Privacy Policy

1. Controller

The controller responsible for the processing of your personal data is blaumedia GmbH, Friedrich-Ebert-Hof 6, 22763 Hamburg, Germany. Managing Director: Dennis Oliver Paul. Registered at Amtsgericht Hamburg, HRB 198611. Email: privacy@paperhero.io.

For personal data contained in the documents you upload, you are the controller and we act as your processor under a Data Processing Agreement (see our DPA and section 4 below).

2. What data we process

Depending on how you use PaperHero, we process the following categories of personal data:

• Account data: first and last name, email address, password (stored only as a scrypt hash), language and timezone, and, if you enable them, two-factor authentication and encryption-key settings.
• Document data: the files you upload (PDFs, images, scans), the text extracted from them, search indexes (embeddings) and any metadata you add (names, folders, tags). Documents may contain personal data about you or third parties; you decide what you upload.
• AI inputs and outputs: the questions you ask the AI assistant, the document content sent to AI models to answer them, and the responses. We also keep a processing log for each document that records which hosting tier processed it (see section 4).
• Usage and technical data: log data such as IP address, timestamps, device and browser information and actions performed, needed to operate and secure the service.
• Payment data: your billing details and subscription status. Card data is handled by our payment providers (Stripe for the website, Apple for in-app purchases); we never receive or store full card numbers.
• Communication data: the content of support requests and emails you send us.
• Email-ingress data (optional): if you enable forwarding, the attachments sent to your personal PaperHero address (see section 6).

3. Purposes and legal bases

We process your data on the following legal bases under Art. 6(1) GDPR:

• Providing the service (account, document storage, OCR, search, AI assistant, sharing, mobile apps): performance of the contract, Art. 6(1)(b) GDPR.
• Payment, billing and statutory record-keeping: Art. 6(1)(b) and Art. 6(1)(c) GDPR (including retention obligations under German commercial and tax law).
• Security, abuse prevention and operating logs: our legitimate interest in a secure service, Art. 6(1)(f) GDPR.
• Privacy-friendly, cookieless analytics: legitimate interest, Art. 6(1)(f) GDPR; cookie-based analytics and marketing: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG.
• Service-related communication and support: Art. 6(1)(b) and (f) GDPR.
• Feedback and reviews you send us via the customer portal or an emailed link: service improvement, legitimate interest, Art. 6(1)(f) GDPR; publication of a review on paperhero.io with your first name and abbreviated last name happens only with your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time by emailing privacy@paperhero.io.

4. Documents and AI processing

Your documents are stored encrypted (see section 8). Newly uploaded files, however, first arrive in your personal inbox; there PaperHero performs text recognition (OCR), generates preview images and computes the search indexes to make your documents searchable and useful and to let you ask an AI assistant questions about them.

Your inbox is personal. Because inbox content is not yet associated with a defined set of recipients at this stage, it is held unencrypted on our servers in the EU until import. Only on import is the file encrypted and made accessible to the users who are authorised through the chosen target folder; in a multi-user account, administrators can manage inbox content.

Search indexes (embeddings) are always computed on our own infrastructure in Germany. They are never sent to a third-party AI provider, in any hosting tier.

Text recognition and the AI assistant run in one of three hosting tiers. Each tier is named after the place where the processing happens, and which tiers you can select depends on your plan:

EU Hosting (from the Small plan, including the Trial): processing by Mistral AI SAS in France. We call Mistral's own API directly for this, without an intermediary gateway.

German Hosting (from the Medium plan): processing by AKI.IO GmbH, Marienburger Str. 1, 10405 Berlin, Germany. AKI.IO operates exclusively on servers in Germany, in ISO 27001 certified data centres and without hyperscalers in its stack; it retains no data and does not train on customer data. For the GPU infrastructure, AKI.IO engages AIME GmbH, Marienburger Str. 1, 10405 Berlin, Germany, as its sub-processor.

PaperHero Hosting (Big plan): processing on AI models that we operate ourselves, on our own servers in Germany (see section 7).

If a hosting tier is temporarily unavailable, processing may fall back one level for the duration of the disruption: PaperHero Hosting to German Hosting, and German Hosting to EU Hosting. EU Hosting is the lowest level and is not replaced any further. A fallback never runs in the opposite direction and never goes to a provider outside the EU. Every such substitution is recorded and is shown to you in the processing log of the document concerned.

We have data-processing agreements in place with all of these providers. Your documents and AI inputs are used only to deliver the feature you requested and are not used to train the providers' AI models.

5. Mobile apps (iOS and Android)

Our iOS and Android apps let you scan, photograph, upload and manage documents. They request access to your camera solely to scan documents; captured images are processed for your account just like any other upload.

The apps contain no advertising, no analytics or tracking SDKs and no third-party trackers, and we do not build advertising profiles. Subscriptions purchased in the iOS app are handled by Apple (see section 9).

6. Email ingress (optional)

If you enable email ingress, you receive a personal PaperHero email address. Messages sent there are retrieved over an encrypted connection from our own mail server (mail.blaumedia.com); supported attachments (PDF, JPEG, PNG) are imported as documents and the message is otherwise not stored. You can restrict accepted senders with a whitelist and can disable the feature at any time.

7. Hosting and storage location

PaperHero is hosted on infrastructure operated by Hetzner in Germany; the data centres used for it are located exclusively in Germany. Your documents and account data are stored on this infrastructure, and this is also where the PaperHero Hosting tier runs.

Text recognition and the AI assistant may, depending on the hosting tier used, additionally run at the processors named in section 9, in Germany or in another EU member state. Section 4 sets out which tier means which place of processing.

When choosing these service providers we specifically made sure that no provider that stores or processes your documents in any way is subject to the US CLOUD Act. Every company involved in that is based in Germany or France and is not part of a US group, so a disclosure order under the CLOUD Act cannot reach your documents. Payment processing (section 9) is separate from this and involves no document content.

8. Encryption and security

Each user has a personal key pair. Your private key is protected by your password (key derivation with scrypt, encryption with AES) and is unlocked with your password on your device. Documents are encrypted at rest with a per-document key, and all connections are additionally protected by TLS.

When you simply view or download your documents, decryption takes place locally on your device. Our server only ever provides the encrypted data; your private key and your decrypted document content are not transmitted to us.

Only when you use the search or AI features is your key transmitted to our service for that specific request, so that the relevant content (your documents and the search index) can be decrypted server-side and used for search and AI processing as described in section 4. Depending on the hosting tier you use, this includes transmission to the AI processors named in sections 4 and 9.

By default we keep your private key solely in the form encrypted with your password; we do not store it in clear text, so we cannot read your documents on our own initiative. Optionally you can enable end-to-end encryption - we then delete this server-side copy, and your keys remain solely on your own devices.

Passwords are stored solely as scrypt hashes. Each customer's data is isolated in its own database and storage area. All connections are TLS-encrypted and two-factor authentication is available.

9. Recipients and processors

We use carefully selected service providers who process data on our behalf under Art. 28 GDPR, and a small number of independent recipients where required to provide the service:

• Hetzner Online GmbH (Germany / EU) - hosting and storage.
• AKI.IO GmbH, Marienburger Str. 1, 10405 Berlin, Germany - AI text recognition and assistant in the German Hosting tier, on servers in Germany. AKI.IO engages AIME GmbH, Marienburger Str. 1, 10405 Berlin, Germany, as its sub-processor for the GPU infrastructure. We have a data processing agreement with AKI.IO GmbH that includes a supplementary agreement for members of professions bound by professional secrecy under section 203 of the German Criminal Code (§ 203 StGB).
• Mistral AI SAS, France - AI text recognition and assistant in the EU Hosting tier. We call Mistral's API directly, without an intermediary gateway.
• blaumedia GmbH mail server (mail.blaumedia.com) - transactional email and email ingress.
• Our self-hosted CRM (Twenty), operated on our own EU infrastructure - customer and subscription records.
• Stripe Payments Europe, Ltd. - payment processing for website subscriptions.
• Apple - payment processing and subscription management for purchases made in the iOS app; for in-app purchases Apple is the seller of record and processes the related payment data under its own terms.

10. International data transfers

Our core processing (hosting, document storage, search indexes, and AI processing in all three hosting tiers) takes place within the EU, as does reach measurement with Matomo.

Only if you have enabled the "Marketing" category in the cookie settings (section 13) is your data also transferred to Google and LinkedIn: to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and to LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, and from them to Google LLC and LinkedIn Corporation in the USA. Both US companies are certified under the EU-U.S. Data Privacy Framework (as of 1 October 2026). The legal basis for the transfer is the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework (Art. 45 GDPR); in addition the providers have adopted the EU Standard Contractual Clauses in their terms (Art. 46(2)(c) GDPR). The Irish entities process the data collected on our website jointly with us; the US companies process it as independent controllers for their own purposes (for Google, the Google Ads controller-to-controller data protection terms additionally apply).

11. Retention and deletion

We keep your data for as long as your account exists. When you delete your account (in the app, in the customer portal, or by contacting us), access is disabled immediately and your documents, account data and search indexes are erased within 30 days.

We retain invoices and accounting records for the statutory period of up to 10 years (§ 147 AO, § 257 HGB). Where data is required to comply with legal obligations or to assert or defend legal claims, we retain it for as long as necessary for that purpose.

12. Your rights

You have the following rights regarding your personal data. To exercise them, contact privacy@paperhero.io; account holders can also export their data and delete their account directly in the app or customer portal.

• Access (Art. 15), rectification (Art. 16) and erasure (Art. 17) GDPR.
• Restriction of processing (Art. 18) and data portability (Art. 20) GDPR.
• Objection to processing based on legitimate interest (Art. 21 GDPR).
• Withdrawal of any consent you have given, with effect for the future (Art. 7(3) GDPR).
• The right to lodge a complaint with a supervisory authority — for us the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit).

13. Cookies and analytics

Without your consent this site loads no third-party scripts. Reach measurement happens server-side; no tracking script from Matomo runs in your browser.

Cookies: without your consent we use first-party, essential cookies only. Alongside the cookies for authentication these are NEXT_LOCALE (language preference, 12 months), _ph_vid (a random visit identifier, 13 months), _ph_attr (the click identifier of the advertising network you reached us through, 90 days) and ph_aff (the identifier of the partner whose link you reached us through, 60 days). _ph_vid, _ph_attr and ph_aff are set by our server, are HttpOnly and therefore unreadable by scripts in the browser, and are not passed to third parties. cc_cookie records your decision on this notice (6 months).

Reach measurement: our server sends page views to Matomo, a self-hosted open-source tool that we run on our own infrastructure in Germany. It processes the page visited, the referrer, browser identification, language and your IP address. The legal basis is our legitimate interest in measuring reach and providing an offering that meets demand (Art. 6(1)(f) GDPR). No data is passed to third parties.

Marketing (only with your consent): if you enable the "Marketing" category in the cookie settings, we load in your browser the Google Ads tag (gtag.js) of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and the LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Both record which pages of our site you visit, your IP address and browser identification, so that ads for PaperHero can be shown to you on Google and LinkedIn (remarketing); they do not measure conversions. For this they set cookies and identifiers in your browser, among others "_gcl_au" (Google, 90 days) and "li_adsId" (LinkedIn, 180 days) on our website, plus "li_sugr" (90 days), "bcookie" (1 year), "lidc" (24 hours), "UserMatchHistory" (30 days), "AnalyticsSyncHistory" (30 days) and "li_gc" (6 months) that LinkedIn sets on linkedin.com; the providers also set further cookies on their own domains. Details: https://policies.google.com/privacy and https://www.linkedin.com/legal/privacy-policy. The legal basis is your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG; the data may be transferred to Google LLC and LinkedIn Corporation in the USA (section 10). The providers process the data as independent controllers for their own purposes; we are jointly responsible only for collecting the data on our website and transmitting it. Without your consent neither tag is loaded and no connection to Google or LinkedIn is made. We do not load the tags in the customer portal. You can withdraw your consent at any time with effect for the future by disabling the "Marketing" category under "Cookie Settings" in the footer; the tags are then no longer loaded and the cookies they set on our site are deleted.

You may object to the reach measurement at any time under Art. 21(1) GDPR - informally, at privacy@paperhero.io. You can bring up the cookie settings again at any time via "Cookie Settings" in the footer.

14. Children

PaperHero is not directed at children. You must be at least 18 years old to enter into a contract with us, and we do not knowingly process the data of minors.

15. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to the service or legal requirements. We will inform you of material changes by email or in the app. The date above indicates the current version.

Contact

For privacy questions or to exercise your rights, contact our data protection contact:

privacy@paperhero.io

blaumedia GmbH
Friedrich-Ebert-Hof 6
22763 Hamburg
Germany