LEGAL
Privacy Policy
How PaperPict collects, uses, and protects personal data, in line with the GDPR.
1. Who we are
PaperPict ("we", "us") operates paperpict.com and the PaperPict application. We are established in France and act as the data controller for personal data described in this policy. Contact: privacy@paperpict.com.
2. What we collect
- Account data — name, email address, password hash, plan, and billing status.
- Content you provide — text prompts, sketches, images, abstracts, PDFs, and the figures generated from them.
- Usage data — pages visited, features used, generation counts, device and browser information, approximate location derived from IP address.
- Payment data — handled by our payment processor; we store only the last four digits, card type, and transaction records.
- Support correspondence — messages you send us.
3. Why we process it and on what basis
- To provide the service and generate your figures — performance of a contract (Art. 6(1)(b) GDPR).
- To bill you and keep accounting records — legal obligation (Art. 6(1)(c)).
- To secure the service, prevent abuse, and improve features — legitimate interests (Art. 6(1)(f)).
- To send product updates — consent (Art. 6(1)(a)), which you can withdraw at any time.
4. Your content and AI models
Prompts, uploads, and generated figures are processed to produce your output and to provide editing, storage, and export. We do not use your manuscripts, sketches, or figures to train machine-learning models. Where third-party AI providers are used for generation, your content is transmitted under agreements that prohibit training on it and require deletion after processing.
5. Sharing
We share data only with processors that help us run the service: hosting and storage, AI inference providers, payment processing, email delivery, and analytics. Processors are bound by data-processing agreements. We do not sell personal data.
6. International transfers
Some processors are located outside the European Economic Area. Transfers rely on adequacy decisions or the European Commission's Standard Contractual Clauses with supplementary measures where required.
7. Retention
Account data is kept while your account is active and for up to 12 months after closure. Uploaded PDFs and images are deleted 30 days after the related figure is deleted. Billing records are kept for 10 years as required by French law. Usage logs are kept for 13 months.
8. Your rights
You have the right to access, rectify, erase, restrict, and port your data, to object to processing based on legitimate interests, and to withdraw consent. Write to privacy@paperpict.com. You may also lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés) or your local supervisory authority.
9. Security
Data is encrypted in transit and at rest. Access is limited to staff who need it, and generation infrastructure is isolated per request.
10. Children
PaperPict is intended for users aged 16 and over. We do not knowingly collect data from younger children.
11. Changes
We will post updates to this policy here and, for material changes, notify account holders by email.