Paperpile and GDPR

GDPR is the EU's data protection law. To run Paperpile, we process some of your personal data, and we follow GDPR principles such as transparency, purpose limitation, data minimization, and security. This article explains what personal data we process, how we use it, your rights under GDPR, and how to delete your data.

Personal data Paperpile processes

To provide the service, we process a limited amount of personal data:

• Account information: Your name and email address.
• Billing and subscription data: Your billing details, if you have a paid subscription.
• Product data you store: The references, PDFs, and notes you keep in your library.
• Technical and usage data: Debug logs and similar information we need to keep Paperpile reliable and secure.

How Paperpile uses your data

We use your data for a few purposes:

• Service delivery: To provide Paperpile, as described in our Terms of Service or your contract with Paperpile.
• Legitimate interests: For security, fraud prevention, and service improvement.
• Consent: For anything you opt in to, such as optional email updates.

See our Privacy Policy for more details.

Your GDPR rights

If you're covered by GDPR, you can ask us to:

• Give you access to your data.
• Correct or rectify your data.
• Delete or erase your data.
• Restrict or object to how we process your data, where this applies.
• Provide your data in a portable format, where this applies.

To exercise these rights, contact our support team at support@paperpile.com. To delete your data, follow the steps in the next section.

Delete your data

You can delete your data in two ways, depending on how completely you want it removed.

• Delete your account: You can delete your Paperpile account yourself. This removes your data from our active systems. See Delete your personal data for details.
• Request GDPR erasure: Deleting your account removes your data from our active systems. A GDPR erasure request goes further—it also covers copies in our backups and logs.

To request erasure, email our support team at support@paperpile.com with:

• The subject “GDPR data deletion request”
• Your account email
• Confirmation that you want your data deleted

Data security and confidentiality

We use industry best practices to control and safeguard your data:

• Encryption: Your data is encrypted at rest and in transit.
• Backups: We keep backups and run periodic recovery exercises.
• Least privilege: Admin access follows the principle of least privilege, so staff can only reach the data they need.
• Incident response: We follow internal playbooks to manage security incidents.

For more information, see Security at Paperpile.