advertising cookies
Pappery home
Privacy · Version 2026-07-17
Pappery Privacy Notice.
Effective July 17, 2026. This notice describes Hilum Labs' processing of personal data when operating Pappery. We do not sell personal data or use third-party advertising cookies.
export link lifetime
intended audience
01
Data we collect
We process account and authentication data, legal acceptance, email preferences, referenced billing data, support requests, documents, templates, themes, fonts, images, snapshots, and export metadata.
Technical data includes IP address, user agent, request IDs, security logs, and operational metrics. We do not store full card numbers.
02
How we use it
We use data to create and protect accounts, save and sync work, enforce quotas, generate exports, administer billing, answer support, prevent abuse, meet obligations, and improve reliability.
Marketing email is optional and records consent and withdrawal. Transactional email operates the account and purchase.
03
Providers and transfers
AWS hosts infrastructure, storage, and email delivery; Polar processes purchases as merchant of record. Other providers are enabled only when necessary or when you choose an integration.
Providers act under their own terms or as processors. International transfers use applicable legal mechanisms.
04
Cookies and local storage
A secure, HttpOnly, host-only, same-site cookie renews the session. Access tokens remain in memory. Local storage and IndexedDB keep necessary preferences, onboarding, recent views, and offline drafts.
Signing out revokes the server session and clears authentication. Clearing site data removes local values from the device.
05
Retention and deletion
We retain data while the account is active and for documented technical or legal periods. Backups expire on infrastructure schedules; tax, security, consent, and audit records may remain longer.
Account deletion blocks writes, verifies subscription cancellation, erases objects, and removes identity through a retried job. Subscription expiry never begins deletion by itself.
06
Your rights and controls
Depending on residence, you may request access, correction, deletion, restriction, objection, portability, or appeal and complain to a data authority.
Settings provides data export, credential changes, billing management, and deletion. We may verify identity and require proof from an authorized agent.
07
Security, children, and changes
We use encryption, private storage, least privilege, admin MFA, request limits, audit, backups, and vulnerability controls. No service can guarantee absolute security.
Pappery is not directed to children under 16 or the local minimum age. We update the version date and notify material changes when required.
Pappery
Control your data from your account.
For a rights request, use Settings or support and allow identity verification.