Privacy Policy

1. Who we are and how to contact us

The controller of your personal data is Baesso Works Servicos Administrativos LTDA., registered with the Brazilian company registry (CNPJ) under No. 50.377.331/0001-13, with its registered office at Praca Cruz da Esperanca, 106. Vila Baruel, São Paulo - SP. 02522040 - Brazil. (“paperrise” or “we”). For an organization’s content and the data about its use, paperrise acts on the organization’s behalf, as explained in section 18.

For any privacy matter — questions, requests about your data or complaints — write to contact@paperrise.com. This address also serves anyone who cannot sign in to their account.

As a small-scale processing agent under Brazilian law, paperrise is not required to appoint a data protection officer (encarregado) (ANPD Resolution CD/ANPD No. 2/2022, art. 11). The email address above is our channel for communicating with data subjects and with the Brazilian National Data Protection Authority (ANPD).

2. Who this policy applies to

This policy applies to visitors of the public website paperrise.com, to people who create an account and use the system at paperrise.com/app, to people who write to us, by email or through the website’s contact form, and to people invited to an organization.

It does not apply to third-party websites and services you reach from paperrise, such as Stripe’s payment page and the Google and Microsoft sign-in screens. Those services follow their own privacy policies.

paperrise is intended exclusively for people aged 18 or over (section 16).

3. What data we process

We process only the data needed for the service to work. It reaches us in three ways: data you provide, data generated by your use of the service, and data we receive from third parties when you choose to use them.

Data you provide:

• Sign-up: email, name and password. For the password, we store only a hash (bcrypt), never the password itself. If you prefer, you can sign in with your Google or Microsoft account instead of creating a password, or use both. Your name, email and password can be changed later, on the Account page (section 12).
• Profile, filled in right after sign-up and editable on the Account page: date of birth, gender (with a “Prefer not to say” option), occupation and purpose of use.
• Content: everything you record in the system — the projects and the journey of each one (steps, materials and the history of their versions, core fields, decision diary, assumptions, evidence, experiments, checkpoint decisions, the funnels — interviews, commitments, sales, investors and buyers — and the company checklist), the project’s contacts (the people and organizations you record in its funnels: name, organization, how to reach them and notes) and the local rules you write. Attachments and proofs are links to other websites or notes: we don’t store files you upload. How this content is kept is described just below.
• Indicators: each project’s monthly figures (revenue, recurring revenue, new, active and lost customers, gross margin, acquisition spending, cash, net burn and sales cycle) and its cohorts (customers and revenue by entry month), typed or pasted, kept with the project’s cash flow and versioned like any material, and the period an investor report covers. The metrics calculated from them (runway, CAC, LTV and others) are not stored: they are calculated whenever they are shown. The records of the team’s rituals (the weekly review, the monthly close, the quarterly review: what was learned and what changed) are entries of the decision diary.
• Organizations, if you create or join one: its name, your role, the projects you can open and with what access, the invitations you send as its owner or an admin (the email address invited, the role and the projects offered) and the organization’s content (section 18).
• Project shares: who you share a project with and who shared one with you — the email address invited and, once accepted, the account —, with which permission (View, Edit, or Edit and decide checkpoints), what the person reaches (the whole project or some of its parts: phases, the fundraising track, the checklist), until when (the last day of access, if any), who gave the access and when; the invitations to projects (the email address invited, the permission, the parts, the validity, how many times it was sent and its status); and how many invitations to projects you sent in the last 24 hours, to limit abuse (section 8).
• Data room and folder readers: what the project files in each of the 18 folders — materials, checklist proofs that are links and business CVs as their investor cut was approved —, kept by reference: no file is uploaded or stored, and each document is generated from the project when it is opened; who reads which folders and until when (the last day), who gave the access and when; the invitations to folders (the email address invited, the folders, the last day, who invited, how many times it was sent and its status); and each reader’s access log: every time they open the data room, read a document or export it (PDF or Markdown), with their account, their email address partly masked, the document (by type, code and identifier, never its text), the folder, the format, and the date and time (section 8).
• Business CV: the items of your record as an entrepreneur that you enter (what it was, the result, the proof — a link or a note, never an uploaded file —, the period and each section’s own fields), your three biggest achievements, the projects you show it in, with the sections chosen, and the cuts (for the team, for investors and for grant calls) you put together and approve, with a copy of each cut as you approved it. The CV belongs to your account and only you edit it; in a project, it appears only by your choice (section 8).
• Published local rules: when you publish a local rule of yours to the founders of its country, a copy of what the preview showed — the checklist item, the country, the text, the source, the date it was consulted and your account’s name, as you agreed to show it (never who validated it) —, with when you agreed, published and withdrew it; the reports others make about it, as counts; and the reports you make about other founders’ published rules: the reason, the note, which copy you saw, when, the project you saw it in and how our team resolved it.
• Reminder preferences: whether the daily summary of reminders comes by email, which types of reminder it carries, the time zone it follows (your device’s, saved by the app when none is saved, or the one you choose) and, if you stopped it, when and how (on the Account page, by the link in an email or by your email provider’s unsubscribe button).
• Messages you send us by email or through the website’s contact form. The form asks for your name, email, phone, occupation, company or institution, the topic and the message, and also sends us the language of the page and the time it was sent; it reaches our mailbox as an email.

How the content of projects is kept:

• Versions: each material keeps the history of its versions, with who saved them and when. Consecutive saves by the same person on the same material, less than 10 minutes apart, become a single version; a version that a checkpoint decision points to never changes.
• Records that are never edited: each checkpoint decision (the decision, the justification, who decided and when, the status of each criterion and the versions of the materials, assumptions, evidence and experiments at that moment, kept by reference) and each project’s audit log (decisions, changes to criteria, checklist items and local rules, pauses and reactivations, with who did it, when, and the value before and after). These records are neither changed nor deleted, except with the project or by the erasure from the history described below. The free text written in them — a decision’s justification, the reason why a criterion or a checklist item does not apply or was postponed — stays as written until the project is deleted.
• Decision diary: automatic entries (checkpoint decisions, changes of track, criteria adjustments, changes to checklist items and others) and entries written by the team. Each person edits their own entries, and the earlier text is kept; the project’s owner (in an organization, the owner or an admin) can take an entry out of the diary, which stays stored, with its earlier texts, and in the export.
• Company checklist: the status of each item, with the reason and the new date when it does not apply or was postponed, the expiry dates you record, who is responsible and the proof, which is a link or a note.
• Local rules: what a country’s law says about a checklist item, with the source, the date it was consulted and who validated it. A rule belongs to the account of whoever wrote it, not to the project: only that person changes it, it is offered again only in that person’s projects with the same item and country, and whoever can read a project where it was used reads it there, with the author’s name. It leaves every project when its author deletes it or deletes their account; each project keeps only the record that it left, without its content.
• Published local rules: a published rule is seen, on the same checklist item, by the founders who list its country in the jurisdictions sheet of one of their projects (each founder declares their own countries) while they work on that item, as a reference to check, with your name as you agreed to show it — renaming your account changes nothing they see until you publish again. They may adopt it, which makes a rule of their own that they must validate again and that stays theirs, or report it. Open reports about the copy shown now, from people of 3 different organizations or personal projects, hide it until our team reviews it; our team sees the reports, with who made them, and hides the rule, with a reason we email you, or restores it. You see only how many reports and adoptions it had, never who.
• Erasing from the history: the project’s owner (in an organization, the owner or an admin) can erase the content of a card, a material, an assumption, a piece of evidence or an experiment from earlier versions too, and a contact, with every funnel item that names it — for example, to answer a data subject’s request or to remove data pasted by mistake. The content leaves every version, the copies made when a phase is redone, what the checkpoint records show and the exports; only the record that it was erased remains, by whom, when and, if given, why. Erasure does not reach the free text of the records that are never edited (above), which goes with the project.
• Other people’s data: projects may contain data about people you record, such as interviewees, contacts and customers. You — or the organization, in one of its projects — are responsible for this data and decide about it, as its controller; paperrise processes it on your behalf, as your processor (operador), only to provide the service (Terms of Use, sections 13 and 24). We keep it, with its history, until the project is deleted or the content is erased from the history. A request from one of these people — for example, an interviewee who asks to be erased — is for you to answer: you can erase their contact from the history, with every item that names them, and download the project’s data; if such a request reaches us, we forward it to you or tell the person whom to contact.
• Shares in the diary and the audit log: giving, changing and removing access to a project, and sending, resending, revoking, accepting or declining an invitation, are recorded with who did it, when, the terms of the access and the person’s email address, partly masked (for example, a***@example.com), with their account identifier: their name appears in these records for as long as their account exists. Changes to your business CV do not go to the projects’ diary or audit log.
• The data room’s access log: it is never changed or deleted, except with the project; if the reader’s account is deleted, only their partly masked email address remains. It exists so that whoever runs the project — its owner or, in an organization, its owner and admins, and whoever has Edit and decide checkpoints on the whole project — knows who saw what and when; the reader is told so in the invitation and in the data room itself. Filing, moving and removing documents, and inviting, changing the folders or the last day of, and removing a reader, are recorded in the project’s audit log (and the readers in the diary), like shares.

Data generated by your use of the service:

• Sessions and devices: date and time of each sign-in, IP address, source port of the connection, browser and operating system (user agent), last use and end of each session, and the browsers marked as trusted.
• Activity: the days on which you used the system and the date of your last use. We do not record clicks or screen time, and we do not analyze your browsing.
• Security events: failed sign-in attempts, failed bot checks and too many attempts, with the email typed, the IP, the port, the page and the date and time; and changes to the account — changing the email, creating or changing the password, connecting or removing Google or Microsoft, including refused attempts to change the email or to connect an account — with the account’s identifier and email, the IP, the port and the date and time; and attempts to accept, while signed in, an invitation to an organization sent to another address, with the account’s email, the invitation’s identifier, the IP, the port and the date and time.; and sales of a paid plan refused because of the country (Terms, section 7), with the subscription's and the customer's Stripe identifiers, the plan, the account or organization and the countries of the billing address and of the card. For an email change, the event keeps the previous address.
• Verification codes and password reset links: we store only a hash of the code or link, with the dates it was issued and used. The codes of an email change are tied to the new address and the previous one.
• Account and subscription status: plan; dates of the trial, of the subscription, of failed payments, of the lock and of the scheduled deletion; the version of the Terms of Use and of this policy you accepted and when; and a record of the notice emails sent.
• Reminders: for each day the daily summary looked at, whether an email went and which reminders it carried — their identifiers and stage (days before the date) and the project’s name as the email gave it —, so that a reminder is never sent twice; and when you published or reported local rules in the last two days, to apply the daily limits.
• Organization activity: a record of what is done in each organization — invitations, members joining, leaving or being removed, changes of role and access, projects created or moved into it, changes of name and of users paid for — with email addresses partly masked (section 18).
• Preferred language, so we can email you in your language.
• Web server technical logs: IP, date and time, address of the page requested (without parameters), response code and user agent.

Data received from third parties:

• Google or Microsoft, if you choose to sign in with them or connect them to your account: the identifier of your account with that provider, its email, confirmation that the email has been verified, and your name (section 4).
• Stripe, if you subscribe to the Pro plan or, as the owner of an organization, to the Team plan: the customer and subscription identifiers and the subscription status; for each paid invoice, its number, amount, currency, description, period billed, billing-address country and payment reference; for a new subscription, the billing-address country and the card's issuing country, to check that it is bought from Brazil (Terms, section 7); and, for each refund or payment dispute (chargeback), its amount, currency, status, reason and date. The card's number, expiry date and security code are entered directly with Stripe and never pass through or are stored on our servers.
• Whoever invites you to an organization: your email address, which they give us to send you the invitation (section 18).
• Whoever shares a project with you: your email address, which that person gives us so that we can send the invitation (section 8).
• Cloudflare Turnstile: only the result of the bot check (passed or failed).

To create an account, your email and name are needed, and your date of birth is used to confirm that you are 18 or over. Sign-up also asks for your gender, occupation and purpose of use, which we use only in aggregate statistics (section 5) and which are not needed to provide the service: that is why these questions offer answers such as “Prefer not to say”, “None of these” and “Other”. To subscribe to Pro or Team, payment details are needed, entered with Stripe. All other data is generated by your use of the service. To send a message through the contact form, all of its fields are needed: they tell us who is writing and about what, and let us reply.

4. Data received from Google and Microsoft

If you choose “Continue with Google” or “Continue with Microsoft”, or connect one of those accounts on the Account page, we ask the provider only for the basic identification permissions (openid, email and profile). We receive your account identifier, your email, an indication that the email has been verified, and your name. The provider may also send your profile picture, which we do not store. We have no access to your password or to your contacts, files, emails or calendar.

We use this data only to create your account, let you sign in, fill in your name at sign-up and show you which provider account is connected. We do not sell it or use it for advertising or to train artificial intelligence models. When the account is created with Google or Microsoft, the email we receive becomes your account’s email and, as such, is shared only with the processors in section 8 that the service needs: the delivery of service emails and, if you subscribe to Pro or, as an organization’s owner, to Team, Stripe. Within an organization you belong to, its owner and admins also see it (section 18). This data is deleted together with your account, except for the records described in section 11.

You can also connect a Google or Microsoft account to a paperrise account that already exists, under Account → “Sign-in methods”, after confirming a code sent to your account’s email. In that case, your account’s email does not change: we keep the provider account’s email separately, with its identifier and the date it was connected, to show it to you on the Account page and in security notices and to include it in the export of your data. It is not shown to the organizations you belong to or sent to Stripe. When you sign in with a Google or Microsoft account whose email, verified by the provider, is your paperrise account’s email, that provider account becomes a way to sign in to your account without a confirmation code — unless your account already has an account from that provider connected or you removed that provider account earlier (see below) — and we tell you by email.

You can remove Google or Microsoft from your sign-in methods, under Account → “Sign-in methods”, also after confirming a code sent to your account’s email and as long as the account keeps another way to sign in: a password or another connected account. Removing it deletes the connection, but, for as long as your account exists, we keep the removed account’s identifier with the provider and the date of the removal, so that signing in with it again does not reconnect it to your account without you noticing: to use it again, connect it again on the Account page. The provider and the date of the removal appear in the export of your data, and this record is deleted with your account.

paperrise’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can also revoke paperrise’s access in the security settings of your Google or Microsoft account. This does not remove the connection in paperrise: if you choose “Continue with Google” or “Continue with Microsoft” again, the provider asks for the permissions again and, if you grant them, you are signed in. To stop signing in with that account, remove it under Account → “Sign-in methods”. If your account does not have a password yet, you can create one there or through the sign-in with email option, after confirming the code we will send you.

5. What we use the data for, and on what legal basis

Every use of data has a legal basis. In the table, “contract” means the processing is necessary to provide the service you signed up for, or to take steps you ask for before signing up (LGPD, art. 7, V; GDPR, art. 6(1)(b)); “legal obligation” means a law requires it (LGPD, art. 7, II); “legitimate interest” means the processing serves an interest of ours or yours, balanced against your rights and expectations (LGPD, arts. 7, IX, and 10; GDPR, art. 6(1)(f)); and “exercise of rights” means the data is used to prove facts or defend ourselves in proceedings (LGPD, art. 7, VI). Where the obligation comes from Brazilian law, the basis for data subjects protected by the GDPR or the UK GDPR is our legitimate interest in complying with it.

Before relying on legitimate interest, we assess whether the processing is necessary and whether it respects your expectations. You can object to these uses (section 12). We do not use your data for purposes incompatible with those described here.

6. What we do not do

• We do not sell or rent personal data.
• We do not use advertising, audience analytics or cross-site tracking cookies or tools. The usage statistics we have come from our own database (for example, how many accounts used the system on a given day).
• We do not send marketing emails: only those needed for the service. If we ever want to send you news, we will ask for your consent first. The daily summary of reminders is a service email: you choose its reminders, or stop it, on the Account page or with the link it carries.
• We do not use your content to train artificial intelligence models (section 7).
• Our team does not access the content of your projects in the ordinary course of business. The internal console shows account data, the organizations each person belongs to and, for each organization, its members, invitations and number of projects — not the content or the names of projects. Content is accessed only when necessary to handle a request from you, investigate a technical or security issue, or comply with a legal obligation. Published local rules are the exception: they are shown to the founders of their country, and our team sees them, and the reports about them, to moderate them.

7. Artificial intelligence

paperrise may offer features based on artificial intelligence. Today, no artificial intelligence provider receives your data or the content of your projects.

Before launching any feature that sends content to an artificial intelligence provider, we will update this policy — stating the provider, the purpose, where the data is processed and how long it is kept — and notify you in advance (section 17).

Your content is not used to train artificial intelligence models, ours or anyone else’s. We will only engage providers that commit, by contract, not to use your content to train their models.

8. Who we share data with

We share data only with the providers needed to run the service, and only what each one needs. Some act as processors, handling data on our behalf and under our instructions; others act as independent controllers, under their own privacy policies.

We may also share data:

• with the other people in an organization you belong to, as described in section 18 — for example, your name on the projects you can open and, for its owner and admins, your email address;
• with the people a project is shared with, by the choice of whoever runs it (section 3). Whoever receives it sees, of the parts shared, their content and the names of who created and edited each thing and, of the project, its name, summary, status and the names of those who have access; the project’s settings (profile, jurisdictions and currency) only if they received the whole project. Whoever runs the project (its owner or, in an organization, its owner and admins, and whoever invited a reader, as regards that reader) sees the name, email address, permission, parts and last day of each person the project is shared with. Someone with the View permission only reads. We send the invitation email on the instruction of whoever invited, with the project’s name and theirs, the terms of the access and, where applicable, the names of the phases and of the organization, in the language of the invitee’s account if they have one. If the project’s owner loses access to paperrise, those it was shared with are told only that it is unavailable, never why;
• with the folder readers of a project’s data room, by the choice of whoever runs it: they see only what is filed in the folders of their invitation, until the last day — the content of those documents, the project’s name and the name of its owner or organization —, and nothing else of the project: not the journey, not the other folders, not the funnels and contacts (which cannot be filed), not who else has access, nor who on the team erased a document. Business CVs are included only as each person approved their investor cut. Whoever runs the project sees each reader’s name and email address, folders, last day and access log; whoever files sees only which folders have readers. We send the invitation email and the removal notice on the instruction of whoever runs the project, with the project’s name and that of whoever invited, the folders and the last day, in the language chosen by whoever invited;
• your business CV, only in the projects whose team you are on (the project’s owner, the organization’s owner and admins, and those with Edit or Edit and decide checkpoints) and only by your choice: the project sees your name and the sections and cuts you made visible and approved, never your email address, and the people with access to the parts where they appear (the team’s CV material, the materials about the team and the fundraising track) read them. Someone who only reads a project does not show their own CV in it;
• the local rules you publish, with the founders who list their country in the jurisdictions sheet of one of their projects, while they work on that checklist item: the copy you published, with your name as you agreed to show it, never your email address nor who validated the rule. The reports about it go to our team, with who made them; you receive only how many there were and, if our team hides the rule, its reason;
• with the accountant and lawyers who advise us, under a duty of confidentiality and only as far as necessary;
• with public authorities, when there is a court order or a request provided for by law. Access records are only disclosed under a court order (Marco Civil da Internet, arts. 10 and 15);
• with a successor to paperrise in the event of a reorganization, merger or sale of the company, which will be bound to respect this policy. In that case, we will notify you beforehand.

9. International data transfers

The paperrise server is located in the United States, in Boston. As a result, all service data is stored and processed in the United States, including that of users in Brazil, the European Union and the United Kingdom. Some of the providers in section 8 also process data in the United States and in other countries.

The United States has no adequacy decision from the ANPD. Transfers from Brazil rely on their being necessary to perform the contract you entered into with us, or the steps prior to it (LGPD, art. 33, IX, together with art. 7, V), and, where the provider’s data processing terms include them, on international transfer clauses (LGPD, art. 33, II, and ANPD Resolution CD/ANPD No. 19/2024). Our contracts with the providers that act as processors require them to protect the data and to use it only for the contracted purposes.

For data subjects in the European Economic Area and the United Kingdom: the European Commission has found that the EU–U.S. Data Privacy Framework ensures adequate protection for the U.S. companies certified under it (GDPR, art. 45), and the United Kingdom has adopted the UK–U.S. extension to it. Where a provider is not certified, the transfer relies on the European Commission’s standard contractual clauses and, for the United Kingdom, the corresponding addendum, set out in the provider’s data processing terms (GDPR and UK GDPR, art. 46).

The data you yourself give Google or Microsoft, when signing in with those accounts, and Stripe, when paying, is processed by those providers under their own policies. The same applies to Google Fonts, which receives your IP address from your browser when the typefaces load: it acts as an independent controller, with no data processing contract with us. You can ask for more information about the safeguards that apply to each provider, or for a copy of them, at contact@paperrise.com.

10. How long we keep data

We keep each item of data only for as long as its purpose requires or for the period the law requires. The deletions below are carried out by automated routines that run every day (and, for the account lock and deletion rules, every hour). The exception is email messages, which we delete manually.

When an account or an organization is deleted, its revenue history (amount, currency and the dates subscriptions started and ended) is no longer associated with it and is used only in aggregate revenue statistics, until it is erased within the period shown in the table.

Deletion — automatic or at your request — is suspended while there is a court order, a request from an authority or a preservation request provided for by law, pending legal proceedings or a complaint, or an open payment dispute (chargeback). During that time, the account is kept with all its data, and the access, security, proof and tax records linked to it are not erased at the end of their periods. If you ask for deletion in that situation, the system will tell you that the account cannot be deleted at the moment: write to contact@paperrise.com to find out why, which we will tell you unless the law or a court order prevents us. Once the reason no longer applies, you can ask for deletion again, and the automatic deletion periods start over, with new email notices before any deletion. The same applies to organizations.

Stripe, Google, Microsoft and our other providers keep their own records for the periods set by their policies and legal obligations. Deleting your paperrise account does not erase, for example, the payment records Stripe is required to keep.

11. What happens when the account is deleted

Deletion — at your request or under the automatic rules — erases at once the account, the profile, all content, sessions, devices, Google or Microsoft links and the record of the accounts from those providers you removed, activity and the Stripe link. The local rules you wrote leave, with the account, every project they were in, including those of organizations, and each of those projects keeps only the record that the rule left; their publications go with them, with the reports about them, and the rules other founders adopted from them stay theirs. Your reports about other founders’ rules, your reminder preferences and the record of your summaries are deleted too. Before that, we end any subscription and any open payment page, so that nothing more is charged.

Your places in organizations end with the account: what you wrote in them stays with each organization, without your name, invitations you sent that are still pending are revoked, and each organization’s owner is told by email that you left. An organization you own is deleted together with your account only if no one else belongs to it and it has no active subscription; otherwise, the account cannot be deleted until you transfer or delete the organization (Terms of Use, section 23).

Projects shared with you stop opening, the invitations you sent and those addressed to your email are revoked, and your business CV is deleted, leaving every project it appeared in, data rooms included. The data rooms you read stop opening and the invitations to them addressed to you are revoked; in their access logs, only your partly masked email address remains. Projects you shared keep, in their audit log, only the masked email address of whoever received them.

Only the following are kept, for the periods in section 10:

• the minimal proof record: a hash of your email generated with a secret key (which allows the same address to be recognized, but not recovered), the internal account identifier, the dates of payment failure, lock, cancellation, refund, dispute and deletion, the notices sent (type, channel and date), the version of the Terms of Use accepted and the Stripe customer identifier;
• the tax records of paid invoices, refunds and disputes;
• the revenue history, with no link to the account (section 10);
• the access records of the last 6 months (date and time, IP, port, account identifier and email);
• the security events of the last 6 months (failed sign-in attempts, bot checks, too many attempts, invitations opened by another account and changes to the account), with the email typed or the account’s (for an email change, the previous address), the IP and the port;
• the hash of the email that prevents a second free trial, if you had chosen a plan, and that of the addresses the account left by changing its email after that;
• the record of the team’s actions that changed the account;
• copies in backups, until they expire, within 35 days.

After the deletion, we send a confirmation email. For automatic deletions, it states what was kept, for how long and why.

12. Your rights and how to exercise them

You have the right to:

• confirm whether we process your data and access it;
• correct incomplete, inaccurate or out-of-date data;
• ask for data that is unnecessary, excessive or processed unlawfully to be anonymized, blocked or erased;
• receive your data in a structured format, to take it to another service (portability);
• ask for your account and data to be deleted;
• know who we share your data with;
• object to processing based on legitimate interest and, where applicable, ask for processing to be restricted;
• ask for a review of decisions made solely on the basis of automated processing (section 13);
• complain to a data protection authority.

In your account, you can yourself, at any time and free of charge, even while the account is locked:

• correct and update your name and profile (date of birth, gender, occupation and purpose of use), under Account → “Profile”;
• change the account’s email, under Account → “Email”: we send a code to the new address and then another to the current one, which authorizes the change; at the end, we notify both addresses. In the messages to the old address, the new one is shown only in part. The new email then applies to signing in and to notices, and right after the change we ask Stripe to update it for your subscription and those of the organizations you own; if Stripe cannot be updated at that moment, the change still holds, and you can update the email at Stripe under Account → “Manage subscription” (for an organization, in its settings) or ask us at contact@paperrise.com;
• create or change your password and connect or remove Google and Microsoft, under Account → “Sign-in methods”, after confirming a code sent to the account’s email (section 4);
• download a copy of your data in JSON format, under Account → “Download my data”: profile, personal projects (with the journey of each one: materials and versions, core fields, diary, assumptions, evidence, experiments, checkpoint decisions, audit log, checklist, funnels and contacts, the data room, its folder readers, their invitations and the access log, and erasures from the history), your local rules (with their publications and the reports they received — how many and why, never who), the reports you made about other founders’ rules, the organizations you belong to, your access to their projects and the invitations pending for your email address, the projects shared with you and the invitations to projects (those received and those you sent, with the address masked), the data rooms you read (whose, which folders, until when, who gave the access), the invitations to data rooms (those received and those you sent, with the address masked) and your lines in their access logs — never the documents, which are the project’s —, your business CV (its items and, in each project it appears in, the sections and cuts, with the draft and the approved copy), your reminder preferences and the record of the summaries sent, sign-in methods (including the Google or Microsoft accounts you removed), sessions, devices, verification codes and password reset links (dates only), security events (including those of the addresses the account had before an email change), activity, subscription, invoices, refunds and disputes, notice emails and proof records. The internal record of the team’s actions on the account is not included in the file, but can be requested by email;
• delete one of your local rules, under Account → “Your local rules”: it leaves every project it was in, and its publication goes with it; there you also publish a rule to the founders of its country, after a preview, and withdraw the publication at any time;
• choose which reminders come by email and the time zone of the summary, or stop it, under Account → “Reminder emails”; the link in each summary stops it without signing in (turning it back on takes the Account page, and makes the links of earlier summaries stop working);
• write, correct or delete the items of your business CV, choose the sections and cuts each project sees and take the CV out of a project, under Account → “Business CV” (with an account without a plan, you read, export and delete what you already have); and leave a project shared with you, on the project’s Access tab;
• with the account active, erase from the history the content of a card, a material, an assumption, a piece of evidence or an experiment of your personal projects, on the page where it is (section 3);
• delete the account and all its data, under Account → “Delete account” (to confirm, we ask for a code sent to your email), except in the situations of suspension described in section 10 and while you own an organization that other people belong to or that has an active subscription (Terms of Use, section 23);
• see and end the sessions open on other devices, under Account → “Connected devices”.

For other requests — for example, correcting other data, objecting to processing or receiving the record of the team’s actions on the account — or if you cannot sign in to your account or make one of these changes (for example, because you lost access to its email), write to contact@paperrise.com (or use the contact form on the website, with the topic “Privacy and personal data”). This includes accounts suspended by our team (section 19 of the Terms of Use), which cannot sign in: in that case, ask by email for a copy of your data or for deletion. To protect your data, we may ask that the request be sent from the account’s email address or that you confirm your identity in another way. There is no charge.

Requests about personal data in an organization’s content — for example, about what was written about you in one of its projects — are for the organization, which is its controller: write to its owner. If such a request reaches us, we will forward it to the owner or tell you whom to contact, and we help the organization answer it (section 18). An organization’s data is exported by its owner, in the organization’s settings.

We reply within 15 days. If the applicable law allows the period to be extended for complex requests, as the GDPR and the UK GDPR do, we will tell you before those 15 days are over, explaining why. If we cannot fulfil a request — for example, because the law requires us to keep certain data — we will explain why.

You can complain to the ANPD (www.gov.br/anpd). In the European Union, you can complain to the data protection authority of the country where you live or work or where the infringement took place; in the United Kingdom, to the Information Commissioner’s Office (ICO). If you prefer, talk to us first: we will try to resolve the matter directly. If the law of your country grants you other rights, you can also exercise them through the same channel.

13. Automated decisions

We do not make decisions based on profiling, nor do we evaluate aspects of your personality, behavior or financial situation by automated means.

Some actions happen automatically, under fixed time rules set out in the Terms of Use: locking the account when the trial ends, when the subscription comes to an end or when a payment is not settled within 7 days, and deleting it 90 days after the lock. The same time rules apply to organizations (Terms of Use, section 23). Temporarily refusing suspicious sign-in attempts is also automatic, as is hiding a published local rule when open reports about it come from people of 3 different organizations or personal projects, until our team reviews it (section 3); we email its author. So is cancelling, with a full refund, a new paid-plan subscription taken out with a billing address or card from outside Brazil (Terms, section 7). If you believe one of these rules was applied wrongly in your case, write to contact@paperrise.com: a member of our team will review it.

14. Cookies and local storage

We use only cookies and local storage that are strictly necessary for the service to work. That is why we do not show a cookie consent banner. We do not use advertising, analytics or tracking cookies. The public website sets no cookies.

When you use Stripe’s payment page or the Google and Microsoft sign-in screens, those sites may use their own cookies, under their own policies. On the sign-in, sign-up and password recovery screens and on the contact form, the bot check (Cloudflare Turnstile) collects technical browser signals to tell people from bots. Typefaces are loaded from Google Fonts servers; as a result, your browser sends Google your IP address and technical browser data.

Because we do not track you, signals such as Do Not Track or Global Privacy Control do not change how paperrise works.

15. Security

We take technical and organizational measures, proportionate to our size, to protect your data, including:

• connections always encrypted (HTTPS, with HSTS);
• passwords stored only as bcrypt hashes, with rules that reject weak or very common passwords;
• server-side sessions: the cookie contains only a random code, of which we store only a hash, and you can end any session at any time;
• access to an organization’s projects checked on every request, so that a change of access or a removal takes effect at once;
• a code sent by email when signing in with a password on a new browser and an email alert whenever the account is signed in on a new device, by any sign-in method (when a password is added through the sign-in with email option, the notice of the new password serves as that alert);
• on the Account page, confirmation with a code sent to the account’s email, valid for 10 minutes and only in the session where it was confirmed, before creating or changing the password and connecting or removing Google or Microsoft; for an email change, one code sent to the new address and another to the current one. Outside the Account page, a password is only set through a link (password reset) or a code (sign-in with email) sent to the account’s email, and a Google or Microsoft account whose email, verified by the provider, is the account’s own becomes a sign-in method when used to sign in (section 4); each of these changes is notified by email;
• an email notice when the account’s email, password or connected accounts change and, when the password is created or changed, the end of the sessions on other devices, which ask again for the emailed code at their next sign-in with a password;
• verification codes and reset links stored only as hashes, with short validity and a limited number of attempts;
• bot checks, attempt limits and refusal of disposable email addresses;
• protection against common web attacks, such as a content security policy (CSP) and checks on the origin of requests;
• an internal team console separate from customer accounts, with two-step verification, roles with different permissions and a record of every change made by the team;
• daily database backups, deleted automatically within 35 days.

No system is completely invulnerable. If a security incident occurs that may pose a relevant risk or harm to you, we will notify you and the ANPD within the legal deadlines, explaining what happened and what to do.

16. Children and teenagers

paperrise is not intended for anyone under 18 and does not knowingly collect data from children or teenagers. Right after the account is created, we ask for your date of birth and do not complete the sign-up of anyone under 18. Without a completed sign-up, the service cannot be used, and the account is deleted automatically 90 days after its last use. If we learn that an account belongs to a minor, it will be deleted immediately. If you know of such a case, write to contact@paperrise.com.

17. Changes to this policy

We may update this policy when the service or the law changes. The date of the version in force is shown at the top of this page, and each account records the version accepted at sign-up.

We will notify you by email, at least 30 days in advance, of relevant changes — such as collecting a new type of data, a new purpose, a new provider that receives your content, or sending content to an artificial intelligence provider. If you do not agree, you can download your data and delete your account before the change takes effect. Previous versions of this policy can be requested at contact@paperrise.com.

18. Organizations (Team plan)

This section applies when you create, join or are invited to an organization. How organizations work is explained in the Terms of Use (sections 23 and 24).

For an organization’s content and the data about its use — its projects and the personal data in them, its list of members and their roles, the access given to each member, its invitations and its activity log — the controller is the organization (the company or group it was created for, represented by its owner), and paperrise processes that data as its processor (operador), on its behalf and following its instructions. For everything else about you — your account, profile, sign-in and security data, personal projects, your own subscription and the emails we send you — paperrise remains the controller, as described in the rest of this policy. paperrise is also the controller of the organization’s billing data (its Stripe customer, subscription and invoices).

What we process in organizations:

• the organization’s name and subscription (number of users, status and dates, monthly amount and currency) and its Stripe identifiers; at checkout, Stripe also collects its billing address and, if given, its tax ID;
• each member’s role, date of joining and who added them, and who each project is shared with — members or people from outside —, with which permission (View, Edit, or Edit and decide checkpoints), which parts and until when, who gave the access and when, and the invitations to projects;
• invitations: the email address invited, the role and the projects offered, who sent it, when and how many times, and its status;
• the organization’s content, with who created and edited each project and what is in it (versions of materials, diary entries, assumptions, evidence, experiments, checkpoint decisions and checklist items), and each project’s audit log;
• each project’s data room, its folder readers (members or people from outside), with their folders, last day and who gave the access, the invitations to it and each reader’s access log;
• an activity log of what is done in the organization — invitations sent, resent, revoked, accepted or declined; members joining, leaving or being removed; changes of role and access; projects created or moved into it; changes of name and of users paid for — with the people involved and email addresses always partly masked (for example, a***@example.com).

Invitations: when the owner or an admin invites someone, we send the invitation email on the organization’s instruction, with the organization’s name and the name of whoever invited, in the language of the invitee’s account if they have one. The address invited is used only for that invitation: to send it, to let it be accepted only by the account with that address, to show it to the owner and the admins while it is pending and in the organization’s data export, and to protect the service against abuse (for example, by refusing disposable addresses and limiting the number of invitations). If you are invited and do not have an account, we keep your address only while the invitation is valid (7 days, renewed if it is sent again) and for 30 days after it is accepted, declined, revoked or expires; only the partly masked form remains in the organization’s activity log.

What other people see: every member of an organization sees its name and the name of its owner. On the projects you can open, the others who can open them see your name and your access, and your name appears as the author of what you create or edit. The owner and the admins also see your email address, role, date of joining and access to projects, and the owner’s export of the organization’s data contains this information and the activity log. Your personal projects are never visible to the organization. Someone with access to only some parts of a project sees only those parts, and whoever runs the project also sees the email address of the people it is shared with. A folder reader — a member or not — sees only what is in the folders of their invitation, until the last day.

Local rules: a local rule a member writes is theirs (section 3), not the organization’s. In the organization’s projects where it was used, whoever can open them reads it, with the author’s name; it leaves those projects when its author deletes it or deletes their account, and each project keeps only the record that it left. In the organization’s projects, who validated a rule is recorded by the owner, the admins and those with Edit and decide checkpoints with the checklist; someone with Edit with the checklist validates it in their own name. Publishing a rule to the founders of its country is its author’s choice (section 3), also when it was used in the organization’s projects; a rule adopted from another founder’s is the adopter’s own.

Leaving, removal and account deletion: if you leave an organization or are removed from it, your access ends at once — including the shares of and invitations to its projects, and your business CV leaves those projects —, and what you wrote stays in its projects, under its control. If you are removed, we tell you by email. If you delete your account, your name is removed from what you wrote in organizations, and each organization’s owner is told by email that you left.

Requests about personal data in an organization’s content should be addressed to the organization, through its owner. If they reach us, we forward them to the owner or tell you whom to contact, and we help the organization answer them. Requests about your account are for us (section 12).

Export and deletion: the organization’s owner can download all of its data at any time, also while it is locked. An organization is deleted, with all its content, when its owner deletes it; 90 days after it is locked, with email notices to the owner 30, 7 and 2 days before; 30 days after it was created, if it was never paid for and has no projects; or together with its owner’s account, if no one else belongs to it and it has no active subscription. Afterwards, we keep only what section 11 describes for accounts — the minimal proof record (under a hash of its owner’s email address), the tax records of its invoices, its revenue history without a link to it and the record of our team’s actions on it — for the periods in section 10.

Our team sees, in the internal console, each organization’s name, owner, members (name, email address, role and number of projects granted), pending invitations, users paid for, number of projects and subscription status — never the content or the names of its projects. Every change our team makes to an organization is recorded.

19. Contact

Baesso Works Servicos Administrativos LTDA. — CNPJ 50.377.331/0001-13

Praca Cruz da Esperanca, 106. Vila Baruel, São Paulo - SP. 02522040 - Brazil.

Privacy and data protection: contact@paperrise.com