Privacy policy
Last updated 7 November 2026
Who is responsible
paperpipe is run by Yannick Meeus (Amaryx), Alihaka 2 D, 02620 Espoo, Finland. We are the controller of the personal data described here. Questions or requests: hello@amaryx.com.
What we collect and why
- Your account: email address, a hashed password, whether you confirmed your email, and when the account was created. We need these to give you the service (GDPR art. 6(1)(b)).
- Your files: files you upload are processed and deleted right away. We do not store them. Results made through the MCP server are kept for 1 hour so your agent can download them, then deleted.
- API keys: a name you choose, a short prefix and a hash of each key. We never keep the key itself, and it is shown to you once.
- Usage log: for each operation, its type, the size and the time, so we can count your monthly quota and bill correctly. It contains no file names and no file content (art. 6(1)(b)).
- Where it runs: on servers in Germany (Hetzner), operated by Amaryx, a one-person studio in Espoo, Finland.
- Billing: paid plans are sold by Stripe through Link, which is the merchant of record. We receive a customer ID, your plan, its status and the renewal date. We never see your card details. Stripe handles payment data as its own controller under the Stripe privacy policy.
- Server logs: IP address, time, requested address and browser type, kept for 5 days to keep the service secure and stop abuse (art. 6(1)(f), our legitimate interest).
- Email: we only send email the service needs, such as confirmations, password resets and the notifications you set up. No newsletters, no tracking pixels.
Who else handles your data
| Who | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Servers and backups | EU (Finland, Germany) |
| Resend (Plus Five Five, Inc., USA), sending through Amazon Web Services in the EU (Ireland) | Delivering email | EU |
| Stripe and Link | Selling paid plans, tax, receipts (as their own controller) | EU and US, under Stripe's safeguards |
The site loads no third-party scripts, fonts or trackers. We do not sell or share your data with anyone else.
We count visits with Umami, running on our own server in the EU. It sets no cookies and records the page, the referring site, your browser, operating system, device type, screen size and country, never who you are. Your IP address is used to look up the country and is never stored; to count you once per visit it stores a one-way hash of your IP address, browser and a salt that changes every month, which cannot be turned back into either. Legal basis: our legitimate interest in knowing which pages are read (GDPR art. 6(1)(f)).
How long we keep it
We keep your data until you delete your account. Deleting it (Account → Delete account) removes your data right away; backups that still contain it are overwritten within 30 days. Server logs are deleted after 5 days.
Your rights
- See and take your data: Account → Download my data gives you everything in a JSON file.
- Correct it: change your email in Account, or ask us.
- Delete it: Account → Delete account. This also ends any paid plan.
- Object or restrict: email hello@amaryx.com.
- Complain: to the Finnish Data Protection Ombudsman (tietosuoja.fi) or the data protection authority where you live.
Cookies
We use no cookies and no analytics. When you log in, your browser keeps a login token in its local storage; logging out removes it.
Changes
If we change this policy in a way that matters, we email account holders before it takes effect.