Version: 30 October 2026. This notice applies to the PaperPlane website, application, support, billing, document-processing, integration, sharing and signature services.
1. Controller and contact
code & comments kg
Hörnesgasse 19/16, 1030 Vienna, Austria
Email: hello@codeandcomments.at
No data protection officer is currently appointed. Privacy requests can be sent to the address above. We will publish dedicated officer contact details here if an appointment becomes required.
2. Our roles
We act as controller for the website, customer accounts, authentication, subscriptions, invoices, payments, support, security, fraud prevention, service communications and Personal workspaces.
For a Business workspace, the business customer is normally controller for personal data in its documents, imports, folders, notes, shares, recipients and signature workflows. We process that data on its instructions as processor under our Data Processing Agreement. The business customer must give affected people its own privacy information.
We remain controller for operational account, billing, security and compliance data even when the workspace customer is a business.
3. Data, purposes and legal bases
Website and contact
When the website is requested, infrastructure systems process IP address, request time, requested resource, response status, referrer, user agent and technical security events. This is necessary to deliver and secure the website (Article 6(1)(f) GDPR). If you contact us, we process name, contact details, message and correspondence to answer the request (Article 6(1)(b) or (f)).
The marketing website stores only the selected colour theme in local storage. It currently uses no advertising or analytics tracker. See the Cookie and Browser Storage Notice.
Accounts, authentication and workspaces
We process identity-provider subject identifier, name, email address, language, login and security data, workspace membership, role, invitations, linked identity information and account-lifecycle events to create and protect accounts and deliver the contract (Article 6(1)(b)); security and abuse prevention also rely on Article 6(1)(f). Authentication is provided through a PaperPlane-operated Keycloak deployment.
Documents and archive functions
Depending on use, we process uploaded or imported files, filenames, folder paths, document metadata, extracted text, OCR results, thumbnails, annotations, search indexes, vector embeddings, AI questions and generated answers. Documents may contain any personal data chosen by the user, including special-category or criminal-offence data. For Personal workspaces, processing is needed to provide the requested service (Article 6(1)(b)); the user is responsible for a lawful basis for third-party data placed in the archive. In Business workspaces this processing is performed on the customer’s documented instructions.
OCR and rule-based extraction run in our hosting environment. Semantic indexing sends document text passages to the configured AI provider to create embeddings. Archive questions send the question and selected relevant passages to the configured chat provider. Optional automatic AI metadata extraction, if enabled, sends a limited portion of extracted text. AI processing does not make decisions producing legal or similarly significant effects about users.
Integrations
If enabled by the user, we process connector type, remote account identifier, selected folders, encrypted access and refresh tokens, sync cursors, imported filenames/files or email attachments, job status and errors. Google Drive and Gmail access is read-only; equivalent read/import access is used for Microsoft, Dropbox, IMAP, SFTP and FTP sources. Processing is required to perform the requested import (Article 6(1)(b)) or follows the Business customer’s instructions.
Disconnecting an integration deletes or invalidates its PaperPlane connection credentials as the workflow permits, but does not delete copies already imported into the archive. Remote providers process data under their own terms and privacy notices.
Sharing and signatures
We process share secrets, access modes, expiry and access events; recipient email addresses, verification codes and verification state; signature requests, signers, status, consent evidence, signature images, signed documents and audit events. This is needed to perform the user-requested sharing or signature workflow (Article 6(1)(b)) and to protect the integrity and evidence of the process (Article 6(1)(f)). Recipients who did not create an account receive their data from the workspace user who addressed the request to them.
Qualified-signature data is sent to the identified trust-service provider only if that feature is enabled and selected. The current production configuration does not offer the qualified-signature workflow.
Billing, tax and payments
We process customer type, billing name, organisation, address, email, country, VAT number and validation result, selected plan, prices, tax and location evidence, subscription and payment identifiers, invoices, credits, consent records and payment status. Purposes are contract performance (Article 6(1)(b)), Austrian/EU accounting and tax duties (Article 6(1)(c)), and fraud, claim and payment-security interests (Article 6(1)(f)).
Mollie processes checkout and payment details. We generally receive status and identifiers rather than full card or bank credentials. Mollie also acts under its own legal obligations as a regulated payment provider.
Security, auditing and abuse prevention
We process login, access, change and audit events; IP and device/network information where available; rate-limit data; referral attribution and keyed anti-fraud hashes; incident and support records. This protects users, prevents misuse, demonstrates changes and establishes or defends legal claims (Article 6(1)(f)); certain records are also needed for legal duties (Article 6(1)(c)).
We do not sell personal data and do not use it for third-party advertising.
4. Recipients and service providers
Personnel and contractors receive access only where required for operation, support, security, accounting or legal duties. Current material providers and processing locations are listed in the Service Providers and Subprocessors Register. They include:
- Scaleway for EU infrastructure, object storage, database backups and transactional email;
- OpenAI for configured AI embeddings and chat processing;
- Mollie for payment processing; and
- user-selected Google, Microsoft and Dropbox services for connected-source access.
We may disclose data to professional advisers, authorities or courts where legally required or necessary to establish or defend rights. We do not provide customer content to law enforcement on an informal request; we assess the legal basis and scope of a binding request.
5. International transfers
Core production compute, database, search and object storage are operated in the EU. Transactional email is provided from Scaleway’s Paris, France region.
The currently configured OpenAI service may process data outside the EEA. Where an adequacy decision does not apply, transfers are based on the European Commission’s Standard Contractual Clauses and supplementary contractual and technical measures under the provider agreement. Do not enable or advertise an EU-only data boundary while this configuration remains in use.
User-selected remote providers may process data in other countries under the user’s account and their provider terms. More details and provider links appear in the subprocessor register.
6. Retention
We apply the following periods or criteria:
| Data | Normal retention |
|---|---|
| Active account and workspace data | For the contract and while the account/workspace is active |
| Deleted documents | Recoverable for 30 days unless permanently deleted earlier |
| Deleted account or workspace operational data | 30-day recovery period, then scheduled for purge |
| Imported documents | Until deleted in PaperPlane; disconnecting the source does not delete them |
| Connector credentials | Until disconnected, revoked or the relevant workspace is purged |
| Share/signature records | For the workspace/document lifecycle and legitimate evidence needs |
| Billing consents, payments and invoices | Up to 10 years as implemented for tax, accounting and claims evidence |
| Audit/security records | For the workspace lifecycle or as needed for security and legal claims |
| Support correspondence | As needed to resolve the request and generally for up to three years afterward |
| PostgreSQL backups | Daily recovery points, normally retained for 14 days |
| Non-current object versions | Normally retained for 30 days |
Deletion from live systems does not immediately remove data from a rotating backup. Backup copies age out and are isolated from ordinary use; if restored for disaster recovery, deletion controls are reapplied. We may retain a restricted record longer where a legal hold, statutory duty or specific dispute requires it.
7. Security
Measures include encrypted network transport, role-based workspace access, isolated tenant checks, Keycloak authentication, protected session cookies, encrypted connector credentials, managed secrets, network policies, audit events, rate limits, object versioning and daily database backups. Access is limited according to role and operational need. No internet service can promise absolute security; we assess and improve measures in light of risk and technology.
If a personal-data breach is likely to create risk, we notify the competent supervisory authority without undue delay and, where required, within 72 hours after becoming aware. We notify affected people where the law requires it. Business customers receive breach assistance under the DPA.
8. Your rights
Subject to the applicable conditions, you may request access, rectification, erasure, restriction, data portability and information about recipients. You may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it for the future without affecting earlier processing. You also have the right not to be subject to a solely automated decision with legal or similarly significant effect; PaperPlane does not currently perform such decisions.
Send requests to hello@codeandcomments.at. We may verify identity and, where a Business customer controls the data, refer the request to or assist that customer.
You may complain to the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at (opens an external site), or another competent supervisory authority, particularly in your EEA country of residence or work.
9. Children
PaperPlane contracts are intended for adults aged 18 or over. We do not knowingly offer the service directly to children. If you believe a child has provided data without appropriate authority, contact us.
10. Changes
We update this notice when services, providers or legal requirements change. Material changes are announced through the service or by email where appropriate. The review date and current version appear at the top of this page; prior contract-relevant versions can be requested by email.