Privacy policy

Who we are

Paperflight is a web app operated by Arthiq Tech Pte Ltd, registered at 68 Circular Road #02, Singapore 049422. You can reach us at support@paperflight.app.

In privacy law we are the “controller” of your data in the United States, the “organisation” under Singapore’s PDPA, and the “Data Fiduciary” under India’s DPDP Act. All three words mean the same thing: we decide what happens to your data, so we are the ones answerable for it.

The short version

You upload bank and credit-card statements. We read them and show you where your money went.

• We never connect to your bank. There is no Plaid, no aggregator, no open banking link, and no bank login. We have never asked for your banking credentials and we never will.
• We hold the statement files you upload (encrypted, so you can re-download them and so a better parser can re-read them), what we extract from them, your phone number, and any statement password you explicitly choose to save. You can delete any stored file at any time.
• We do not sell, rent or share your personal data. We run no advertising and no ad tech.
• Your original statement files are downloadable any time, and a copy of everything we hold is yours on request at support@paperflight.app. Whatever your plan, we never delete or hide your data while your account exists.
• You can delete your account and your data, and we will delete it.

What we collect, and why

Your phone number

Your phone number is your account. You ask to sign in, we send a link on WhatsApp, and tapping it gives you a short code to type back. We use your number to create and identify your account, deliver those links, and contact you about your account or a security issue.

There is no password. We never set one, so there is no password of yours for us to leak. We do not read your WhatsApp messages or your contacts. WhatsApp is only a delivery channel for a code.

The statement files you upload

We keep the file, encrypted, until you delete it. It is stored exactly as your bank produced it — a password-locked PDF stays locked at rest — in private storage where every read is a signed link that expires in about a minute. Alongside it we store the parsed transaction rows, the file’s name and size, and a one-way fingerprint (a SHA-256 hash) of its contents, which is how we recognise a duplicate upload.

Keeping the file is what lets you re-download the original whenever you need it, and lets a better parser re-read old statements without asking you to find them again. It is also yours to remove: every stored file has a delete control on the Statements page, with a choice of removing just the file or the extracted transactions with it. Deleting your account removes every stored file.

Statement passwords, only if you save one

A locked PDF asks for its password at import. If you tick “save for this account”, we store that password encrypted, and use it only to unlock that account’s future statements. We never store it without that choice, it never appears in any log, and you can forget it at any time from My profile — the next locked statement simply asks again.

What we extract from those files

• Transaction rows — date, the description as printed by your bank, amount and currency.
• Merchant and category labels — our reading of what each transaction was for.
• Account metadata — the account name on the statement, the last four digits, the currency and the country.

We store the last four digits so you can tell your accounts apart. Four digits cannot be used to charge a card or move money.

Payment information

Payments are handled by Stripe. Card details go straight to Stripe; they do not pass through our servers and we do not store them. From Stripe we receive a customer reference, your subscription status, and whether each payment succeeded. We never see your full card number.

Technical and log data

Our servers keep logs so the app can be operated and debugged: IP address, time, the endpoint requested, browser and device type, and error traces. We use cookies only to keep you signed in. There are no advertising cookies and no third-party tracking cookies.

What we do not collect

• No bank usernames, passwords, PINs, banking one-time codes or security questions.
• No connection of any kind to your bank, card issuer or any aggregator.
• No full card numbers, CVV codes or expiry dates.
• No national identity or tax numbers — unless one is printed on a statement you upload, which we neither ask for nor look for.
• No location tracking, no contact list, no device fingerprinting.
• No data bought from data brokers, and none sold to them.

Why we are allowed to hold this data

Singapore (PDPA). We collect, use and disclose your data with your consent, given when you create an account and upload a statement. Some processing runs on deemed consent — you upload a statement precisely so that it will be parsed — and some on the legitimate-interests and business-improvement exceptions. You can withdraw consent at any time.

India (DPDP Act 2023). We process your data on your consent, given after this notice, for the purposes described here. You may withdraw consent as easily as you gave it.

United States. We process your data to provide the service you asked for, to bill you, to keep the service secure and to meet legal duties. We do not sell your personal information and we do not share it for cross-context behavioural advertising.

Categorising and labelling

Cleaning a merchant name, categorising a transaction and spotting a recurring charge all happen on our own servers, with ordinary code — pattern rules, not a language model. No third-party model sees your transactions today, with one exception you control entirely: an AI agent you choose to connect (next section).

If we add a model to improve categorising, it will appear in the vendor table below before it processes anything, and we will contract on a no-training, no-retention basis. Your data will not be used to train any model, ours or a vendor’s.

AI agents you choose to connect

On a paid plan you can connect an external AI agent (for example, an assistant like Claude) to your Paperflight data through our MCP interface. This never happens by default: you approve it on a consent screen that lists, scope by scope, exactly what the agent may see and do, and you can pause any scope or disconnect the agent at any time from My profile.

When a connected agent reads your data, that data goes to the agent and to whoever operates it, under their privacy terms — connecting an agent is you directing us to share with a processor of your choosing. Check the operator’s policy before connecting if that matters to you. On our side: agents get only the scopes you enabled, every change they make is marked as theirs in the audit trail, they can never see a saved statement password, and disconnecting revokes their access immediately.

Who else processes your data

Your statements are parsed entirely by our own code, on our own servers — PDFs included. No third party sees them. If that ever changes — reading scanned documents may one day need an external service — this table changes first and we will tell you before it does.

Beyond this list we disclose personal data only when the law requires it — a valid court order, warrant or regulatory demand — or to establish or defend a legal claim. If we are permitted to tell you about such a demand, we will.

Sending data across borders

Our users are worldwide; our servers are in Singapore. Under Singapore’s Transfer Limitation Obligation we transfer data outside Singapore only where the recipient is contractually bound to a comparable standard. Under section 16 of the DPDP Act we do not transfer to any country the Indian government has restricted.

Security: how this is built

What follows are design decisions you can check, not marketing claims.

What is not there to steal. The largest security decision in Paperflight was made by leaving things out. There is no bank connection, so there are no banking credentials or tokens in our systems — nobody who compromises us can log into your bank, move your money, or open an account. There is no password, so there is nothing of yours to crack or to find reused elsewhere. There is no full card number anywhere in our infrastructure.

Sign-in. We send a link on WhatsApp; tapping it shows a short code that you type back into the app. The code does not exist until the link is tapped, so there is nothing to intercept beforehand. Codes are single-use, expire after ten minutes, and both the link and the code are rate-limited per number and per IP address.

Sessions last a year and renew as you use the app, so an active user signs in approximately never. There is no “sign out everywhere” yet — a lost phone keeps access until someone signs out on it. That is a real gap, and closing it is planned.

Statement files live in a private bucket with public access blocked at the account level, encrypted at rest, readable only through signed links that expire in about a minute. The credentials our servers use for that bucket are scoped to this application’s own folder and can touch nothing else. There are no public file URLs anywhere in the system.

Where the real risk sits, honestly, so you can reason about it: your phone, because sign-in is by phone number and whoever controls your number can reach your account — set a SIM PIN and turn on WhatsApp two-step verification. Our vendors, because each is a place your data exists, which is why the list is short. Our own staff, controlled and logged but not zero. And your exports, which are plain unencrypted files once they leave us.

How long we keep things

Deleting your data, and getting a copy

Getting a copy. Your original statement files are downloadable from the Statements page at any time. For a copy of everything we hold — transactions, categories, account metadata — email support@paperflight.app from your account and we will send it within 30 days. Self-service downloadable reports are planned; this page changes when they ship.

Deleting your account. Self-service deletion is not built yet. Until it is, email support@paperflight.app, include the phone number on your account, and we will confirm the request over WhatsApp before acting. Then we will delete your transactions, categories, account metadata and phone number within 30 days. We will confirm when it is done.

We would rather say that plainly than put a button on this page that does not exist. Export before you ask — deletion cannot be undone.

Your rights

You can see your data, correct it, export it, delete it, withdraw consent, and complain. Email support@paperflight.app and include the phone number on your account. We answer within 7 days, faster where the law requires. We do not charge for these requests and we do not treat you differently for making one.

Singapore

You may request access to your data and to information about how it has been used in the past year, and request correction. Our Data Protection Officer is at privacy@paperflight.app. Unresolved complaints can go to the Personal Data Protection Commission.

India

You may request a summary of the data we process, the identities of others we have shared it with, correction and erasure, and you may nominate someone to exercise these rights if you die or become incapacitated. Our grievance officer is Rajesh (Founder), at support@paperflight.app. Unresolved grievances can go to the Data Protection Board of India.

California and other US states

We do not sell your personal information and have not done so. We do not share it for cross-context behavioural advertising. You may ask to know, access, correct, delete and port your data, and we will not retaliate for a request. If you are in another state with a comprehensive privacy law, email us and we will handle your request under your state’s law.

Children

Paperflight is for adults. You must be 18 or older. If we learn an account belongs to someone under 18, we will close it and delete the data.

Changes

When a change materially affects you — a new sub-processor, a new purpose, a longer retention period — we will tell you before it takes effect and note what changed at the top of this page.