Privacy Policy

1. Data Controller

The data controller responsible for data processing on this website is:

2. Collection and Storage of Personal Data

2.1 When Visiting the Website

When you access our website, information is automatically transmitted to the server by your browser. This information is temporarily stored in a log file:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the retrieved file
• Website from which access was made (referrer URL)
• Browser used and, if applicable, the operating system

2.2 When Using Our Services

When registering for our services, we collect:

• Email address
• Name / Company name
• Payment information (for paid services)
• Usage data of PaperOffice services

2.3 Problem Solver (problem description on paperoffice.ai and in the app)

When you describe a request in the Problem Solver, we process the text you enter, the selected language and the result of the matching (suggested functions, open points). We store this information together with date and time for twelve months in order to improve the Problem Solver and our function catalogue; the IP address is stored only as a day-based hash value. Signed-in users are linked to their account. Our team is informed of every request by email so that it can get in touch if needed. The legal basis is our legitimate interest in improving our offering (Art. 6(1)(f) GDPR). Please do not enter special categories of personal data in the Problem Solver.

3. Purposes of Data Processing

We process your personal data for the following purposes:

• Provision of the website and our services
• Contract processing and customer support
• Improvement of our products and services
• Marketing and advertising (only with your consent)
• Fulfillment of legal obligations

4. Legal Bases

Processing is based on:

• Art. 6 (1) (a) GDPR – Consent
• Art. 6 (1) (b) GDPR – Contract performance
• Art. 6 (1) (c) GDPR – Legal obligation
• Art. 6 (1) (f) GDPR – Legitimate interest

5. Data Storage

5.1 Storage Location

Your data is stored exclusively in European data centers. We do not use cloud services outside the EU for storing personal data.

5.2 Storage Duration

We store your data only as long as necessary for the purposes for which it was collected or as long as statutory retention periods apply.

6. Your Rights

You have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR) – You can request information about your stored data
• Right to Rectification (Art. 16 GDPR) – You can request the correction of inaccurate data
• Right to Erasure (Art. 17 GDPR) – You can request the deletion of your data
• Right to Restriction (Art. 18 GDPR) – You can request the restriction of processing
• Right to Data Portability (Art. 20 GDPR) – You can receive your data in a common format
• Right to Object (Art. 21 GDPR) – You can object to processing
• Withdrawal of Consent (Art. 7 (3) GDPR) – You can withdraw your consent at any time

7. Cookies

Reach measurement and session recording start only after explicit consent in the privacy panel. Without consent they stay off. Technically necessary technologies (language, currency, session, security and the po_privacy choice) are required for operation. There are no advertising IDs.

7.1 Technically Necessary Cookies

These cookies are required for the website to operate (for example language and currency) and cannot reasonably be disabled.

7.2 Reach measurement and session replay

After consent, each selectable on its own: Google Analytics 4 (measurement ID G-HQHHXQ44LG, only paperoffice.ai and www.paperoffice.ai), first-party statistics via /po-stats/ (Plausible), and session recording with OpenReplay on our servers. No Google Tag Manager and no advertising IDs. The choice is stored in po_privacy for about six months.

8. Data Security

We implement technical and organizational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons:

• SSL/TLS encryption for all data transfers
• Encrypted data storage
• Regular security audits
• Access control and authentication

9. Data Sharing

Your personal data will not be transmitted to third parties except for the following purposes:

• Payment service providers (for processing payments)
• IT service providers (for technical support)
• Authorities (when legally required)

10. Connecting AI Assistants (Claude, ChatGPT, Grok, Cursor, Muse) via MCP

PaperOffice operates a Model Context Protocol (MCP) server at mcp.paperoffice.ai that lets you connect third-party AI assistants to your PaperOffice account. The connection is authorised solely by you (OAuth 2.1 with PKCE); your password is never disclosed to the assistant.

On each use, the assistant sends PaperOffice the name of the tool being called and the parameters required for it (for example a search term or a document ID). PaperOffice executes the call with the permissions of your user account within its own infrastructure in EU data centres and returns the result to the assistant. PaperOffice does not receive your chat history or your prompts and does not store conversation data.

Returned results (such as document text) become part of your conversation with the assistant and are subject to the privacy terms of the respective provider (Anthropic, OpenAI, xAI, Cursor, Meta). Please check whether sharing the documents concerned with that provider is permitted within your organisation.

PaperOffice records every tool call in your account's audit trail: time, user, tool, outcome, duration, credits used, connection (session ID and a shortened hash of the access token), the document IDs concerned and the call parameters; text values of up to 100 characters (such as search terms) are stored verbatim, longer values only as their length. The entries are kept for as long as your account exists. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in security and traceability (Art. 6(1)(f) GDPR). Access tokens issued via OAuth are valid for at most 365 days. You can revoke the connection at any time in the PaperOffice app under Account → API → MCP connections or within the assistant; issued access tokens become invalid immediately. An API key that you use instead of OAuth is deleted in the app under Account → API; until then it remains valid.

When you open the connection window of an AI assistant for which direct connection is enabled (initially Claude), mcp.paperoffice.ai sets a strictly necessary cookie (__Host-po_oauth_hb, valid for at most 60 minutes). It contains only a random identifier and links the open connection request to the browser in which you then create or are signed in to your PaperOffice account. This lets the connection be completed after you confirm it in the app, without having to copy an access token. For this purpose PaperOffice stores only a hash of this identifier together with the connection request and holds the confirmed access token until completion, for at most 10 minutes. All of this is deleted at the latest 40 minutes after the connection window was last opened. The legal basis is that the cookie is strictly necessary for the connection you requested (Section 25(2) no. 2 TDDDG) in conjunction with the performance of the contract (Art. 6(1)(b) GDPR).

11. Right to Complain

You have the right to complain to a data protection supervisory authority about the processing of your personal data.

12. Contact for Data Protection Inquiries