Skip to content

Privacy Policy

Last Updated: May 26, 2026

1. Introduction

PaperStack (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our API platform and website at paperstack.qzz.io.

2. Information We Collect

2.1 Information You Provide

  • Account Information: Name, email address, and password when you register.
  • Billing Information: Payment details processed securely through our payment processor (we do not store full payment credentials).
  • Communications: Information you provide when contacting support or submitting feedback.

2.2 Information Collected Automatically

  • API Usage Data: Endpoints accessed, request timestamps, response status codes, and volume of requests.
  • Device and Browser Data: IP address, browser type, operating system, and referring URLs when visiting our website.
  • Analytics: Page views, navigation patterns, and interaction data via Vercel Analytics.

3. How We Use Your Information

  • To provide, maintain, and improve the Service.
  • To authenticate API requests and enforce rate limits.
  • To monitor usage patterns and detect abuse or unauthorized access.
  • To communicate with you about service updates, billing, and support requests.
  • To analyze and improve platform performance and reliability.
  • To comply with legal obligations and enforce our Terms of Service.

4. Data Sharing and Disclosure

We do not sell your personal information. We may share information in the following circumstances:

  • Service Providers: With third-party vendors who help us operate the platform (Cloudflare, Vercel, Unkey, Appwrite). These providers are bound by data processing agreements.
  • Legal Compliance: When required by law, court order, or governmental regulation.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to you.
  • Aggregated Data: We may share anonymized, aggregated usage statistics that cannot identify individual users.

5. Data Retention

We retain your account information for as long as your account is active. API usage logs are retained for up to 12 months for security analysis and then anonymized. If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law.

6. Data Security

We implement industry-standard security measures including:
  • Encryption in transit via TLS 1.3 for all API and web traffic.
  • API key authentication via Unkey with per-key rate limiting.
  • Regular security audits and dependency scanning.
  • Access controls restricting internal access to production data.
No method of transmission or storage is 100% secure. We cannot guarantee absolute security but take all reasonable precautions.

7. Your Rights

Depending on your jurisdiction, you may have the right to:
  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your data (subject to legal retention requirements).
  • Object to or restrict processing of your data.
  • Request portability of your data in a machine-readable format.
  • Withdraw consent at any time where processing is based on consent.
To exercise these rights, contact us at support@paperstack.qzz.io. We will respond within 30 days.

8. Third-Party Services

We use the following third-party services:

  • Vercel — Hosting and deployment platform.
  • Cloudflare — CDN, DNS, and edge computing (Workers).
  • Unkey — API key management and rate limiting.
  • Appwrite — User authentication and account management.
  • Vercel Analytics — Website usage analytics.

Each service has its own privacy policy governing data handling. We encourage you to review their policies. We are not responsible for the privacy practices of these third parties.

9. Cookies

PaperStack uses cookies and similar tracking technologies for authentication, analytics, and service improvement. You can manage your preferences via our cookie consent banner.

9.1 Essential Cookies

These cookies are required for the platform to function. They cannot be disabled.

  • Authentication Session (a_session_*): HttpOnly, SameSite=Strict cookie set upon login to maintain your authenticated session. Expires when your session expires.
  • PostHog Identity (ph_*): Used to distinguish unique users for analytics. Set via server-side middleware. Respects your analytics consent preference.

9.2 Analytics Cookies

Controlled by your analytics consent preference. PostHog captures page views, navigation patterns, and feature usage. All data is pseudonymized. We use self-hosted-compatible ingestion via /ingest proxy — data is sent to PostHog Cloud (EU region) without exposing their API key client-side.

  • Page views, session duration, navigation flows
  • Feature usage and interaction events
  • Device type, browser, operating system (user-agent headers)
  • Referrer URL and landing page

9.3 Marketing Cookies

Controlled by your marketing consent preference. Enabled only with explicit consent.

  • Google Tag Manager (GTM-P86XT6L3): Tag management system that loads Google Analytics and other marketing tags.
  • Google Analytics (G-T4LV0TZQ8V): Aggregated audience insights, campaign attribution, and traffic source analysis. Uses cookies like _ga, _gid, and _gat.

9.4 Managing Your Preferences

You can accept, reject, or customize cookie preferences at any time. Your choices are stored in localStorage and apply across all pages. To change your preferences:

  • Click the cookie consent banner when it appears on your first visit.
  • Clear your browser’s localStorage to reset the consent state and re-trigger the banner.
  • Configure your browser to block or delete cookies. Note that essential authentication cookies are required for dashboard access.

Important: We do not use cookies for advertising, cross-site tracking, or selling your data. Analytics and marketing cookies are used solely to improve the platform and understand how our users interact with it.

10. International Data Transfers

Your data may be processed on servers located in various global locations through our cloud infrastructure providers (Vercel and Cloudflare). By using the Service, you consent to the transfer of your data to these locations. We ensure appropriate safeguards are in place through Data Processing Agreements with our providers.

11. Children’s Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that a minor has provided us with personal data, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through a notice on our website. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us at:

Email: support@paperstack.qzz.io
Website: paperstack.qzz.io