Privacy Policy

1. Introduction

MagicPaper ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our document management service ("the Service").

Please read this Privacy Policy carefully. By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, name, password (hashed), and profile picture when you create an account
• Documents: Files you upload to the Service, including PDFs, images, and other document formats
• Contacts: Contact details you create or import (sensitive fields such as email, phone, address, and banking information are encrypted)
• Payment Information: Billing details when you subscribe to a paid plan (processed by our payment provider; we do not store full card numbers)
• Communications: Information you provide when contacting our support team

2.2 Information Collected Automatically

• Usage Data: How you interact with the Service, features used, and actions taken
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, pages viewed, and referring URLs
• Cookies: Small data files stored on your device for authentication and preferences

2.3 Information from Third Parties

If you choose to sign in using OAuth providers (currently Google and Microsoft), we receive basic profile information as permitted by your privacy settings on those platforms.

3. How We Use Your Information

We use the collected information to:

• Provide, maintain, and improve the Service
• Process and store your documents securely
• Perform OCR text extraction and AI-powered document classification
• Process payments and manage subscriptions
• Send service-related notifications and updates
• Respond to your inquiries and provide customer support
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

4. Document Processing and AI

When you upload documents, we process them using third-party AI services to provide OCR and document enrichment features:

• OCR Technology: To extract text from images and scanned documents
• AI Classification: To automatically categorize and tag your documents
• Metadata Extraction: To identify dates, amounts, and other relevant information

Third-Party Services: Your documents may be processed by external services including:

• Microsoft Azure: For OCR and document intelligence services (primary OCR path)
• Mistral AI: For OCR fallback and document analysis when Azure is unavailable or rate-limited

These services are used solely to provide the Service features. We ensure that all processing respects the confidentiality and security of your data. We do not use your document content to train our own AI models or for any purpose other than providing the Service to you.

Your Consent: By using the Service, you consent to the processing of your documents through these third-party services as described in this Privacy Policy.

5. Data Storage and Security

We implement robust security measures to protect your data:

• Encryption: Documents are encrypted using AES-256-GCM before storage. Sensitive contact fields are also encrypted at rest
• Secure Storage: Data is stored on secure servers with industry-standard protection
• Access Controls: Strict access controls ensure only authorized users can access documents
• HTTPS: All data transmission is encrypted using TLS/SSL

5.1 Data Storage Location

Primary hosting (Switzerland): Your user data, documents, and account information are primarily stored and processed in the Switzerland region using the following services:

• Supabase: Database and document storage hosted in Switzerland
• Object storage (when used): Optional OCR artifact storage configured in Switzerland (e.g. region ch-dk-2)
• Microsoft Azure: When Azure services are used for OCR and document processing, data is processed in Azure data centers located in Switzerland

Exception — Mistral AI: When documents are processed using Mistral AI services, the data may be transferred to and processed in regions outside of Switzerland (typically in the European Union). We recommend reviewing Mistral's privacy policy for more information about their data processing practices.

Other operational providers: Payment processing (Polar), email delivery, authentication providers (Google, Microsoft), and application hosting may involve limited processing outside Switzerland as needed to operate the Service.

This storage and processing arrangement is designed to support compliance with Swiss data protection law (nLPD) and, where applicable, the General Data Protection Regulation (GDPR). Our public claim "Hosted in Switzerland · GDPR compliant" refers to primary data hosting in Switzerland and our overall compliance posture — not a guarantee that every transient processing step occurs exclusively in Switzerland.

6. Data Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

• Service Providers: With trusted third-party services that help us operate the Service (hosting, OCR/AI processing, payment processing, email delivery)
• Legal Requirements: When required by law or to respond to legal process
• Protection: To protect the rights, property, or safety of MagicPaper, our users, or the public
• Business Transfers: In connection with a merger, acquisition, or sale of assets

7. Your Rights (GDPR and Swiss Data Protection Law)

Under the General Data Protection Regulation (GDPR) and Swiss data protection laws (nLPD), you have the following rights:

• Right of Access: Request a copy of your personal data and information about how it is processed
• Right of Rectification: Request correction of inaccurate or incomplete data
• Right of Erasure: Request deletion of your data ("right to be forgotten"), subject to legal obligations that may require us to retain certain information
• Right to Data Portability: Request transfer of your data in a machine-readable format
• Right to Restriction of Processing: Request limitation of data processing in certain circumstances
• Right to Object: Object to processing of your data, particularly for direct marketing purposes
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing based on consent before its withdrawal

How to Exercise Your Rights: You can exercise these rights at any time by:

• Using the account settings in the Service to access, modify, or delete your data
• Contacting us directly at privacy@magicpaper.app

We will respond to your request within 30 days, in accordance with applicable data protection laws. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction (in Switzerland, the FDPIC / PFPDT).

8. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. If you delete your account:

• Your documents will be permanently deleted within 30 days
• Account information will be deleted or anonymized
• Some data may be retained for legal or legitimate business purposes (e.g. billing records)

9. Cookies and Tracking

We use cookies and similar technologies for:

• Essential Cookies: Required for authentication and security
• Preference Cookies: Remember your settings and preferences (including language)
• Analytics Cookies: Help us understand how users interact with the Service, when enabled

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Service.

10. Children's Privacy

The Service is not intended for users under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. International Data Transfers

Primary processing in Switzerland: As described in Section 5.1, your data is primarily stored and processed in Switzerland. However, in certain circumstances, your information may be transferred to and processed in countries other than Switzerland:

• Mistral AI: When using Mistral for document processing, data may be transferred outside Switzerland (typically within the EU). We use contractual and organizational safeguards appropriate to the transfer.
• Other service providers: We may use providers located outside Switzerland for specific functions (payment processing, email delivery, OAuth login, application hosting). In such cases, we ensure appropriate safeguards are in place, including Standard Contractual Clauses where required under Swiss and EU data protection law.

All international data transfers are conducted in compliance with Swiss data protection laws and, where applicable, the GDPR. We maintain contractual obligations with third-party service providers to protect your data according to standards consistent with this policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: