Privacy Policy

1. Introduction

PaperScale LLC (“PaperScale”, “we”, “us”, or “our”) is dedicated to protecting your privacy and treating your business correspondence with the highest degree of confidentiality.

This Privacy Policy explains what information we collect when you use our custom domain email service, why we collect it, how it is secured, and your rights regarding your personal information.

2. Information We Collect

We only collect data necessary to provide you with reliable, calm email service:

1. Account Information: When creating an account, we collect your email address, authentication credentials (or Google OAuth profile identifier), and chosen domain name.
2. Billing Information: Payment transactions are handled directly by our PCI-compliant merchant of record partner. We do not store or process credit card numbers on our servers.
3. Email Content and Metadata:
   • MIME Message Bodies and Attachments: Stored with AES-256 encryption in private Amazon S3 buckets located in Frankfurt (eu-central-1).
   • Message Metadata: Timestamps, sender/recipient headers, subject lines, and thread indices stored in our managed PostgreSQL database to render your inbox thread list.
4. Technical & Telemetry Logs: Server access logs, IP addresses for sign-in fraud protection, and error telemetry to maintain uptime and prevent unauthorized account access.

3. What We Never Do With Your Data

We hold a fundamental belief in communications privacy:

• We NEVER scan your emails for advertising: We have no advertising business model.
• We NEVER train artificial intelligence models on your email: Your correspondence is never fed into generative AI or machine learning algorithms.
• We NEVER sell your data: We do not broker, rent, or trade your contact information or recipient graphs to third-party data aggregators.

4. Data Residency and Subprocessors

All PaperScale primary infrastructure is located in Frankfurt, Germany (EU), ensuring strict adherence to European privacy standards:

• Amazon Web Services (AWS eu-central-1): Inbound/outbound email transport (SES) and encrypted attachment storage (S3).
• Neon (Lakebase Postgres): Fully managed serverless PostgreSQL database hosted in the AWS Frankfurt region.
• Cloudflare: DNS routing, DDoS protection, and SSL termination.

All subprocessors are bound by rigorous Data Processing Agreements (DPAs) with standard contractual clauses.

5. Data Retention and Deletion

• Active Accounts: Your messages and metadata are preserved as long as your subscription remains in good standing.
• Trash and Deletion: When you empty Trash, messages are flagged for permanent deletion from S3 and database indexes within 30 days.
• Account Termination: If you delete your account, all associated mailboxes, messages, and domain mappings are permanently wiped within 14 days following account closure.

6. Your Rights Under GDPR and CCPA

Depending on your jurisdiction, you possess the following rights:

• Right to Access & Portability: Download your full email archive in standard .mbox format at any time from your account settings.
• Right to Rectification: Update your personal account details directly in settings.
• Right to Erasure (“Right to be Forgotten”): Request immediate permanent erasure of your account and all stored correspondence.

To exercise any privacy rights, email our Data Protection Officer at:

[email protected]