Privacy Policy

1. Who we are and what this policy covers

PapelSoftware LLC (“PapelSoftware”, “we”, “us”) is a United States company that provides software development subscriptions and software products, including Papel Copilot, Papel Sites, Papel Cloud and Papel Monitor. This Privacy Policy explains how we handle personal information when you visit papelsoftware.com, contact us, create an account, buy a subscription or use our Services.

When we process data inside the Products on behalf of our business customers (for example, conversations that a client’s end users have with a Papel Copilot assistant, or data stored in a client application hosted on Papel Cloud), we act as a service provider or processor. In that case the client’s own privacy policy governs, and we process the data only on the client’s instructions and under our agreement with them. If you are an end user of one of our clients, please contact that client to exercise your rights.

2. Information we collect

Information you give us

• Contact and inquiry information. When you use our contact form or email us: your name, email address, company name, phone number if provided, and the content of your message.
• Account information. When you create an account: your name, email address, company, role, password (stored as a salted hash) and account preferences.
• Billing information. When you subscribe: billing name, billing address, tax ID if provided and transaction history. Card and bank details are collected and stored directly by our payment processor, Stripe. We do not store full card numbers. We receive only limited details such as card brand, last four digits and expiry date.
• Project information. When we provide Development Services: requests, feedback, specifications, files and credentials you share with us to do the work.

Information collected automatically

• Usage and log data. IP address, browser type, device and operating system, pages viewed, referring URL, timestamps, and actions taken in our Products. Our servers record this to operate, secure and troubleshoot the Services.
• Cookies. We use only cookies that are strictly necessary for the website and Products to work, such as session and security cookies. See our Cookie Policy.

Information from others

We may receive payment status and fraud signals from Stripe, and information from a colleague who invites you to a shared workspace.

We do not intentionally collect sensitive personal information, such as government ID numbers, health data or precise geolocation, and we ask you not to send it to us unless a project requires it and we have agreed how it will be handled.

3. How we use information

We use personal information to:

• respond to inquiries and provide quotes;
• create and manage accounts and provide the Services you request;
• process payments, send receipts and invoices, and handle refunds;
• provide customer support and send service notices, such as security alerts and policy changes;
• monitor, secure and improve the Services, and detect and prevent fraud and abuse;
• comply with legal, tax and accounting obligations and enforce our agreements; and
• send product updates or marketing emails where permitted; you can unsubscribe at any time using the link in the email.

We do not use personal information for automated decision-making that produces legal or similarly significant effects on you.

4. Legal bases for processing (EEA, UK and Switzerland)

If you are located in the European Economic Area, the United Kingdom or Switzerland, we rely on:

• Contract, to provide the Services, manage your account and process payments;
• Legitimate interests, to respond to inquiries, secure and improve the Services, prevent fraud and market to business customers, where those interests are not overridden by your rights;
• Legal obligation, to keep tax and accounting records and respond to lawful requests; and
• Consent, for optional cookies or marketing where consent is required. You can withdraw consent at any time.

5. How we share information and our subprocessors

We share personal information only with service providers that help us run our business, under written agreements that limit their use of the data to providing services to us. Our principal subprocessors are:

We may also disclose information:

• to professional advisers such as lawyers and accountants, under confidentiality obligations;
• when required by law, subpoena or court order, or to protect the rights, property or safety of PapelSoftware, our customers or others;
• in connection with a merger, acquisition or sale of assets, in which case we will notify you and the recipient will be bound by this policy; and
• with your consent or at your direction.

We will update this list before adding a new subprocessor that processes customer personal information. Business customers may request advance notice of changes by emailing [email protected].

6. AI processing for Papel Copilot

Papel Copilot and AI features we build for clients send the text of user messages, relevant excerpts from the client’s knowledge base and conversation context to Anthropic’s API so that Claude can generate a response. We use Anthropic under its commercial terms, under which Anthropic does not use inputs or outputs submitted through the API to train its models.

Anthropic may retain API inputs and outputs for a limited period for trust and safety purposes, as described in its commercial terms. We store conversation history in our own infrastructure on AWS for the retention period the client configures. We do not use client conversation data to train any AI model.

7. No sale or sharing of personal information

We do not sell personal information, and we do not “share” personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”). We have not done so in the past 12 months. We do not use third-party advertising or analytics cookies on our website.

8. Data retention

We keep personal information only as long as needed for the purposes described above:

• Contact form inquiries that do not lead to a contract: up to 24 months after our last communication.
• Account information: for the life of the account and up to 90 days after closure.
• Product data stored for clients: deleted within 30 days after the export window following termination.
• Billing and transaction records: seven years, to meet tax and accounting requirements.
• Server logs: up to 90 days, unless needed longer to investigate a security incident.

When information is no longer needed, we delete it or anonymize it so it can no longer identify you.

9. Your privacy rights

California residents

Under the CCPA, California residents have the right to:

• know what personal information we collect, use and disclose, including the categories described in this policy, and access specific pieces of it;
• request deletion of personal information, subject to legal exceptions;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information (we do not sell or share it) and limit use of sensitive personal information (we do not use it for purposes that require this right); and
• not be discriminated against for exercising these rights.

In the past 12 months we have collected the categories described in “Information we collect”: identifiers, commercial information, internet or network activity, and professional information, from the sources and for the purposes described above, and disclosed them only to the service providers listed in this policy.

Residents of other US states

Depending on where you live, state privacy laws (such as those in Colorado, Connecticut, Virginia, Texas and others) may give you similar rights to access, correct, delete and obtain a copy of your data, and to appeal our decision on a request. We honor these requests for all US residents regardless of state.

EEA, UK and Swiss residents

You have the right to access, correct, delete, restrict or object to our processing of your personal data, to data portability, and to withdraw consent. You also have the right to lodge a complaint with your local data protection authority.

How to exercise your rights

Email [email protected] with your request. We will confirm receipt within 10 business days and respond within 45 days (or one month for GDPR requests), and will tell you if we need more time. We will verify your identity by matching information you provide against our records, usually by confirming control of the email address on file. You may use an authorized agent; we will ask for proof of the agent’s authority. If we deny your request, you may appeal by replying to our decision, and we will respond to the appeal within 45 days.

10. Children's privacy

Our Services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact [email protected] and we will delete it.

11. International data transfers

We are based in the United States, and our subprocessors primarily process data in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. For transfers from the EEA, UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable) or another lawful transfer mechanism, including our subprocessors’ certifications under the EU-U.S. Data Privacy Framework where available.

12. Security

We use administrative, technical and physical safeguards appropriate to the data we handle, including:

• encryption of data in transit with TLS and encryption at rest for databases and backups;
• access limited to personnel who need it, protected by multi-factor authentication;
• separation of client environments and least-privilege access to production systems;
• logging and monitoring of production infrastructure; and
• secrets management for client credentials rather than storing them in code or email.

No system is completely secure. If we learn of a security incident affecting your personal information, we will notify you and the relevant authorities as required by law. To report a vulnerability, email [email protected].

13. Changes to this policy

We may update this Privacy Policy as our Services or legal requirements change. We will post the new version here and update the “Last updated” date. If we make a material change, we will notify account holders by email before it takes effect.

14. Contact us

For privacy questions or to exercise your rights, email [email protected]. You can also write to us at the address below.

Support hours: Monday to Friday, 9:00 a.m. to 6:00 p.m. Eastern Time.