Privacy Policy

1. What Information We Collect

2. How We Use Your Information

• Document processing: Uploaded documents are sent to Google Document AI for OCR (optical character recognition), document classification, and structured data extraction.
• Tax classification: Extracted document data is sent to Google Gemini (LLM) to determine tax categories relevant to your jurisdiction.
• Document storage: Documents are stored in our internal storage system. If you configure an archival destination (Google Drive, Nextcloud/WebDAV, or S3-compatible storage), copies are synced to your chosen destination.
• Search and organization: Extracted text is indexed (encrypted) to enable search across your documents.
• Email scanning (if enabled): Gmail data is used solely to identify and import invoice attachments into your Paper Stuff account.

3. Google API Services — Limited Use Disclosure

Paper Stuff's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only use Gmail data to discover and import invoice attachments into your Paper Stuff account. We do not use Gmail data for advertising, market research, or any purpose unrelated to providing the document management functionality you requested.
• We do not transfer Gmail data to third parties, except as necessary to provide the service (e.g., sending an attachment to Google Document AI for processing), as required by law, or with your explicit consent.
• No human reads your Gmail data, unless you explicitly grant permission for debugging a specific issue, or as required for security purposes (e.g., investigating abuse).
• Google Drive data (if you connect Google Drive as an archival destination) is used solely to sync your processed documents to your Drive. We do not read or access other files in your Drive.

4. Data Storage and Security

• Hosting location: All data is stored on servers in Germany (Hetzner), within the European Union.
• Encryption at rest: Personally identifiable information (names, payment details, passport data, extracted text) is encrypted using per-user encryption keys derived via HKDF. Database-level encryption (pgcrypto) is used for search indexes.
• Encryption in transit: All connections use TLS (HTTPS). Connections to third-party services (Google APIs, storage destinations) also use TLS.
• Password security: Passwords are hashed with Argon2id before storage. We never store or log plain-text passwords.
• Storage destination credentials: If you configure a Nextcloud/WebDAV or S3 archival destination, those credentials are encrypted before storage using per-group encryption keys.

5. Third-Party Services

We use the following third-party services to provide Paper Stuff:

• Google Document AI — OCR, document classification, and structured data extraction. Document content is sent to Google's EU-region processing endpoints. Subject to Google Cloud Terms of Service.
• Google Gemini — LLM-based tax classification of extracted document data. Subject to Google Cloud Terms of Service.
• Google OAuth / GitHub OAuth — Authentication providers. We receive your name, email, and profile picture from these providers.
• Gmail API (optional) — Read-only access to discover invoice attachments. See Section 3 for Limited Use details.
• Google Drive / Nextcloud / S3 (optional) — Archival destinations you configure. Documents are synced to your chosen provider.
• Mailgun — Transactional email delivery (email verification, password reset, payment reminders).
• Hetzner — Server infrastructure in Germany.
• Cloudflare — DNS and CDN. Traffic passes through Cloudflare's network.

6. Data Retention

• Your documents and extracted data are retained as long as your account is active.
• You can delete individual documents at any time. Deleted documents are permanently removed from our storage.
• If you delete your account, all associated data (documents, extracted data, encryption keys) will be permanently deleted.
• Server logs are retained for up to 90 days for security and debugging purposes.

7. Your Rights (GDPR)

As Paper Stuff is hosted in Germany and primarily serves users in the EU, you have the following rights under the General Data Protection Regulation (GDPR):

• Access: You can request a copy of all personal data we hold about you.
• Rectification: You can request correction of inaccurate data.
• Erasure: You can request deletion of your data. You can also delete documents and your account directly through the application.
• Data portability: You can export your documents and data. The application provides download functionality for all stored documents, and CSV/PDF export for tax summaries.
• Restriction: You can request that we restrict processing of your data in certain circumstances.
• Objection: You can object to processing of your data where we rely on legitimate interest as the legal basis.
• Withdraw consent: You can disconnect third-party services (Gmail, Google Drive) at any time through your account settings, revoking our access.

To exercise these rights, contact us at the address below. We will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority.

8. Contact

If you have questions about this privacy policy or want to exercise your data rights, contact us at:

[email protected]