Information we collect
We collect account information such as your email address, display name, workspace membership, roles, authentication records, subscription status, credit activity, and support communications. When you use PaperPilot, we process the documents, images, file metadata, deadlines, contract reviews, notifications, and messages you choose to provide.
If you choose to connect an optional service, such as Gmail or Outlook for attachment import or Google Calendar for deadline sync, we store the connected account's email address, an encrypted access token for that service, and basic connection status such as when it last synced. The Gmail and Google Calendar sections below explain what each connection can access.
We also receive device, browser, diagnostic, security, and service-usage information needed to operate PaperPilot, prevent abuse, troubleshoot failures, and improve reliability.
How we use information
We use information to authenticate accounts, store and organize documents, provide workspace features, process AI requests, manage credits and subscriptions, send notifications, import files and sync deadlines through services you connect, provide support, prevent abuse, investigate security events, comply with law, and communicate important service updates. We do not sell your personal information.
Who is responsible for your information
GladoGadgets operates PaperPilot and is responsible for the account and workspace information processed through the service. For privacy questions, access requests, corrections, exports, or deletion requests, contact mail@paperpilot.net.
AI processing
PaperPilot uses automated AI systems to extract fields, summarize documents, identify potential risks, track deadlines, and answer questions about workspace content. We send only the information needed for the requested feature to the applicable AI service provider. AI output can be incomplete or incorrect and is not legal, tax, medical, financial, or other professional advice.
PaperPilot does not use Google Workspace user data, including Gmail and Google Calendar data, to train, improve, or create generalized or foundational AI/ML models. We do not sell that data or transfer it for those purposes. When a PaperPilot feature requires AI processing, the relevant document content or user request is sent to Google Gemini through its server-side API integration under the provider's applicable API terms. PaperPilot uses the API integration for the requested feature only and does not send Gmail message bodies to Gemini merely to list attachments. Google Calendar sync does not send any calendar data to Gemini.
Document actions and analysis (added October 27, 2026)
When you choose an action for selected documents, such as extracting receipt data, tracking recurring payments, analyzing an insurance policy, tracking a warranty or expiry date, extracting obligations, comparing two documents, checking completeness, asking a question, or summarizing documents together, PaperPilot sends the stored text and extracted details of the documents you selected, together with any question or checklist you enter, to Google Gemini through its server-side API to produce the result. Only the documents you select are included. Results are saved to your account so you can review them, correct them, and include them in exports.
Duplicate-expense checks, recurring-payment patterns worked out across your documents, warranty end-date calculations, and data exports run within PaperPilot using details already extracted, without sending document content to an AI provider.
For results from expiry, insurance, and warranty actions, PaperPilot stores and displays only the last four characters of document numbers, policy numbers, and serial numbers, and reminders created from these results name the type of document only. The original document and the text extracted from it when it was read are kept as uploaded.
Google API data and Limited Use compliance
The use of raw and derived user data received from Google Workspace APIs, including Gmail and Google Calendar, adheres to the Google API Services User Data Policy and its Limited Use requirements. PaperPilot uses Gmail data only to provide the user-requested email attachment import feature, to maintain that feature's security, and to operate the resulting document workflow. PaperPilot uses Google Calendar access only to provide the user-requested deadline sync feature described below. PaperPilot does not use Gmail or Google Calendar data for advertising, credit decisions, surveillance, or unrelated profiling.
PaperPilot does not sell, rent, or transfer Google user data to data brokers or to third parties for generalized model training. Access is limited to the connected account owner and authorized PaperPilot server operations. Imported files become PaperPilot documents and are then governed by the document-processing disclosures in this policy. PaperPilot does not read events from your Google Calendar; it only writes and maintains the deadline events described below in the calendar it created.
Service providers and payments
We use service providers for authentication, database and file storage, hosting, monitoring, AI processing, email or notifications, and payment processing. Clerk supports account authentication. If you choose Google sign-in, Google provides identity information for that login. If you connect Gmail or Google Calendar, Google provides the corresponding API service; if you connect Outlook, Microsoft provides it. Supabase supports database and storage services, Gemini supports requested AI processing, and Razorpay processes subscription payments in Indian Rupees (INR). Payment card details are handled by the payment provider and are not stored by PaperPilot.
Providers may process information on our behalf under their applicable agreements. We may disclose information when required by law or when reasonably necessary to protect users, the service, or the public.
Additional service providers (added October 27, 2026)
Vercel hosts the PaperPilot website and runs its server operations. Sentry receives application error reports and performance traces, and records session replays for a sample of browser sessions and for sessions in which an error occurs. Session replays are configured to mask all text and form inputs and to block images and media, and error reports are configured not to include user identity information or request bodies. Sentry data is sent to Sentry's EU data region. Google Analytics loads only if you allow analytics, as described in the Cookie Policy. To convert amounts into your display currency, PaperPilot requests exchange rates from open.er-api.com; those requests contain only currency codes.
Clarification on payment currency: credit top-ups are created and charged in US Dollars (USD). Subscription charges use the currency of the subscription plan set up with Razorpay. The amount and currency shown at checkout are what you will be charged.
Google sign-in
If you choose to sign in with Google, Google and Clerk process identity information to authenticate you. Through Clerk, PaperPilot receives your verified email address and basic profile details, such as your name, to create or access your account and display your name. Google sign-in is optional and separate from the optional Gmail attachment-import and Google Calendar sync connections. Signing in with Google alone does not give PaperPilot access to your Gmail messages or your calendars. Google's use of your information is governed by Google's privacy policy.
Gmail attachment import
Gmail connection is optional and separate from Google sign-in. If you connect Gmail, PaperPilot requests the read-only Gmail permission https://www.googleapis.com/auth/gmail.readonly so it can find supported attachments in recent Inbox and Sent messages and, only after you choose Import, retrieve the selected attachment. PaperPilot does not send or store Gmail message bodies as documents. You can disconnect Gmail from the Email documents panel; disconnecting stops future access but does not delete documents you previously imported.
Google Calendar deadline sync
Google Calendar sync is optional and separate from Google sign-in and Gmail import. If you connect it, PaperPilot requests the permission https://www.googleapis.com/auth/calendar.app.created, together with your Google account email address so the connection can be identified. This permission lets PaperPilot create one secondary calendar named “PaperPilot Deadlines” and create, update, and delete events only in calendars PaperPilot created. PaperPilot cannot read or change your other calendars or events.
For each open deadline, PaperPilot writes an all-day event containing the deadline type, its title, its date, reminder settings, and a link back to PaperPilot. Document contents, amounts, and AI summaries are not written to your calendar. Completed or deleted deadlines are removed from that calendar. You can disconnect from the Deadlines page at any time; disconnecting stops access, revokes PaperPilot's Google token, and can also remove the PaperPilot Deadlines calendar. Deadlines in PaperPilot are not affected.
Security and sensitive data protection
PaperPilot applies technical and organizational safeguards appropriate to the sensitivity of the information it processes. OAuth authorization uses short-lived, user-bound state and PKCE. Provider refresh tokens are encrypted at rest with an application-managed 256-bit AES-GCM key and are never exposed to the browser. Provider client secrets and AI credentials are kept in server-only secret configuration, not in client-visible variables or source code.
Documents and structured document data are stored in private, access-controlled storage and database records. Server operations enforce the authenticated account or workspace owner before reading or changing data. Imported files are checked for supported type, size, and file signature before storage. We use HTTPS in production, access logging and monitoring, rate limits, least-privilege service access, and security incident procedures. No method of transmission or storage is completely risk-free, so users should not upload information they are not authorized to share.
Workspace data and sharing
Personal workspace content is scoped to your account. Team workspace content may be visible to members and authorized managers according to workspace roles and permissions. You are responsible for inviting only people who should have access to shared content.
Retention and deletion
We retain account, workspace, document, credit, and subscription records while needed to provide PaperPilot, maintain security, meet legal or accounting obligations, resolve disputes, and enforce agreements. You can request export or deletion through support. Tokens for connected services are kept only while the connection exists and are deleted when you disconnect it or delete your account. Events PaperPilot added to your Google Calendar are stored by Google in your Google account; they remain there after you disconnect unless you choose to remove the PaperPilot Deadlines calendar, and you can delete that calendar in Google Calendar at any time. Deleted content may remain in protected backups for a limited period before being overwritten.
Processing, billing, and security records (added October 27, 2026)
PaperPilot keeps the processing status of each document, such as queued, being read, or failed with an error message, so interrupted work can resume. A credit ledger records each credit charge, refund, and returned reservation, including the action, the AI model used, the amount of AI processing (tokens), and the estimated provider cost. Audit records are kept for important account actions.
To prevent abuse, PaperPilot keeps short-lived request counters identified by your account or by a one-way hash of your IP address. Raw IP addresses are not stored in these counters, and a daily clean-up deletes counters older than two days.
When you delete a document, PaperPilot deletes the file, its saved versions, its extracted data, and the saved action results that include it. Deadlines and reminders stay in your Deadlines list until you delete them, without the link to the deleted document. Credit ledger entries are kept as billing records, without the link to the deleted document.
Your choices and rights
You can update profile information, manage workspace members, control notifications, review subscription details, disconnect Gmail, Outlook, or Google Calendar from PaperPilot at any time, or remove PaperPilot's access from your Google account permissions at myaccount.google.com/permissions, and request access, correction, export, or deletion by contacting mail@paperpilot.net. Depending on your location, you may have additional privacy rights under applicable law.
Deletion requests
You may request deletion of your account or personal information by emailing mail@paperpilot.net. We may need to verify your identity before acting. We may retain limited information when necessary for security, fraud prevention, legal compliance, accounting, dispute resolution, or enforcement of our agreements.
Updates to this policy
On October 27, 2026, we added the sections marked “added October 27, 2026” to describe document actions, additional service providers, the payment currency, and processing, billing, and security records. The rest of this policy is unchanged.
Contact
Questions about this policy can be sent to mail@paperpilot.net.