Privacy Policy
PayPapi, operated by Daragiu Studios SRL ("we", "us", "our"), is committed to protecting your personal data. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights under the General Data Protection Regulation (GDPR) and applicable EU data protection law.
1. Who We Are (Data Controller)
Daragiu Studios SRL (trading as "PayPapi") is the data controller for personal data processed through the paypapi.io platform and related services.
- Company: Daragiu Studios SRL (trading as "PayPapi"), Romania
- Contact: hi@paypapi.io
- Data Protection Officer (DPO): hi@paypapi.io
2. Data We Collect
PayPapi has no user accounts and no passwords. Most of what the app works with never reaches us.
2.1 Data you provide directly
- Purchase data: when you buy PayPapi, the store you bought from (Apple, for App Store purchases, or our payment provider) shares your email address and the purchase details with us so we can deliver your purchase, verify it and help you if something goes wrong. We never see or store card numbers.
- Support communications: the messages and attachments you send to hi@paypapi.io.
- Subscription data: the subscriptions you enter (names, costs, renewal dates, notes) are stored on your device only. We do not collect them.
- Images you scan (iOS app): processed on the spot and never stored, as described in section 4.
2.2 Data we collect automatically
- Website (paypapi.io): standard server logs (IP address, browser type, pages requested) kept by our hosting provider for security, and advertising measurement through the Meta Pixel (page views, checkout and purchase events).
- App: the app periodically downloads the public service catalogue and price list from paypapi.io, checks for updates and fetches currency exchange rates. Like any web request, these carry your IP address, but no account, subscription or personal data.
- Anonymous usage totals: only if you opt in, as described in section 3.
2.3 Data from third parties
- Store purchase details: as described in 2.1. Nothing else: there is no sign-in with Google or any other provider, and we buy no data about you.
3. Anonymous Usage Data (Opt-in)
With your explicit consent, PayPapi may collect anonymous, aggregated usage data. This includes your total monthly and annual subscription spend (a single number) and the number of subscriptions per category (Streaming, Software, Cloud, Music, Other). We never collect the name of any specific service, individual subscription amounts, or any information that could identify you.
This is entirely optional, enabled only if you choose to participate in onboarding or Settings, and can be disabled at any time. This data is used solely for product improvement and is never sold to third parties.
4. Scan with AI (mobile app)
The PayPapi iOS app can read your subscriptions from a photo. Two options exist:
- Scan (on-device): the image is analysed on your phone using Apple's text recognition. Nothing leaves your device.
- Scan with AI: when you explicitly choose it, the image you select is sent over an encrypted connection to a PayPapi relay and analysed by an AI model (Anthropic Claude) to detect subscription names, amounts and billing cycles. Before sending, PayPapi automatically blacks out IBANs, card numbers and personal identification numbers on your device.
Images sent through Scan with AI are processed on the spot and are not stored by PayPapi: our relay keeps no copy, no database and no content logs. Only an anonymous, random installation identifier and a one-way hash of your IP address are kept for up to 48 hours to enforce the daily scan limits; neither is linked to you, and the IP address itself is not stored. Anthropic does not use the images to train its models and deletes them automatically within 30 days at most; content flagged by Anthropic's safety systems may be kept longer, as described in their policies. Legal basis: Art. 6(1)(b) contract performance, at your request.
5. Why We Process Your Data (Legal Bases)
We rely on the following GDPR legal bases for processing your personal data:
- Provide and operate the Service. Data used: account, subscription, billing. Legal basis: Art. 6(1)(b) contract performance.
- Process payments and prevent fraud. Data used: billing data, security logs. Legal basis: Art. 6(1)(b) and 6(1)(f) legitimate interest.
- Improve the platform (analytics). Data used: usage data, cookies. Legal basis: Art. 6(1)(f) legitimate interest.
- Send transactional emails (renewal alerts, invoices). Data used: email, subscription data. Legal basis: Art. 6(1)(b) contract performance.
- Send marketing communications. Data used: email, usage behaviour. Legal basis: Art. 6(1)(a) consent.
6. How Long We Keep Your Data
We retain personal data only as long as necessary for the purposes described in this policy:
- Account and subscription data: for the duration of your account plus 30 days after deletion (then permanently erased)
- Billing and invoice data: retained for 7 years to comply with EU financial and tax regulations
- Usage and analytics data: rolling 90-day window, then automatically purged
- Support communications: retained for 3 years for legal defence purposes
- Security logs: retained for 12 months for security investigation purposes
7. Who We Share Your Data With
We do not sell your personal data. We share data only with the following categories of recipients:
7.1 Service providers (data processors)
- Payment provider (Apple, for App Store purchases): payment processing and receipts
- Cloud hosting providers (EU/US): website and infrastructure hosting
- Email delivery provider: transactional email (e.g. purchase confirmations)
- Anthropic (US): AI analysis of images you submit via Scan with AI (not stored by PayPapi; not used for model training; deleted by Anthropic within 30 days)
- Cloudflare (global edge network): stateless relay for Scan with AI (no image storage)
All processors are bound by Data Processing Agreements and may only process your data on our documented instructions.
7.2 Legal and regulatory disclosure
We may disclose personal data to law enforcement, courts, or regulators where required by applicable EU or member state law, or to protect the rights, safety, or property of PayPapi or its users.
7.3 Business transfers
In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity, subject to equivalent data protection obligations.
8. International Data Transfers
We primarily process data within the European Economic Area (EEA). Where data is transferred outside the EEA (e.g. to US-based service providers), we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- adequacy decisions where applicable
You may request a copy of the relevant transfer mechanisms by contacting hi@paypapi.io.
9. Your Rights Under GDPR
- Right of access (Art. 15): obtain a copy of the personal data we hold about you
- Right to rectification (Art. 16): correct inaccurate or incomplete data
- Right to erasure (Art. 17): request deletion of your data where no longer necessary
- Right to restriction (Art. 18): restrict processing in certain circumstances
- Right to data portability (Art. 20): receive your data in a structured, machine-readable format
- Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing
- Right to withdraw consent (Art. 7(3)): withdraw consent for consent-based processing at any time
- Right to lodge a complaint: lodge a complaint with your national data protection authority
A list of EU supervisory authorities is available at edpb.europa.eu. We will not discriminate against you for exercising any of these rights.
10. Security
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:
- encryption of data in transit (TLS 1.2+) and at rest (AES-256)
- role-based access controls and least-privilege principles
- regular security assessments and penetration testing
- multi-factor authentication for internal systems
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, inform affected users without undue delay.
11. Children's Privacy
The PayPapi Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at hi@paypapi.io and we will delete it promptly.
12. Cookies
We use cookies and similar tracking technologies as described in our Cookie Policy. You can manage your cookie preferences at any time via the cookie settings panel on our website.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 30 days before they take effect. The "Last updated" date at the top of this document indicates the most recent revision.
14. Contact and Complaints
For any privacy-related queries or to exercise your rights, contact our Data Protection Officer:
- Email: hi@paypapi.io
If you are not satisfied with our response, you have the right to lodge a complaint with your national data protection authority. In Romania, this is the ANSPDCP (dataprotection.ro).