Privacy Policy
Last updated October 12, 2026
This policy explains what Paperwing ("we") collects when you use paperwing.org, why we collect it, who processes it for us, and the choices you have. In short: we collect what we need to run the Service, we don't sell your data, and you can delete your account at any time.
What we collect
- Account details: your email address and a one-way hash of your password. We never store the password itself.
- Workspace data you enter: your operation details, crew names, roles and training dates, duty logs, reporting events, routes and areas, and document drafts.
- Billing records: your Stripe customer ID, plan and payment status. Stripe holds your card details; we never see or store them.
- Technical data: IP addresses, request logs and error reports, used to keep the Service secure and working.
How we use it
Only to provide, secure and support the Service: saving your workspace, drafting your documents, processing payments, sending account emails (such as email confirmation and password resets), answering support requests, fixing errors and preventing abuse. We do not sell your data, share it for advertising, or use it to train AI models.
Document drafting
When you draft a document, your operation details are sent to Anthropic through its commercial API so its Claude model can write the draft. We send only what the document needs, not your password or payment details.
Who processes data for us
- Vercel: hosting
- Neon: database
- Anthropic: document drafting
- Stripe: payments
- Resend: account emails
- ImprovMX: support email forwarding
Each processes data on our behalf under its own terms and security commitments. These providers are based in, or process data in, the United States.
Cookies
We use one essential cookie to keep you logged in. We do not use advertising or tracking cookies, and fonts are served from our own servers.
Crew information
If you enter information about your crew, you confirm you are allowed to share it for compliance tracking. Crew members can ask you, or us at support@paperwing.org, to correct or remove their information.
Retention and deletion
We keep your data while your account is open. You can delete your account from your account page; this permanently removes your workspace, drafts and account details from our database straight away. Backup copies are overwritten within 30 days. Payment records stay with Stripe for as long as tax and accounting law requires. Error reports are deleted after 30 days.
Your choices and rights
You can view and change your workspace at any time, change your password, and delete your account. To get a copy of your data or ask about anything in this policy, email support@paperwing.org. We answer within 30 days.
Security
All traffic is encrypted with HTTPS. Passwords are hashed with scrypt, login cookies are HTTP-only, and login attempts are rate limited. Access to production systems is limited to the people who run the Service.
Children
Paperwing is for businesses and is not intended for anyone under 18.
Changes
If we change this policy in a material way, we will tell you by email or in the Service before the change takes effect.