What papyro keeps, and what it never sees.

1What papyro collects

Each item below is held for one reason, and that reason is stated next to it.

• Name and work email address, as the identity provider reports them at a Microsoft sign-in, or as typed with a sign-in code that proves the address, to identify the account.
• Sign-in method and its account identifier (the Microsoft account's identifier, or the proven address for a code), so that a later sign-in finds the same account.
• Sign-in code, kept only as a keyed digest beside the address it went to, deleted once it is used or after ten minutes.
• Git host credential, only when a company owner connects the company's git host as a mirror: encrypted at rest, used only to create the company's repositories there and push to them. Removed on Disconnect. Never passed to a third party.
• AI credential, if one is provided: an Anthropic or OpenAI API key, or the company's own AWS Bedrock or Google Vertex credential. Encrypted at rest, used only to make AI requests on the company's behalf.
• Last sign-in time, to delete accounts that have been inactive for 12 months (clause 6).
• IP address at sign-in, kept in the security log for 180 days, then deleted automatically.
• Web server log: for every page request, the IP address, browser, referring page and page requested, to protect the site against abuse and see which pages are read and from which countries. The country is looked up on papyro's own server; no IP address is sent to a lookup service. Kept for 30 days, then deleted automatically.

2What it does not collect

• Nothing kept from the sign-in. There is no password, and no token from the identity provider is stored: only the name and address it reports.
• No use of document content. papyro keeps no document content for its own purposes and never uses it to train AI models. Clause 5 explains what happens when the AI assistant is used.
• No tracking. No tracking cookies, no analytics scripts.
• No selling, no sharing. Personal data is never sold, and never shared with third parties for their own purposes. One infrastructure sub-processor is used (clause 5).

3Repository access

A project's repository lives on papyro's servers (clause 5); signing in needs no git host. A company owner may connect the company's git host (GitHub, gitlab.com or the company's own GitLab) as a mirror, by authorising papyro there or by providing an access token. With that consent, papyro will:

• Create a repository there for each of the company's projects, in the place the owner chose, and push to it when a project is created, when a version is fixed, or when Push is pressed.
• Read from those repositories only when a member asks for changes made there.
• Scan the repositories read-only to find the papyro-enabled ones, those containing a deliverable_register.json file, only when an owner brings in an existing project.

Access can be withdrawn at any time with Disconnect in Account settings › Projects, or in the GitHub or GitLab account settings. The host keeps the copies already pushed there.

4Encryption and security

• All secrets (access tokens, AI keys and cloud credentials) are encrypted at rest with AES-128 (Fernet), under keys derived per user and per organisation.
• Session cookies are httponly and samesite=lax, and travel over HTTPS only.
• Sessions end on sign-out and cannot be reused. A session ends after eight hours without use, and after 24 hours in any case.
• Sign-in endpoints are rate-limited against brute force.
• Every authentication event is recorded in a security log.

5Data location and the AI assistant

All data is stored on servers in Nuremberg, Germany, run by the sole infrastructure sub-processor, Hetzner Online GmbH (hosting, database and encrypted backups). No personal data leaves the European Economic Area.

Other services see personal data only where the company or the person chooses them: Microsoft, as the identity provider of the Microsoft sign-in, under the company's own agreement with Microsoft; the company's git host (GitHub or GitLab), only when an owner connects it as a mirror, under the company's own agreement with that host; and the mail service that delivers a sign-in code to the work address it was asked for.

The AI assistant works on a bring-your-own-account basis. When it is used, the relevant text from the document goes to the AI provider the company has chosen, with the company's own credential and under the company's own agreement with that provider. This can be a direct API key (Anthropic, OpenAI, Mistral, Google) or the company's own AWS Bedrock or Google Vertex account, which lets Claude run in an EU region of the company's choosing under its own cloud contract. In every case papyro routes no AI request through an account of its own and retains none of the content. The AI provider is the company's processor, not papyro's.

Companies on the Enterprise plan run papyro on their own ground. That deployment holds its data on the company's own servers, under the company's own control; this policy covers the service at papyro.space.

A full sub-processor list and a GDPR Article 28 data processing agreement are available on request at carlos@papyro.space.

6Retention

• Account data is kept for as long as the account is active.
• Accounts with no sign-in for 12 months are deleted automatically.
• Security log entries, including sign-in IP addresses, are kept for 180 days, then purged automatically.
• Web server log entries are kept for 30 days, then purged automatically.
• Immediate deletion can be requested at any time (clause 7).

7Your rights

Under the GDPR you have the right to:

• Access. Download a copy of all personal data held about you, at any time, under Settings › Export my data, or request it.
• Rectification. Have inaccurate data corrected.
• Erasure. Delete the account and everything attached to it, at once, under Settings › Delete account, or by writing to papyro.
• Portability. Export the account data as machine-readable JSON under Settings › Export my data. The documents themselves live in the company's Git repository on papyro's servers; a company that connects its git host as a mirror holds a full copy there.
• Objection. Object to processing at any time by deleting the account.

To exercise any of these, write to carlos@papyro.space. papyro answers within 30 days.

8Legal basis

Most processing rests on the performance of a contract (Art. 6(1)(b) GDPR): the account data is needed to provide the service that was signed up for. Security logging and the web server log, including IP addresses, rest on the legitimate interest in protecting the service against abuse and understanding how the site is used (Art. 6(1)(f) GDPR).

9Changes to this policy

Material changes are announced by email to registered users. The effective date at the top of this page is the date of the last revision.