Privacy Notice

Paperatus is operated by Utilitas AB, registration number 556912-9116, Martebogatan 22, 168 61 Bromma, Sweden. We are responsible for the personal information we use to operate Paperatus. Contact us at support@paperatus.com about this notice or your information.

We use your account email, sign-in identifiers and account settings to provide access. Our authentication provider handles sign-in credentials. If you sign in with Google, we receive the account information needed for that sign-in.

We store the work you put into Paperatus: research topics and notes, literature records and extracted text, drafts, manuscripts, datasets, analysis results, figures, comments, revision history, journal requirements and submission records. This may contain personal information about you, coauthors or other people. Literature searches also return author and publication details from scholarly indexes.

We keep collaboration details such as workspace membership, invitations and recent presence. For paid plans we keep subscription identifiers, status, billing periods and usage/credit records. Paddle collects payment details in its checkout; Paperatus does not store full card numbers or card security codes.

When you connect an optional service, we keep the connection information needed to use it. This may include encrypted API or connection credentials, account labels and job status. We also process browser/request information and error logs to operate, troubleshoot and secure the service. Support messages contain the information you choose to send us.

We use account, project, collaboration and subscription information to provide the service you request and administer our contract with you. We use operational records to protect accounts, investigate faults and prevent abuse, based on our legitimate interests in running a reliable, secure service. Where a legal obligation requires records, such as financial records, we retain and use them for that obligation. If we ask for consent for a separate purpose, we explain that purpose and how to withdraw consent at that point.

Account information is needed to provide an account. Optional uploads and connections are your choice; without them the corresponding feature cannot run. We do not use research scores or AI suggestions to make legal or similarly significant decisions about you.

The data sent depends on the feature you use:

• Lovable and Supabase provide application hosting, authentication, storage and related infrastructure.
• AI services receive the prompts and relevant context needed for your requested task. Context can include your topic, source excerpts, manuscript, datasets, recent chat and requested changes. The default route uses Lovable's AI gateway; optional provider connections use the provider and model you select. Provider processing depends on that service's terms and your account settings. Do not upload information you lack authority to share with the services involved.
• Scholarly indexes, including OpenAlex, Semantic Scholar, Crossref and field-specific indexes, receive search terms or document identifiers to find and check literature.
• Paddle handles checkout and subscription payments. We exchange the account email, purchase/subscription identifiers and status needed to activate and manage access. Paddle explains its own processing in its Privacy Notice.
• Google and the Lovable connection gateway support Google sign-in and the optional Gmail feature described below.
• Optional connected runtime or journal-portal services, where enabled and selected, receive the task content and connection information necessary to perform that task. The connection screen identifies the service before connection.
• Public pages may load fonts from Google Fonts, which receives the normal request information needed to deliver them.

People you invite can see the content their project or workspace permissions allow. External assistants you authorize can access the data permitted by that connection. We may disclose necessary information to meet legal obligations, protect the service or resolve legal claims.

Connecting Gmail is optional. We use your Google email/profile information to identify the connected account, and Gmail send permission to deliver the message and attachments you review and approve. This connection does not give Paperatus permission to read your inbox. We keep connection credentials protected so you do not need to reconnect for every send.

You can disconnect in Paperatus and revoke access in your Google Account connections. Revoking access prevents future authorized use; it does not recall messages already delivered or delete a recipient's copies.

Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy and the Google Workspace user-data requirements, including their Limited Use restrictions. We do not sell information obtained through this connection, use it for advertising, or use it to train general-purpose AI models. This restriction concerns information obtained through Google; manuscripts you choose to process with AI are handled as described above.

Publishing a paper makes its published manuscript, displayed figures and bibliography publicly accessible. Figure data needed to render a chart may be included. A published page is public, even if you share its link with only a few people. Check it before publishing. Unpublishing removes public access through Paperatus but cannot remove copies already obtained by others.

Our providers operate internationally, including in the European Economic Area, the United States and Singapore. Hosting location does not determine where every AI request, support operation or connected service is processed, so your information may be processed outside your country and outside the EEA.

The providers' published transfer safeguards include the European Commission's Standard Contractual Clauses: see Lovable's transfer information and Supabase's transfer information. Connected providers describe their own processing arrangements in their notices. Contact support@paperatus.com for information about the arrangements applicable to your data and how to obtain the relevant safeguards.

Your saved work remains available while you keep it in your account. Revisions and checkpoints preserve earlier versions, so changing the current text does not erase its history. Deleting a project removes its associated records from the active application; downloaded files, previously sent messages and copies held by other people are separate.

You can ask us to delete your account and associated information at support@paperatus.com. We may need to verify the request and retain records required by law or needed to resolve an existing dispute. We will explain any applicable exception. Disconnecting a provider does not itself delete your project history or information already held by that provider.

We keep operational and security records for the time needed to diagnose faults, investigate abuse or an incident, and establish whether it has been resolved. Records needed for an existing legal claim or a statutory obligation are kept for that purpose. Financial records follow the applicable accounting and tax requirements.

Deletion from the active service does not immediately remove every backup copy. Hosting providers retain recovery copies according to their backup cycles and service settings; those copies expire or are replaced through that process. The applicable recovery cycle can differ from the retention of your active project. You can contact us for the retention details relevant to a particular record or deletion request.

Depending on applicable law, you can request access, correction, deletion, restriction or a portable copy of your personal information, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without changing the lawfulness of earlier processing. Contact support@paperatus.com. You can also complain to the Swedish Authority for Privacy Protection, IMY, or your local data protection authority.

Paperatus uses browser storage to keep you signed in and remember application state. Clearing it may sign you out. Third-party sign-in and checkout services explain their own storage practices in their notices.

We may update this notice when the service or its processing changes. The effective date above identifies the current version; material changes will be brought to your attention in the service or by email where appropriate.