Privacy Policy
Last updated 6 October 2026
Who we are
paperwork, Dubai, United Arab Emirates, is the controller for data you give us directly: your account, website visits, forms, support chat and emails. Contact: info@paperwork.to.
When our customers process documents of their own clients through paperwork, for example a lender checking an applicant's bank statements, the customer is the controller and we process those documents on the customer's behalf and instructions.
We follow the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and apply the same standards to users in other countries.
Data we collect
Account data
- Name, work email, company and role
- API keys, which we store only as hashes
- Usage records, credits and dashboard activity
Documents and results
- The files you or your clients upload: PDFs, scans and photos
- Data extracted from them, such as names, ID numbers, amounts, dates and transactions
- Check results, such as fraud verdicts, cash flow metrics and company checks
- Processing metadata: time, file type, size and job ID
Forms, chat and email
- What you send through the demo and contact forms, the support chat or email
Technical data
- IP address, browser, device and language
- Pages visited and how you use the site, through analytics described in the cookie policy
- Error and performance logs
Consent records
When you make a choice in the cookie banner or tick a consent box on a form, we record the choice, the policy version, your IP address, browser and the page you were on.
Billing is by invoice under your contract. We do not take card payments on the platform.
How we use data
- Process the documents you submit and return results through the API, dashboard and Paper OS
- Set up accounts, give support and fix errors
- Send service emails, invoices and security notices
- Prevent abuse and keep the platform secure
- Meet legal duties, such as tax records and lawful requests from authorities
We process data to perform our contract with you, on your consent (analytics and marketing emails), on our legitimate interest (security, abuse prevention and product improvement), and to meet legal duties.
AI processing
Most features send document pages or text to third-party AI model and OCR providers, which return the extracted data or analysis. Paper OS asks model providers not to retain or log requests. For other features, the provider's own data terms apply.
On-premise installations run inside your own infrastructure; documents do not reach us or our providers.
Automated decisions
Fraud Detection returns an automated verdict for each document (clean, suspicious or fraudulent) with the findings behind it. Paper OS agents draft recommendations. In both cases our customer decides what to do with the result; we do not make lending or onboarding decisions.
If a result affected an application you made with one of our customers, ask that customer for a human review first. We will help with our records if needed: info@paperwork.to.
Who can access data
Users in your organisation see your organisation's documents and results. Authorised paperwork staff can access customer documents and results to set up accounts, give support and fix errors.
We use these categories of service providers:
| Category | Purpose |
|---|---|
| Cloud hosting and database | Website, dashboard, API, processing workers, database, sign-in and file storage |
| AI model and OCR providers | Text recognition and language-model analysis of document pages and text |
| Public data and blockchain data providers | Company sentiment, registry and wallet checks. Requests contain the company name, domain or wallet address you check |
| Email delivery | Emails Paper OS sends to your clients, team invitations, and inbound email for Document Automation |
| Error monitoring | Error reports, which can include IP address and request details |
| Messaging service | Website support chat and internal alerts read by our team |
| Website analytics | Visitor measurement, described in the cookie policy |
The named list of providers is available to customers on request at info@paperwork.to. We do not sell personal data and do not share it with advertisers. We disclose data to authorities only when the law requires it.
Where data is processed
Our cloud service and providers can process data outside the UAE. We transfer data on the grounds the PDPL allows, such as contract necessity or your consent.
If your regulator or policy requires data to stay in one country, we can install the platform on your own servers under a license.
Your rights
You can ask us to:
- give you a copy of your personal data
- correct data that is wrong or incomplete
- delete your data
- restrict or stop some processing
- send your data in a machine-readable format
- withdraw consent you gave
Write to info@paperwork.to. We reply within 30 days of a verified request. You can also complain to the UAE Data Office or your local data protection authority.
Security
- HTTPS on every connection, with HSTS
- Encryption at rest by our hosting and database providers
- API keys stored only as hashes
- Role-based access; documents are scoped to your organisation
- Signed links for client uploads
- Error monitoring and alerts
If a breach affects personal data, we notify the UAE Data Office and the affected customers without undue delay.
Privacy Mask extension
This section applies to the Privacy Mask by PaperWork extension for Google Chrome. Masking runs locally in your browser. Prompt text, documents, detected values, placeholder maps and settings are never sent to paperwork, and the extension has no analytics or telemetry. The Free plan's weekly counter stays in local extension storage, together with the install date and a local activity log (time, site, screen, placeholder names, counts per type and file names, never the hidden values; last 5,000 entries). None of this leaves your device.
Optional account (Pro plan)
The Free plan needs no account. If you choose Pro, you sign in with Google, and we receive and store:
- Your Google account email and the basic profile data Google returns, such as name and picture
- An account ID, sign-in times and security logs, which can include IP address and browser
- Your plan status and the end date of the current billing period
- The customer and subscription IDs our payment provider assigns to you
No prompt text, documents or masked values are linked to the account. We use this data only to sign you in and to tell the extension whether your Pro plan is active. While you are signed in, the extension checks your plan once an hour, so our account service sees your IP address and the time of the check. To start a subscription, we create a customer at our payment provider with your email and account ID. Payment happens on the provider's own pages; we never see or store card or bank details. The provider tells us when a subscription starts, renews, changes or ends, and sends you back to paperwork.to afterwards.
Service providers
- Google, for sign-in
- Our cloud database and authentication provider, for the account record
- Our payment provider, for subscriptions
- A public model hosting service, only if you choose to download the optional local model; it receives an ordinary download request and no text
Retention and deletion
Account data is kept while the account exists. To delete it, sign out of the extension and email info@paperwork.to from the same address. We delete your account and subscription record and your customer record at the payment provider. The provider may keep payment and invoice records the law requires it to keep.
Chrome Web Store User Data Policy
The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not sell this data, do not use or transfer it for purposes unrelated to the extension's single purpose, and do not use or transfer it to determine creditworthiness or for lending.
Children
paperwork is a business service for people aged 18 and over. If you believe a child's data has reached us, write to info@paperwork.to and we will delete it.
Changes
We update this policy when the service or the law changes. We email customers about material changes before they take effect. The date at the top shows the current version.
Contact
info@paperwork.to
paperwork, Dubai, United Arab Emirates