Privacy Policy

Introduction

Papera is an AI-assisted content studio: you create and refine content, produce it in the formats the app offers, publish it when you choose to, and connect the third-party services you choose to use. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have over it. It applies to the Papera web application, its marketing site, and related services (together, the "Service").

Please read this policy alongside our Terms of Service. By using the Service you agree to the practices described here.

Who we are

The Service is operated by ULADZIMIR KARALEU, a natural person conducting individual activity in the Republic of Lithuania under Individual Activity Certificate No. 1504522 (taxpayer identification number 37105012024) ("we", "us", "our"). For the purposes of applicable data protection law (including the EU/UK GDPR), we are the data controller of the personal data described in this policy. If you have questions or wish to exercise your rights, contact us at contact@papera.dev.

Information we collect

We collect information in three ways: information you provide directly, information collected automatically as you use the Service, and information we receive from third parties you connect.

Information you provide

• Account information — when you create an account we store your name, email address, and (if you sign in with Google) your profile image. Accounts are created via Google sign-in or a passwordless magic-link email.
• Content you create — the content you create in the app, in the formats it produces, together with the media and other assets you create, upload, generate, or publish, the settings and preferences you save, and the content you draft, set to publish automatically, or publish to third-party services you connect.
• Billing information — your plan, subscription status, and billing history. When you subscribe to a paid plan, checkout and payment are handled by our payment processor (Stripe), which collects your billing email, billing address, tax identifiers where required, and your card or bank-account details directly. We do not receive or store full card or bank numbers — only a tokenised customer reference and the subscription details we need to run your plan (customer and subscription identifiers, price/plan, subscription status, and current billing-period end).
• Email subscriptions to a portal: when you subscribe to a portal by email, we store your email address, the portal you subscribed to, the language of the page you subscribed from, and whether and when you confirmed the subscription. We do not store your IP address with it, and we do not record whether you open or read our emails. We use the address only to send you a weekly digest of what that portal publishes, and only after you confirm the subscription from the email we send to ask. Resend receives your address only to deliver these emails. A subscription you never confirm expires after a week, and its address is erased. Every digest carries a one-step unsubscribe link for each portal in it, and one that ends every subscription of your address; either ends the subscription at once, with no account, and erases your address from it. When the address is your verified account address, you can also end each subscription from Settings, under Email subscriptions. If an email to your address bounces for good, or you mark a digest as spam, we end every subscription of that address and erase it. For any other question about a subscription, write to us at contact@papera.dev.
• Support and communications — the contents of any messages you send us (for example, support or feedback emails).

Information collected automatically

• Session & authentication data — to keep you signed in and to secure your account, we record session tokens and sign-in events (including sign-in timestamps) together with the IP address and browser user-agent associated with each session, and security-relevant events such as new sign-ins.
• External tools you authorise — when you allow an external tool, such as an AI assistant or a companion app, to act on your account, we store its registration, the permissions you granted it, and the sign-in tokens we issue to it. These tokens expire on a fixed schedule.
• Device & connection data — IP address, browser type and version, operating system, device identifiers, referrer URL, language preference, and the approximate location (country/region) we derive from your IP address.
• Error & crash reports — PostHog is loaded for every visitor to report unhandled errors in your browser: the error message and type, the stack trace, the page it happened on, and basic device, browser, and operating-system information. This does not depend on analytics consent — we rely on our legitimate interest in keeping the Service working — and without that consent PostHog stores no cookie or other identifier on your device, so the reports are not linked to you or to your other visits.
• Usage & telemetry — once you accept analytics, PostHog additionally collects page views and routes visited, referrer information, device type, browser and operating system, and approximate country, and links them to a stored device identifier. Independently of analytics consent, our servers keep operational logs of feature and API usage, publishing outcomes (content created, published, or failed to publish), and error, crash, and performance data needed to run and debug the Service.
• Reads of a published article — when someone opens an article you have published, our server counts the read as a daily total for that article, kept separately for each place where the article is displayed. As it counts the read, the server derives the reader's country from their IP address, using a country dataset (from DB-IP) held on our own servers, so the address is sent to nobody. The address is then discarded, and only a daily total per country is kept. Nothing finer than a country is derived. You see these country totals on the article's Audience page, with countries that drew few reads grouped together; readers see no country. A repeat read on the same day is recognised through a value salted with a secret that rotates daily, so no address, user agent or cross-site identifier is kept, and no cookie is set on the article's own host.
• Interactions with the interface — once you accept analytics, PostHog also records interactions automatically: clicks, form submissions, dropdown selections, and repeated frustrated clicking on the same spot (a "rage click"). For each one it stores what you interacted with rather than what you wrote — the element's type, its styling classes and identifiers, its visible label, and any link it points to. It does not record what you type into text fields, nor the content you write, generate, or paste in the editor.

Information from connected services

• Google account — if you sign in with Google, we receive your name, email address, and profile picture from Google.
• Third-party services you connect — when you connect a third-party service to publish to it, we store the OAuth access and refresh tokens the service issues us and the scopes you granted, along with credentials and account details for that service: the account's username or handle and its identifier on the service, its display name and profile picture, and the account-level metadata the service exposes (such as follower or audience counts and, on services that use them, page or channel identifiers). We also keep a record of what was published to it. These tokens are held server-side, are never exposed to your browser, and are released when you disconnect the service.
• Content & engagement data — to show you how your published content performs, we fetch and cache the item-level and audience metrics a connected service exposes for your account and for the content you publish to it through us, such as impressions and reach, likes, shares, and replies, and the engagement rates derived from them.

How we use your information

We use personal data to:

• Provide, operate, and maintain the Service, including your account and projects;
• Authenticate you and keep your account and sessions secure;
• Generate content on your behalf when you use AI features, and publish content to the third-party services you connect;
• Run automations you set up, which execute on our servers even when your device is offline;
• Bill and collect payment — manage your subscription, issue invoices and receipts, prevent payment fraud, and comply with tax and accounting law;
• Send you service-related emails, such as magic-link sign-in links, receipts, notices that a publish failed, confirmations for automations you set up, and other important notices; and, where you have opted in, product and marketing emails you can unsubscribe from at any time;
• Understand how the Service is used and improve its performance and reliability;
• Detect, prevent, and address security incidents, fraud, and abuse;
• Comply with legal obligations and enforce our Terms of Service.

Legal bases for processing

Where the GDPR or similar laws apply, we rely on the following legal bases: performance of our contract with you (to provide the Service and the features you request); legitimate interests (to secure, maintain, and improve the Service); your consent (for optional analytics and, where required, marketing); and compliance with legal obligations. You may withdraw consent at any time where processing is based on consent.

AI processing of your content

When you invoke an AI feature, the content and prompts involved are sent to our server-side AI providers (currently OpenAI and/or Anthropic, depending on configuration) and, for research, to a web-search provider (Tavily) to gather source material. We do not use your content to train our own models. Our AI providers process the content under their own terms and, per their policies, do not train their foundation models on data submitted through their APIs. AI features run only when you invoke them; if you never use them, your content is never sent to these providers.

AI outputs are generated probabilistically and may be inaccurate, incomplete, or unsuitable for your purpose. You remain responsible for reviewing them before you rely on or publish them.

How we share your information

We do not sell your personal data. We share it only with the service providers ("subprocessors") that help us operate the Service, and only as needed for the purposes below. Each processes data on our behalf under contractual confidentiality and security obligations.

• Google (Sign in with Google) — Authentication when you choose to sign in with a Google account.
• Resend — Sending email — transactional and magic-link sign-in messages, and, where you have opted in, product and marketing emails.
• Stripe — Payment processing and subscription billing as merchant of record — Stripe collects and stores your card or bank details directly and handles tax; we only receive a tokenised customer reference and your subscription status.
• OpenAI — Server-side AI generation (research, outlining, drafting) when you use AI features.
• Anthropic — Server-side AI generation, used interchangeably with OpenAI depending on configuration.
• Tavily — Web search used by the AI research step to gather source material for your topic.
• Amazon Web Services (S3) — Object storage for media and assets attached to content you publish.
• PostHog (EU) — Error tracking — crash and error reports from your browser, collected for everyone so we can keep the Service working — and, only if you accept analytics, product analytics such as page views, interface interactions, and basic device/browser information; both are processed in the EU (Frankfurt).

When you publish content to a third-party service you connect, that content and its media are sent to the service and become subject to its own terms and privacy policy. We may also disclose information to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you). Requests from courts, law enforcement, and other public authorities are handled as described in "Government and law enforcement requests" below.

Government and law enforcement requests

We may receive requests from courts, law enforcement, regulators, or other public authorities for personal data about our users. We handle every such request under the following process.

• Legality review — we review each request before responding: that it is authentic and comes from the authority it claims to; that the authority has jurisdiction over us as a controller established in the Republic of Lithuania; that it is supported by a valid and binding legal instrument; and that its scope is specific and proportionate. Requests from authorities outside the EU are not acted on solely on the basis of a foreign judgment or order — consistent with Article 48 GDPR, we require a basis in an applicable mutual legal assistance treaty or other international agreement, or another lawful ground under EU or Lithuanian law.
• Challenging unlawful requests — where a request fails this review, because it is not legally binding on us, is overbroad or vague, or lacks a proper legal basis, we refuse it, seek narrowing or clarification, require a properly issued order, or challenge it through the available legal channels, taking outside legal advice where appropriate.
• Data minimization — where we are legally required to disclose, we disclose only the specific data, accounts, and time period the request actually covers. We do not provide full account exports or bulk data in response to a narrower request.
• Documentation — we keep a record of every request we receive: the date, the requesting authority, the legal instrument relied on, the data sought, our assessment of its legality and the reasoning behind it, who was involved in the decision, what (if anything) we disclosed, and whether the affected user was notified.
• User notification — we notify affected users of requests concerning their data unless we are legally prohibited from doing so or notification would obstruct a lawful investigation. Where a prohibition is temporary, we notify once it lapses.

Cookies, local storage, and tracking

We use cookies and browser storage (localStorage) that fall into the following categories. You can manage non-essential categories through the in-page consent banner or your browser settings; disabling strictly-necessary storage will break parts of the Service.

• Strictly necessary — required to run the Service, most importantly a session cookie that keeps you signed in after you authenticate, and local storage we use to hold your session and preferences. These cannot be switched off without breaking core functionality.
• Analytics — set only after you accept analytics. PostHog sets a cookie holding a random device identifier so we can recognise returning visits and measure retention. It is not used for cross-site tracking and never for advertising. Until you accept, PostHog runs entirely in memory: its error reporting sets no cookie and writes nothing to browser storage. If you withdraw consent later, analytics collection stops and the stored identifier is deleted from your browser — see your rights below.
• Functional and marketing — we do not currently set functional or marketing cookies, pixels, or advertising SDKs. If we introduce any, we will add them to the consent banner and update this policy first.

Data retention

We keep personal data only as long as needed for the purposes described here. Account data is retained for as long as your account is active and then deleted within 30 days after you close it. Published projects and content are retained until you unpublish or delete the project, after which they are removed within 30 days. Session and log data are rotated on a rolling basis. Tokens for third-party services you connect are deleted when you disconnect the service or close your account. Credentials for external tools you authorise are deleted when you close your account. The same-day values behind a published article's read count, and that day's salt, are deleted once that day has passed. An email subscription to a portal is erased a week after it was made if it was never confirmed; a confirmed one is kept until its subscriber asks us to end it, and deleting the portal's project or its author's account erases every subscription to it. Deleting your account erases every subscription to its verified address. Billing and transaction records are retained for as long as legally required — invoices and transaction records are kept for the period tax and accounting law demands, typically several years, even after you close your account. When you delete your account, we delete or anonymize the associated personal data, except where we must retain it to comply with a legal obligation or resolve disputes.

International data transfers

We and our subprocessors may process your data in countries other than your own, including the United States. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. Usage analytics are an exception: they are processed by PostHog in its EU region and stay in the EU. Details of the safeguards we use are available on request at contact@papera.dev.

Security

We take reasonable technical and organizational measures to protect your data. API keys and credentials for services you connect are held server-side and never exposed to your browser; authorization tokens for connected services are scoped to the minimum permissions publishing needs. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Your rights

Depending on where you live (for example, under the GDPR or the CCPA), you may have the right to:

• Access — request a copy of the personal data we hold about you;
• Rectify — correct inaccurate or incomplete data;
• Delete — delete your account and its data yourself, at any time, from Settings → Profile → Delete account. Deletion is immediate and permanent: it removes your projects and their published pages, your uploaded files, your connections to third-party services, the automations you set up and any active subscription. Billing records are retained as described above;
• Port — receive your data in a portable format;
• Object or restrict — object to or restrict certain processing;
• Withdraw consent — including opting out of analytics at any time.

You can manage your analytics preferences here at any time(currently: declined). To exercise any other right, contact us at contact@papera.dev. You also have the right to lodge a complaint with your local data protection authority.

Children's privacy

The Service is not directed to children under 18, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we make material changes we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

Contact

For any privacy question or to exercise your rights, reach us at contact@papera.dev. The Service is governed by the laws of the Republic of Lithuania.