隐私政策

Account data. Your email address, your name if you enter one, and a password, which our authentication provider stores only as a hash. If you accept an invitation, we record which workspace invited you.

Workspace data. The templates you import or write, including any text and images in them; the values you fill into placeholders; the documents you generate and their PDFs; folder names and document titles. This is your content. We process it to provide the service and for nothing else.

Billing data. Your plan, its status and the customer identifier our payment provider assigns to your workspace. Card numbers and billing addresses are collected and stored by Polar, our merchant of record; they never reach our servers.

Connection data. API keys you create (stored hashed; the plaintext is shown once) and the AI-assistant connections you approve: which assistant, which workspace, when.

Technical data. Our hosting provider records request logs (IP address, browser type, the pages and API routes requested, timestamps) for a short time, for security and debugging. We count page views with Simple Analytics, which uses no cookies and no identifiers and cannot recognise a returning visitor.

What we do not collect. We set no advertising or tracking cookies.

What stays in your browser. We store your sign-in session and interface preferences in your browser. When you view a generated document through our chat widget, the widget may also store up to three recent document previews in browser local storage so it can restore them when you return to the conversation. These cached previews include rendered document content and document-link metadata. They are replaced as newer previews are stored and have no automatic time-based expiry. You can remove them through your browser's site-data controls where the chat host makes that storage available. The assistant provider may separately retain conversation content under its own policy.

When you fill a public template on one of our template pages, the values stay in your browser; nothing is sent to us unless you generate a document in your own workspace.

• To run the service: store your templates, apply your fills, generate documents, render PDFs, and share work within your workspace according to its members and roles.
• To sign you in and keep your account secure.
• To bill you, through Polar, and to answer support requests.
• To understand how the product is used in aggregate: page views by page and country, never by person.
• To meet legal obligations.

We do not sell personal data, and we do not use your content to advertise to you or to anyone else.

Placeholder detection on import. When you import a Word file with the "Find fillable placeholders with AI" switch on, we send an outline of the document's text (no images, and not the file itself) to Anthropic's API, which proposes where the placeholders should go. Anthropic processes it under its commercial API terms and does not use it to train models. Switch it off and nothing leaves your browser but the parsed document.

Connected assistants. If you connect an AI assistant (Claude, ChatGPT, or a tool using our API) to a workspace, it can read that workspace's templates and generated documents and generate new ones, using your access. What the assistant does with what it reads is governed by its provider's terms and privacy policy, not by this one. The connector returns the text of templates and generated documents that your account can access in the connected workspace. Generated-document lists also include creator names and identifiers for finding documents by creator. When a document is generated or reopened through the connector, it returns a PDF download link that works without sign-in for approximately one hour. Anyone who has that link can download the document until the link expires, so share it only with intended recipients. Downloaded copies can remain with their recipients after a link expires.

You can disconnect at any time. Revoking an API key in PaperClerk stops its access immediately. Removing a connector in the assistant stops the assistant from making new connections; an access token it was already issued can keep working until it expires, typically within an hour, and PDF download links already issued keep working until their own one-hour expiry. To stop access sooner, email hello@usepaperclerk.com.

We do not use your documents to train models, and neither do the providers we use to run PaperClerk, including Anthropic for placeholder detection. When you connect an assistant, the text it reads is sent to that assistant's provider, and whether that provider retains it or uses it for training depends on its terms and your settings there, not on us.

We use a small number of providers, each bound by a data-processing agreement and used only for the purpose listed:

• Supabase: database, authentication and file storage (templates, documents, PDFs).
• Vercel: hosting, server-side PDF rendering, request logs.
• Polar: payments, subscriptions, invoices and tax, as merchant of record.
• Anthropic: AI placeholder detection, only when you switch it on.
• Simple Analytics: cookieless page-view counts.
• Resend: delivery of account emails (the one-time code that confirms your email address when you sign up, and the link that confirms a change of email address), sent on behalf of our authentication provider.
• Google Workspace: our hello@usepaperclerk.com mailbox, where support email arrives, and the Google account that holds the Google Docs copies of public templates.

Members of your workspace see the templates and documents shared with them, according to each document's visibility and their role; owners and admins can see every document in the workspace. If a workspace publishes a template as a public template, its content is public by design, and a copy is mirrored to Google Docs from an account we control.

Some of these providers store data outside your country, including in the United States. Each provides contractual safeguards for those transfers.

• Account and workspace data: for as long as the account or workspace exists. Deleting a template keeps the documents generated from it, since those are records, until they are deleted too.
• PDFs and files: as long as the document they belong to.
• Request logs: a matter of days.
• Billing records: as long as tax and accounting law requires, held by Polar.
• Backups: our database provider keeps rolling backups for a limited period after deletion.

To delete a workspace or your account, email hello@usepaperclerk.com; we complete the deletion within 30 days. Export your documents first; Markdown and PDF downloads are available in the app.

Data travels over TLS and is stored encrypted at rest. Every database query runs under row-level security, so a workspace's data is only ever readable by that workspace's members. API keys are stored hashed and are bound to one workspace and to the standing of the admin who created them. No system is perfectly secure; if you believe you have found a problem, email hello@usepaperclerk.com and we will respond promptly.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to restrict or object to its processing, and to complain to a data-protection authority. You can change your name, email and password on your profile page and export documents from the app; for anything else, email us and we will act within 30 days. We never charge for exercising a right.

PaperClerk is not directed at children under 16, and we do not knowingly collect their data.

We will post changes here and update the date at the top. If a change materially affects how we handle your data, we will tell account owners by email first.

hello@usepaperclerk.com