Paperwright is operated by bldr arena LLC, a Wyoming limited liability company ("we", "us"). This policy explains what we collect when you use paperwright.dev, app.paperwright.dev, the Paperwright API and SDK (the "Service"), why, who we share it with, and the choices you have.
The short version
- We collect what we need to run your account and your templates, and nothing to sell. We do not sell or rent personal data, and we do not show ads.
- The data your app sends us to make a PDF is used to make that PDF and is not stored.
- When you choose to use an AI feature, what you give that feature is sent to our AI provider, Anthropic, and to no one else.
- You can ask us for a copy of your data, or to delete it, at any time: info@paperwright.dev.
What we collect
Account information. Your email address and a hashed password (we never store it in plain text), plus your plan and sign-in security state (such as failed attempts). If you sign in with Google or GitHub, we receive your email address and account ID from that provider, and nothing from your contacts, repositories or files.
Workspace content. The templates you design, their sample data, version history, comments, workspace members and invitations, uploaded base PDFs, and API keys (stored hashed). This is your content; we hold it so you can use it.
Data you send to make PDFs. When you or your app calls the render API, the data in the request is used to produce the PDF and is then discarded. We keep only a usage record: which workspace, which template, when, the source (preview, API or batch) and the file size, so we can show you your usage and enforce limits.
Batch files. When you upload a spreadsheet to make many PDFs at once, its rows are kept only while the job runs and are deleted when it finishes. The finished ZIP is kept for 24 hours so you can download it, and then deleted. If you ask us to email each PDF, the recipient addresses come from your spreadsheet; we send to them once and do not add them to any list.
AI features. If you use "Generate with AI", AI steps or section refine, we send the image or PDF you provide, your instructions, and (for steps on an existing document) that document's layout, text and sample values to Anthropic to produce the result. Data your app sends to make PDFs is never sent to the AI. We record each AI call's time, the account that made it, the feature used, token counts and cost, so we can manage usage; we do not keep a copy of the AI output beyond what you save. A reference image you attach is kept in your own browser so a later step can use it; it is not stored on our servers.
Technical information. When you sign in we record the IP address and browser of the session, to keep sessions secure and let you notice unfamiliar sign-ins. Our servers keep short-lived operational logs (errors, request timing, and the recipient address of emails we send for you) to run and debug the Service.
Analytics. We use Vercel Web Analytics to count page views on our website. It does not use cookies and does not identify you across sites.
Cookies and local storage
We use a secure, HTTP-only cookie to keep you signed in, and a cookie that remembers your language. The app also stores your session, theme and editor preferences in your browser's local storage. We use no advertising or cross-site tracking cookies.
Who we share it with
We use these service providers to run Paperwright. Each may process personal data only to provide its service to us:
| Provider | What for | Where |
|---|---|---|
| Vercel | Website and app hosting, page-view analytics | Global edge network |
| Render | API servers and PDF rendering | Frankfurt, Germany |
| Neon | Database | Frankfurt, Germany (AWS) |
| Cloudflare R2 | Temporary batch files | Cloudflare network |
| Resend | Account and document emails | United States |
| Anthropic | AI features, only when you use them | United States |
| Google, GitHub | Sign-in, only if you choose it | United States |
Under its commercial terms, Anthropic does not train its models on the data we send it. We may also disclose information if the law requires it, to protect the rights and safety of our users or the Service, or as part of a merger or sale of the business, in which case this policy continues to apply to your data.
How long we keep it
We keep your account and workspace content for as long as your account exists. Render data is not stored. Batch rows are deleted when the job ends and batch ZIPs after 24 hours. Usage and AI call records are kept for as long as your account exists, so your usage history stays accurate. When you delete your account, we delete your account and workspace content within 30 days; backups roll off on their own schedule after that.
Your choices and rights
You can view and edit your profile and content in the app at any time. You can ask us to send you a copy of your data, correct it, or delete your account and its content by writing to info@paperwright.dev. Depending on where you live (for example the EU, the UK or California) you may have further rights, such as to object to or restrict processing, and to complain to your local data protection authority. We will answer within 30 days and will not treat you differently for asking.
Where data protection law requires a legal basis, we process your data to perform our contract with you (running your account and the Service), for our legitimate interests (keeping the Service secure, understanding usage), or with your consent (optional sign-in providers and AI features, which you can stop using at any time).
Data you put in your documents
If your templates or render requests contain personal data about other people, such as your customers or employees, you decide what that data is and why it is used, and we process it on your behalf to provide the Service. Please make sure you have the right to use it.
Security
Connections are encrypted with HTTPS, passwords and API keys are stored hashed, and the PDF renderer runs with scripts and outbound network access disabled. No system is perfectly secure; if we learn of a breach that affects your data, we will tell you without undue delay.
International transfers
We are a US company and our providers operate in several countries, so your data may be processed outside the country where you live. Where the law requires it, we rely on safeguards such as the providers' standard contractual clauses.
Children
Paperwright is a business tool and is not intended for anyone under 16. We do not knowingly collect data from children.
Changes
If we change this policy in a way that matters, we will update the date below and, for significant changes, tell you by email or in the app before they take effect.
Contact
bldr arena LLC, Wyoming, United States. Email: info@paperwright.dev