PaperFig Privacy Policy

To run the Service, we collect:

• Email address — used to sign you in via magic link.
• Prompts you type and the AI-refined version we send to the image model.
• Text extracted from documents you upload (PDF / DOCX). The original file is discarded after extraction.
• Generated figures (the image files themselves).
• Credit balance and transaction history.
• Payment metadatafrom Stripe (we don't see your card number — Stripe does).
• Anonymous usage analytics (page views, response times) via Vercel. No personal identifiers, no cross-site tracking.

• We don't train any AI model on your prompts, papers, or figures.
• We don't sell your data to third parties.
• We don't set advertising cookies or run third-party trackers.

• Uploaded paper text: 30 days, then automatically deleted.
• Original PDF / DOCX files: discarded immediately after we extract the text.
• Generated figures: kept as long as your account is active, so you can re-download them.
• Account email + credit ledger: kept while the account exists; deleted when you ask.

• Supabase (US) — authentication, database, storage.
• Vercel (US) — hosting and privacy-friendly analytics.
• Anthropic (US) — refining your prompts via Claude. Anthropic does not train on API inputs.
• Replicate (US) — running the image-generation model.
• Stripe (US, EU) — payment processing.

You can ask us to:

• Access the data we hold about you.
• Export your generations and account data.
• Correct any inaccurate information.
• Delete your account and all associated data.

Email support@paperfig.app from the address on your account. We respond within 14 days.

Connections are TLS-encrypted. Data at rest is encrypted by our providers. Access to production data is limited to the operator. That said, no system is perfectly secure — don't upload data you can't afford to lose.

PaperFig is not directed at children under 13. If you believe a child has signed up, email us and we will delete the account.

We may update this policy. Material changes will be announced via email or in-app notice at least 14 days before taking effect.