can store inputs and outputs for up to 30 days in the EU; if abuse is suspected, authorized Microsoft staff can review them.

These automated processes help organize your documents but do not make decisions that have legal or similarly significant effects on you (Art. 22 GDPR). You can edit or override every AI result. Paperarchive does not pay, cancel or report anything on its own.

6. Content check of uploads

To comply with applicable law and protect all users, Paperarchive checks uploaded documents automatically with the SafeSearch detection of Google Cloud Vision (for digital PDFs only the first page) for the following categories:

• Adult content (explicit or pornographic material)
• Violent content (graphic depictions of violence)
• Racy content (suggestive but not explicit material)
• Spoof content (potentially misleading or deceptive material)

If content in one of these categories is detected above a threshold, the file is deleted automatically (if the document is protected in a GoBD space, the file is moved to quarantine instead of being deleted). The document entry remains and is marked as skipped; the reason is shown in the app until you delete the entry. No email is sent. A record of the result (document, account, category, time) is kept for one year and deleted right away when the document or the account is deleted. If you think the check was wrong, write to me.

7. Service providers (processors)

The following providers process data on behalf of Paperarchive under data processing agreements (Art. 28 GDPR):

• Supabase (Supabase Inc., hosted on Amazon Web Services in Frankfurt, Germany): Database, file storage, sign-in and serverless functions. Data, files and the serverless functions are located in the AWS region eu-central-1 (Frankfurt).
• Hetzner (Hetzner Online GmbH, Falkenstein, Germany): Servers for the API, the web app and the website. They run the document pipeline (for example file conversion and reading digital PDFs), the malware scan and the local ranking of search results.
• Google Cloud Vision (Google Cloud EMEA Ltd., EU): Text recognition (OCR) for scanned documents and photos and the content check (SafeSearch). Processing runs through the EU endpoint (eu-vision.googleapis.com). Digital PDFs with a text layer are read on Paperarchive's own servers; only their first page is sent for the content check. The data is not used to train models and images are not stored after processing.
• Microsoft Azure OpenAI Service (Microsoft Ireland Operations Ltd., EU Data Zone, resource in Frankfurt): AI features, see section 5.
• Cloudflare (Cloudflare, Inc., global network): Receives the emails you forward to your Paperarchive address (Email Routing) and passes them to Paperarchive's servers without storing them. The invocation logs of this step, which would contain sender and recipient, are switched off; the remaining logs contain only the size and the processing status. Cloudflare Turnstile protects sign-up, sign-in and password reset in the web app and the apps against bots; for this check, Turnstile processes your IP address and information about your browser or device.
• Stripe (Stripe Payments Europe, Ltd., Ireland): Payment processing, subscriptions and invoices. Stripe is certified under PCI DSS Level 1.
• Brevo (Sendinblue SAS, France): Sends the emails about your account, the notification emails you switched on (with the document title, sender, category and summary), the daily document digest if you switched it on (with document titles, summaries, amounts and due dates) and, after your confirmation, the newsletter. For customer emails, Paperarchive stores these contact attributes at Brevo: email address, first and last name, language, time zone, sign-up date, plan, start and end of the trial, account status, number of documents, whether you have uploaded, searched or upgraded, and your personal upload address. If you switch off product update emails, Paperarchive no longer syncs these attributes to Brevo and removes your contact from the onboarding lists; if you switch them back on, the contact is synced and added again. The contact is deleted when you delete your account.
• Sentry (Functional Software, Inc., data region EU, Frankfurt): Error monitoring for the web app, the API, the serverless functions and the iOS and Android apps. The web app and the iOS and Android apps also send release health sessions (release and environment, whether a session ended normally or with an error or crash; the web app with the pseudonymous user ID, the apps with a random installation ID). Error reports of the web app and the API contain a pseudonymous user ID; the iOS and Android apps send only a random installation ID instead. Error reports contain no IP address and no document contents; before sending, email addresses, IDs, tokens, file names, paths, query strings and database values are removed from addresses (URLs) and error texts, and the click history contains no console output and no click texts. Errors the apps handle themselves are reported only with their type and HTTP status. The web app sends performance traces for 10 percent of page loads, with addresses without IDs or query strings; performance traces of the API and the serverless functions are sampled at 10 percent as well, and the API also sends performance profiles (which code ran how long, without data contents) for 10 percent of its requests. Reports about blocked content (CSP reports) go first to an endpoint of Paperarchive, which accepts at most 16 KB per request and 30 reports per minute per client and removes query strings, IDs, IP address and user agent before forwarding them to Sentry. For this limit the client is identified only by a salted hash of its IP address, held in memory for at most one minute; the IP address itself is neither stored nor logged. Sentry deletes the reports automatically after its retention period.
• Plausible Analytics (Plausible Insights OÜ, Estonia, hosting in the EU): Cookieless statistics, see section 10.
• Google Workspace (Google Ireland Ltd.): Email inboxes, in particular the support inbox.
• Push services (Apple Push Notification service, Firebase Cloud Messaging by Google, push service of your browser vendor): Delivery of push notifications, see section 9.

8. Sign-in providers, Google Play services and integrations

The following providers are responsible for their own processing:

• Sign in with Google (Google Ireland Ltd.): The Google sign-in script (Google Identity Services with One Tap) loads only for users whose last sign-in was with Google, on the sign-in page or after the session has ended (signed out). Everyone else contacts Google only after clicking Sign in with Google, through a redirect to Google. The script and the redirect transmit your IP address and browser information to Google. If you sign in with Google, Google passes your name and email address to Paperarchive.
• Sign in with Apple (Apple Distribution International Ltd.): Only if you choose it. Apple passes your name and your email address or an Apple relay address to Paperarchive.
• Google Play services on Android (Google Ireland Ltd.): The document scanner of the Android app uses the Google ML Kit document scanner, which runs through Google Play services on your device. The app checks for new versions with Google Play In-App Updates. Google Play services can send usage and diagnostic data about these functions to Google.
• Integrations you connect yourself: If you connect Google Drive or Dropbox, Paperarchive imports files from the folders you chose, with read access only. If you connect an AI assistant (for example Claude or ChatGPT) through the Paperarchive MCP interface, or use the API with your own key, the assistant or program receives the documents and search results it requests, under the terms of its provider. These transfers happen at your request, and you can disconnect at any time. When you connect, you choose the Spaces the assistant may see and whether it may also change something (mark events as paid, confirm, archive or cancel them, add or remove tags); changes are off unless you switch them on. For every connection Paperarchive stores the app's name, the permissions and Spaces you granted, when it was last used and, for each change, the time and the connection that made it (security log); the change log of the document names you as the person who made the change. To identify an assistant, Paperarchive may fetch the public metadata document its provider publishes (no personal data).

9. iOS and Android apps, push notifications

• iOS app: Sign-in and data work as in the web app; the sign-in session is stored in the iOS keychain. The app uses the camera and the photo library only after your permission, to scan and import documents. Push notifications go through the Apple Push Notification service (Apple Inc.); the app asks for permission only when you switch on app notifications. Your recent searches are stored on the device outside backups and deleted when you sign out. The privacy manifest of the app lists the data types it processes; the app does no tracking. Crash and error reports go to Sentry (see section 7).
• Android app: Sign-in and data work as in the web app; the sign-in session is stored encrypted on the device. Push notifications go through Firebase Cloud Messaging (Google). The push token is created only after you switch on app notifications and is deleted when you switch them off; the app does not use Firebase Analytics. The document scanner uses Google ML Kit and new versions are offered through Google Play In-App Updates (see section 8). Crash and error reports go to Sentry.
• Content of push notifications: App notifications on iOS and Android can contain the document title, the sender, amounts and dates, for example a deadline or a cash discount. This text passes through Apple's or Google's push service. What the lock screen shows depends on the platform and your device settings: iOS hides notification previews by default while the device is locked, so only the app appears there; Android shows the content depending on the lock screen setting of your device, and Paperarchive marks its notifications as private there, so with sensitive content hidden only a short text without content appears (for example New document). Browser notifications contain only the short text and are sent encrypted. You can switch notifications off per channel in the settings.

10. Statistics and analytics

• Plausible (cookieless, always active): The website and the web app use Plausible to count visits in aggregate, through Paperarchive's own domain. Plausible sets no cookies and stores no persistent identifier on your device; it processes browser, operating system, device type and the country derived from your IP address, without storing the IP address. From the website it receives the path, campaign parameters (utm) and the referrer without query or fragment; from the web app only the route pattern (for example /documents/:id), without IDs, query, fragment or referrer. Invitation links and other tokens are removed from the address bar before any statistics are sent. Paperarchive uses no other analytics tool.

11. Cookies and storage on your device

Paperarchive stores the following information on your device. All of it is strictly necessary for the function you use or a setting you made (§ 25(2) no. 2 TDDDG); there are no analytics or advertising cookies. Cookies of an earlier optional analytics tool are deleted on your next visit.

• i18n_redirected (cookie, website and app, 1 year): Your language.
• sb-... (cookies, web app): Your sign-in session and, during sign-in, the page you wanted to open. They are removed when you sign out.
• pa-last-login-method (local storage, web app): Whether you last signed in with email, Google or Apple, so the sign-in page can highlight it.
• Settings of the web app (local storage): Selected space, theme, collapsed sidebar and hints, dismissed security hint, your recent searches on this device, onboarding selections and a pending invitation link.
• Session storage of the web app: Scroll position and filter of lists and an error message after an invitation link; deleted when you close the tab.
• Offline cache of the web app: Up to 50 recently opened document files for at most 24 hours, so they open faster; the cache is cleared when you sign out.
• Local storage of the website: Theme, campaign parameters of your visit for the quiz (30 days), your last quiz result and, only if you enter one in the API documentation, your API key for the test console.

You can delete cookies and stored data in your browser settings at any time. Without the strictly necessary entries, sign-in and settings do not work.

12. Shared spaces and auditor access

If you invite people into a space, all members see the documents of that space with their details, summaries and the change log, according to their role (owner, admin, editor, viewer). Members see each other's name and email address and who changed what. If the owner of a shared space deletes their account, the documents that other members added move to those members' own spaces; a GoBD space that holds archived records of other members under retention has to be handed over first, and an active retention hold in one of the owner's own spaces blocks the deletion until the hold is released or the space is handed over. If a member deletes their account, the archived records and the uploads under a retention hold they added to a GoBD space of another owner stay there and pass to the owner of that space, with their tags, sender and category; the member's IP address and browser are removed from their change log entries. Everything else of the member is deleted.

The owner of a space can give external auditors, for example a tax auditor, time-limited read-only access to that space, for at most 366 days. The auditor sees the documents of the space and the change log and can create the GDPdU export for the tax audit, but not the plan or billing status of the owner. Exports the auditor creates and every file the auditor opens or downloads, in the web app, the iOS and Android apps, through the Paperarchive API or an AI assistant, are recorded in the change log of the space with the auditor's user ID, the document, the time and the channel; all members who can see the change log of the space see these entries. The access ends automatically on the date set by the owner.

Invitations contain the email address of the invited person. Only the owner and the admins of the space and the invited person can see them. They are deleted 30 days after they expired or were accepted or declined.

13. Transfers outside the EU

Your documents and the database are stored in Germany, text recognition and AI processing run in the EU. A fallback outside the EU exists only as an emergency switch that is turned off; before it were ever used, it would be announced in this privacy policy. Several providers belong to US groups (Supabase, Amazon Web Services, Microsoft, Google, Cloudflare, Stripe, Apple and Sentry), so access from the USA cannot be ruled out. Data reaches the USA or other countries in particular for email delivery through Cloudflare, push notifications through Apple and Google, sign-in with Google or Apple, Turnstile, Google Workspace and payment processing through Stripe. These transfers are based on the EU-US Data Privacy Framework for certified providers (Art. 45 GDPR) and on the Standard Contractual Clauses of the European Commission (Art. 46 GDPR).

14. Retention periods

Paperarchive keeps personal data only as long as needed for the purposes above:

• Documents: Stored until you delete them. Deleted documents stay in the trash for 30 days, where you can restore them, and are then deleted permanently together with their files. In a GoBD space, documents are archived right after processing; documents with an open Needs input item only after your review, at the latest 10 days after the upload. Documents whose processing failed are archived only after an explicit decision. Until archiving you can still delete, split and merge them, and each of these steps is recorded in the change log. Archived documents cannot be deleted before their retention period (6, 8 or 10 years, depending on the type of record) has ended. While the owner or an admin of a GoBD space has set a retention hold (for example because an audit is announced or a tax assessment is still open, suspension of expiry under § 147 (3) AO and § 171 AO), the covered documents and their change log values are kept beyond the retention period; the legal basis is the legal retention duty of the space owner, Art. 6(1)(c) GDPR.
• Original emails (.eml): Kept together with the documents that came from them and deleted with them. Original emails without a remaining document are deleted after 7 days.
• Account deletion: When you delete your account, your documents, their files and your account data are deleted right away, together with your Stripe customer record and your Brevo contact. If deleting the Stripe customer record or the Brevo contact fails, Paperarchive retries every hour; your data at Stripe and Brevo is deleted within 30 days at the latest. If it still fails after 30 days, I delete it by hand, and the email address and customer ID stored for the retry are erased. If your address was blocked for transactional emails at Brevo, the block is lifted briefly to send you the deletion link and then restored; this record is kept for at most 7 days. Exceptions: archived documents in your own GoBD spaces that are still under retention are only deleted after you confirm that you keep the records yourself; an active retention hold in one of your own spaces blocks the deletion until the hold is released or the space is handed over; archived documents and uploads under a retention hold that you uploaded to a GoBD space of another owner stay there and pass to the owner of that space with their tags, sender and category, and your IP address and browser are removed from their change log entries; the change log is kept as described below; server logs are deleted after 30 days at the latest; database backups are overwritten after 7 days; error reports at Sentry stay pseudonymous until Sentry's retention period ends; invoices and payment records stay at Stripe and in my accounting as long as the law requires.
• Change log (audit log): The change log records for every change what was changed, when and by whom. In GoBD spaces it also keeps the old and new values of a change for as long as the documents have to be kept (6, 8 or 10 years); outside GoBD spaces it records only which fields changed, not their content. The values are erased only by fixed deletion rules: when a document is finally deleted after its retention period, when its retention period has ended and when you delete your account; an active retention hold keeps them. If a document that was never archived is deleted from a GoBD space, its values are kept until the end of the year it was added plus 10 years. Values without a document are erased after 10 years. The entries themselves stay without values, and after an account deletion without a link to your person; on entries that stay with a space owner, only your IP address and browser are removed.
• Search history: Your search queries, questions and AI answers are deleted after 30 days; statistics about searches are kept without the search text and deleted after 365 days. If you rate an answer as unhelpful, Paperarchive keeps a short correction note (question and your feedback) for 30 days to improve later answers. If you rate an answer as helpful, Paperarchive keeps the question and the answer as a memory for later searches until you delete your account or ask me to delete it.
• Server logs and sign-in logs: The process logs of the API, the web app and the website rotate daily and are deleted after 30 days; they contain no document contents, names, email addresses, file names, subjects or search queries. The sign-in service's audit log is deleted when you delete your account, and otherwise after 90 days. To limit sign-ups per address, a hash of the email address is kept for 24 hours. If processing a document fails repeatedly, an internal error queue keeps only technical IDs (document, user and job ID, error code and times), no file names, contents or error texts; its entries are deleted after 14 days, and entries of a deleted account within six hours at the latest. The processing job of such a document loses the recognized text as soon as it has failed for good and is deleted from the job queue after 24 hours.
• Notifications and invitations: Notifications in the app are deleted 90 days after they were read or expired; notifications you never read and that have no expiry date are deleted after 12 months. Invitations are deleted 30 days after they expired or were accepted or declined. Expired auditor access is deleted after one year. Records of emails that your email inbox rejected (sender not allowed) are deleted after 90 days. Push tokens of devices on which the app has not checked in for 90 days are deleted.
• Data exports: You can request up to 3 exports per 24 hours. The email only tells you that your export is ready and contains no link; you download it in the app after signing in, through a link that is valid for 10 minutes. The export files are deleted 48 hours after the export was created; a daily database job deletes any leftovers. The record of an export request (time and status, without files) is deleted 90 days after its files were removed.
• Invoices and payment records: Kept for as long as German commercial and tax law requires (§ 147 AO, § 257 HGB): 8 years for invoices and other accounting vouchers.
• AI usage records: Records of AI usage (model, tokens, cost) are deleted together with their document; records without a document, for example of searches, are deleted after 12 months.
• Newsletter and quiz: Your newsletter subscription is kept until you unsubscribe or withdraw your consent. The quiz result email is sent because you request it; it does not subscribe you to the newsletter. If you give your marketing consent in the quiz, Paperarchive asks you to confirm it by email (double opt-in). Consents you did not confirm and quiz results without consent are deleted after 90 days. Quiz results with a confirmed consent are deleted 24 months after your last interaction (your last quiz or your last confirmation), and right away when you unsubscribe or withdraw your consent, when emails to your address bounce permanently or when you mark an email as spam. Waitlist entries are deleted one year after the invitation or rejection, entries that were never invited two years after the sign-up.
• Support emails: Kept as long as needed to handle your request and possible follow-up questions.
• Backups: Database backups are kept for 7 days and then overwritten.

15. Data security

Paperarchive protects your data with technical and organizational measures, including: encryption in transit (TLS) and at rest by the hosting providers (AES-256); passwords stored only as hashes; optional two-factor authentication; row-level access rules in the database; private file storage with short-lived download links; malware scans of uploads; monitoring; and hosting in ISO 27001-certified data centers in Germany. Document contents are not end-to-end encrypted, because text recognition, AI analysis and search have to read them.

16. Your rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR): You can request a copy of your personal data and information about its processing. In the app you can download the personal data stored in your account yourself as a ZIP archive: your documents, original emails, recognized text, data derived from them, learned patterns, your sign-in history, invitations, AI usage, entries under your email address (waitlist, quiz), the change log of your account, a description of the processing and a list of what is not included and how to get it (for example invoices at Stripe). The email only tells you that the export is ready; you download it in the app after signing in, through a short-lived link.
• Rectification (Art. 16 GDPR): You can correct inaccurate data, most of it directly in the app.
• Erasure (Art. 17 GDPR): You can delete documents and your account at any time; the exceptions are listed under Retention periods.
• Restriction of processing (Art. 18 GDPR): You can ask me to restrict the processing of your data.
• Data portability (Art. 20 GDPR): You receive your data in a structured, machine-readable format (ZIP archive with files and JSON data).
• Objection (Art. 21 GDPR): See Your right to object at the beginning of this policy.
• Withdrawal of consent (Art. 7(3) GDPR): You can withdraw a consent at any time with effect for the future, without affecting the lawfulness of the processing before the withdrawal.
• Complaint (Art. 77 GDPR): You can lodge a complaint with a supervisory authority. The authority competent for Paperarchive is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

To exercise your rights, write to [email protected]. I answer within one month (Art. 12(3) GDPR).

17. Do you have to provide your data?

You are not legally obliged to provide personal data. Without an email address and the documents you upload, Paperarchive cannot provide the service. Consent-based features (newsletter) are optional.

18. Children

Paperarchive is intended for adults: you must be at least 18 years old to create an account. I do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and believe that your child has provided personal data, please contact me so I can delete it.

19. Changes to this privacy policy

I update this privacy policy when Paperarchive, its providers or the legal requirements change. The current version is always on this page with its date; I inform customers about material changes by email.