Privacy Notice
Who is responsible
PaperMind is operated by Huseyn Huseynov, an individual based in Azerbaijan. Contact: hhuseynov0707@gmail.com.
What we collect
| Data | Why | Kept |
|---|---|---|
| Email address | To identify your account and contact you about it | Until you delete the account |
| Password | To sign you in. Stored only as an argon2id hash — we cannot read it | Until you delete the account |
| Display name (optional) | To address you in the interface | Until you delete the account |
| Saved papers and notes | To provide your library | Until you delete them or the account |
| Questions you ask | To produce answers, and to measure and improve answer quality | While your account exists; deleted on request |
| Usage events (which operation, how many credits) | To enforce plan limits and answer billing questions | While your account exists |
| Session records (IP address, browser user-agent) | Security — so you can see and revoke sessions, and to limit abuse | Until the session expires or you sign out |
| Subscription status | To give you the plan you paid for | Until you delete the account |
We do not collect payment card data. Payments go through Paddle, which acts as Merchant of Record. Card details are entered on Paddle's systems and never reach ours.
We use no advertising trackers and no third-party analytics. The only
cookie we set is the session cookie that keeps you signed in. It is
httpOnly, so scripts on the page cannot read it.
Who else processes your data
- Groq (United States) — the questions you ask, together with the retrieved abstracts, are sent to Groq to generate an answer. Do not put personal or confidential information into questions.
- Paddle (United Kingdom / European Union) — billing, tax and payment processing, as Merchant of Record.
- Hetzner Online GmbH (Germany) — hosting. Your data is stored on servers in Germany.
We do not sell your data, and we do not share it with anyone else.
Training
We do not use your questions, notes or saved papers to train machine learning models.
Legal basis
Where the GDPR applies: we process account and library data to perform our contract with you; usage and session records under our legitimate interest in operating the Service securely and within its limits; and billing data to meet legal obligations.
Your rights
You can ask us for a copy of your data, correct it, or delete it. Write to hhuseynov0707@gmail.com and we will respond within 30 days.
Deleting your account
You can delete your account yourself: open the account panel and choose Delete account. We ask for your password again, because a stolen session should not be enough to erase everything you saved.
Deletion is not immediate. Your account is marked and removed permanently 30 days later, so an accidental click can be undone. During that window the same panel offers Cancel deletion.
If you have an active subscription, cancel it first. We block deletion in that case on purpose — otherwise the account would disappear while billing continued, and you would have no way left to stop it.
What is removed
- Your email address, display name and password hash
- All sign-in sessions
- Your library — saved, starred and read papers, and any notes
- PDFs you uploaded, including the text extracted from them
- Your usage records (which features you used and when)
What we keep, and why
- Payment records. Accounting and tax law require us to keep what was paid and when. We remove the link to you, so the record no longer says who paid — only that a payment happened.
- Encrypted backups. Backups are snapshots; we cannot edit a past snapshot without destroying its integrity. Your data therefore remains inside encrypted backups until they expire — at most 30 days after deletion. Backups are encrypted with a key that is not stored on our server, and they are never used to restore a deleted account.
- Questions asked to the AI. These are stored without any link to your account, so we cannot find yours to remove them. They are not connected to your email or identity.
- Records held by our payment provider. Paddle keeps its own copy of the transaction under its own retention rules. Contact Paddle directly if you want those removed.
If you are in the EU or UK and are unhappy with how we handled your data, you may complain to your national data protection authority.
Security
Traffic is encrypted with HTTPS. Passwords are hashed with argon2id. Session tokens are stored only as SHA-256 hashes, so a copy of our database would not let anyone sign in as you. The database and cache are not exposed to the internet.
No system is perfectly secure. If we discover a breach affecting your data, we will tell affected users without undue delay.
Changes
If we change this notice in a way that materially affects you, we will email account holders before it takes effect.