1. Data We Collect
1.1 Account Information
When you create an account, we collect your email address and a hashed version of your password. We do not store plaintext passwords. We use Supabase for authentication, which implements industry-standard bcrypt hashing.
If you choose to add a display name or phone number to your profile, these are stored in your account profile. They are optional and can be removed at any time from your account settings.
1.2 Document Images
When you scan a document, your image is transmitted to our servers over an encrypted HTTPS connection. On the Free plan, images are processed in-memory and are not permanently stored. If you are on the Pro plan and save a document to your Vault, the image is stored in an encrypted, access-controlled storage bucket associated with your account.
We do not use your document images for any purpose other than generating the analysis you requested. We do not sell, share, or use your images for AI model training.
1.3 Analysis Results
The structured analysis output (urgency level, summary, action type, deadline, key entities) is stored in our database associated with your account ID if you are a Pro user with Vault storage enabled. This data is encrypted at rest using AES-256.
1.4 Technical & Operational Data
We collect minimal technical data necessary to operate the Service securely — including authentication tokens, session cookies, and server-side error logs. We do not use any third-party analytics or tracking services. We do not place advertising pixels, fingerprint your device, or track your behaviour across other websites.
2. How We Protect Your Data
2.1 In-Transit Encryption
All data transmitted between your device and our servers uses TLS 1.3, the current industry standard for transport-layer security.
2.2 At-Rest Encryption
All data stored in our database — including analysis results, vault contents, and any saved document metadata — is encrypted at rest using AES-256 encryption managed by our cloud infrastructure provider (Supabase, hosted on AWS).
2.3 Access Controls
Your data is logically separated from other users’ data using Row Level Security (RLS) policies enforced at the database level. Only your authenticated session can access your documents and analysis results.
2.4 Sensitive Identifiers — Our Recommendation
If your document contains a full Social Security Number, Aadhaar number, bank account number, or similar sensitive identifier and you are privacy-sensitive, we recommend physically covering that section before photographing.
We are actively developing on-device redaction capabilities that will allow your device to mask sensitive identifiers before any image is transmitted. This feature will be opt-in when released.
3. Third-Party AI Sub-Processors
PaperLens uses third-party AI APIs to perform document analysis. When you submit a document for analysis, a copy of the image or extracted text is sent to the following sub-processor:
3.1 Google (Gemini 2.5 Flash)
- Purpose: Generating plain-language summaries, urgency classifications, key entity extraction, and AI chat responses
- Data sent: Base64-encoded image or extracted document text
- Retention: Google processes API requests and, per our API agreement, does not use API inputs to train Google’s models by default.
- Privacy policy: policies.google.com/privacy
We have configured our Google API account to opt out of data usage for model training. However, as with any third-party service, we cannot guarantee their practices beyond what is stated in their privacy policy and our data-processing agreement with them. If you require absolute data isolation, do not use cloud-based AI analysis tools.
3.2 Supabase (Database & Storage)
- Purpose: Authentication, database storage, and file storage
- Data stored: Account credentials (hashed), profile information, analysis results, vault documents
- Infrastructure: Hosted on AWS (us-east-1 region by default)
- Privacy policy: supabase.com/privacy
3.3 Resend (Transactional Email)
- Purpose: Delivering transactional emails — account verification, email reminders, deletion notifications
- Data sent: Your email address and the email content only. We do not share any document content with Resend.
- Privacy policy: resend.com/legal/privacy-policy
4. Cookies & Session Storage
We use session cookies strictly for authentication — to keep you logged in across page loads. We do not use:
- Third-party tracking or advertising cookies
- Analytics cookies or pixels
- Cross-site tracking technologies
- Any cookies from advertisers or data brokers
You may disable cookies in your browser, but doing so will prevent you from staying logged in. We also store a language preference cookie (paperlens_locale) if you change your preferred language — this is functional only and contains no personal data.
5. Your Rights
Depending on your jurisdiction, you have the following rights regarding your personal data. To exercise any of these rights, contact us at privacy@paperlens.co.
5.1 Right to Access
You may request a complete export of all personal data associated with your account. We will respond within 30 days. For Indian users, we will respond within the timeframes required by the DPDP Act 2023.
5.2 Right to Delete (Right to Be Forgotten)
You may delete your account and all associated data at any time from your account settings. Upon request, your account is scheduled for permanent deletion within 48 hours. This window exists to allow PaperLens to cancel active subscriptions, settle any pending billing, and deliver any reminders already queued. You may cancel the deletion request within this window from your settings page. After 48 hours, all personal data — profile, documents, vault contents, AI chat history, folders, and reminders — is permanently deleted. Residual copies in encrypted backups are purged within 30 days.
5.3 Right to Correct
You may update your display name, email, or other profile information at any time from your account settings.
5.4 Right to Data Portability
You may request an export of your vault data in JSON format by contacting privacy@paperlens.co. We will provide the export within 30 days. This right is provided in compliance with GDPR Article 20 and the DPDP Act 2023.
5.5 Right to Opt Out of Sale (CCPA — California)
We do not sell personal data. We do not share personal data with third parties for their direct marketing purposes. California residents have no sale to opt out of.
5.6 India — DPDP Act 2023 Rights
If you are located in India, you have the following rights as a “Data Principal” under the Digital Personal Data Protection Act, 2023:
- Right to information about personal data being processed
- Right of access to a summary of personal data and processing activities
- Right to correction and erasure of your personal data
- Right to grievance redressal — contact our Grievance Officer (see Section 8)
- Right to nominate another individual to exercise rights on your behalf in the event of death or incapacity
We act as a Data Fiduciary under the DPDP Act. We process your personal data based on your consent, provided at the time you create your account. You may withdraw consent at any time by deleting your account.
6. Children’s Privacy
PaperLens is not directed to children under 13. We do not knowingly collect personal information from children under 13. For users between 13 and 18 years old (or the age of majority in your jurisdiction), parental or guardian consent is required as set out in our Terms & Conditions.
If you believe a child has provided us with personal information without appropriate consent, contact us immediately at privacy@paperlens.co and we will promptly delete the data.
7. Data Retention Summary
- Free plan documents: Deleted immediately after analysis is delivered — no retention
- Pro plan vault documents: Retained while subscription is active; 60-day grace period post-cancellation; then permanently deleted
- Account data (profile, email): Retained until account deletion is requested
- Deleted account data: Permanently deleted within 48 hours of request; backup purge within 30 days
- Server error logs: Retained for up to 90 days for debugging and security purposes, then automatically purged
8. Contact & Grievance Officer
For privacy-related questions, data requests, or to report a concern:
- Email: privacy@paperlens.co
- Response time: Within 5 business days for general questions, 30 days for formal data requests
Grievance Officer (India — DPDP Act 2023 & IT Act, 2000):
In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, grievances from Indian users must be addressed within 30 days of receipt. Contact:
- Role: Grievance Officer, PaperLens
- Email: grievance@paperlens.co
- Response time: Acknowledgement within 48 hours; resolution within 30 days
9. Changes to This Policy
We reserve the right to update this Privacy Policy. Material changes will be communicated by email to registered users at least 14 days before taking effect. The updated date at the top of this page will always reflect when it was last revised.