Privacy Policy

Papernils (“we”, “us”) is a receipt-scanning and bill-splitting service operated by [legal entity]. This policy explains what personal information we collect, how we use it, who we share it with, and your choices. Questions: [privacy@papernils.com].

1. Information we collect

You give us:

• Email address — for passwordless sign-in. We email you a one-time link; we don't store a password.
• Profile — a display name and any payment handles you add (e.g. PayPal.me, Venmo, Wise, Revolut, Interac). You add these so people you split with can pay you back; they're shown to those people by design.
• Preferences — your home currency and rounding preference.
• Receipts — the photos you upload, voice descriptions you speak, or data you type, plus the line items, merchants, dates, amounts, and categories derived from them.
• Bill-splitting data — trips, the people you split with (including the names of people who don't have an account — see §3), who paid, who owes whom, settlements you record, and your friend connections.

Generated automatically: an activity log of changes to shared receipts/trips, and standard operational logs from our hosting provider — the time, method and path of each request, its response status, the account it came from, and the browser and operating system used. These are kept for 24 hours. We do not run advertising or third-party tracking cookies.

Share-link counts. When a share link is opened, or an item is assigned on one, by someone other than the link's owner, we record that it happened so we can tell how well sharing works. These rows contain a one-way hash of the link, which kind of thing was shared, and a timestamp — and nothing else. No name, no email, no account ID, no IP address, no device or browser information, and no identifier that follows you between visits or between links. We set no cookie for this and load no third-party script; the counts never leave our own database. Because a row describes no person, there is nothing in it to erase — so these counts are kept indefinitely and are not removed when an account is deleted (see §9).

We don't intentionally collect payment card numbers or bank credentials. Papernils doesn't process or hold money (see §4).

2. How we use your information

To provide the service (read your receipts, categorize spending, calculate who owes whom, generate the payment links you ask for), operate your account and shared trips, secure and debug the service, and email you about it. We do not sell your personal information, and we do not use it for advertising.

3. Information about other people

When you split a bill, you may enter the names of people who don't have an account, and what they owe. We store this to provide the splitting feature. You're responsible for having an appropriate basis to share other people's information with us.

4. Payments — we don't move money

Papernils is a record-keeping and calculation tool. It is not a bank, payment processor, or money-services business. The “settle up” buttons open your own payment apps (or copy a handle) with an amount pre-filled; money moves within those apps, never through Papernils. We never see or hold your funds.

5. Service providers

To run Papernils we share data with a small set of providers:

• Supabase — database, authentication, file storage, and hosting [region].
• Anthropic (Claude) — your receipt photos are sent to Claude's API to read the line items.
• OpenAI — your voice recordings are sent for speech-to-text transcription. We don't store your audio — only the resulting text.

We don't permit these providers to use your data for their own purposes beyond providing their service to us. [When paid plans launch, a payment processor will be added and described here — not yet in place.]

6. Where your data is processed

Your data may be processed in [the United States and/or other countries]. For EU/EEA users this is a cross-border transfer [transfer mechanism to confirm].

7. How we protect your data

• Receipt photos are stored in a private bucket and served only via short-lived signed URLs — not publicly accessible.
• Database access is constrained so people only see the trips, receipts, and balances they're party to.
• Sign-in is passwordless, so there's no password to store or have breached.

No system is perfectly secure, and we can't guarantee absolute security.

8. Retention

We keep your information while your account is active. When you delete your account (see §9), your personal data is erased as described there [any minimum retention to confirm].

9. Deleting your account

You can delete your account and data at any time from your Account page. Because bills are shared between people, deletion follows an anonymize-and-keep approach:

• Erased: your profile (name, payment handles, preferences), your email and sign-in identity, every receipt photo you uploaded, the raw text/voice transcripts of your receipts, and any receipts or trips only you were part of.
• Kept but anonymized: where you split bills with other account holders, the shared records (e.g. a settlement someone else relies on) are retained so their balances stay accurate, but your name is replaced with “Deleted user” and your photos and transcripts are removed. Your account is deactivated so it can never be signed into again.
• Unaffected: the share-link counts described in §1. They hold a one-way hash, a timestamp and nothing else, so there is no information about you in them to remove.

Depending on where you live, you may also have rights to access, correct, export, or restrict processing of your data [how to exercise — contact channel — to confirm].

10. Children

Papernils isn't directed to children under [13 / 16], and we don't knowingly collect their information.

11. Changes to this policy

We may update this policy; we'll change the “Last updated” date and, for material changes, [notify you how].

12. Contact

[Papernils — contact / privacy@papernils.com / address]