Paidwhere

Privacy Policy

Effective: October 18, 2026

This document is a starting template and must be reviewed by a qualified lawyer before Paidwhere launches.

1. Who is responsible

Paidwhere, operated by Apledot (a sole proprietorship in South Korea), is the controller of the personal data described in this policy: the early-access list, accounts and licenses, billing, support and the website. Paidwhere is a local-first app: your invoices, receipts and ledger are stored on your own computer and are not collected by us.

When the App sends the text of a page for AI reading, we process that text on your behalf only to return the result. If you are a business, you are the controller of the personal data in your documents and our Data Processing Addendum applies.

Privacy officer: Bo Sung Jang, Representative. Contact: privacy@paidwhere.com. Our postal address is available on request.

Paidwhere is offered only in the United States, Australia, Hong Kong, South Korea and Japan. Users in Korea: see our Korean-language Privacy Policy at paidwhere.com/ko/privacy.

2. What we collect

  • Early-access list: your email address, which computer you use (Mac, Windows or both) and which sign-up form you used.
  • Account and license: email address, plan, license details and dates, and the number of pages read for your plan’s limit.
  • Billing data from Paddle: plan, status, billing period and Paddle customer ID. We never receive your full card number.
  • AI reading: the text of a page the App could not read itself, while it is being read. It is not stored.
  • Sharing between your computers (when two or more of your computers are signed in): each invoice’s details (vendor, dates, amounts, category, file name) as your computers made them, and invoice files you choose to move from one computer to another. Your computers encrypt them with a key only they hold before they reach us, so we store ciphertext we cannot read. The details stay until the invoice is removed or you sign the computer out; a file is deleted as soon as the other computer picks it up, and never kept longer than 7 days.
  • Mail forwarding (only if you use it): messages you or your mail service forward to your private Paidwhere address. Each one is encrypted for your computers as it arrives and kept only in that encrypted form until one of them picks it up, when it is deleted, and never longer than 7 days. We also keep a record of each message (date, sender, subject, size and whether it was picked up, bounced or expired) and show it on your account page.
  • Support: what you write to us by email.
  • Technical data: IP address, browser and timestamps in our security and error logs, and the country your connection comes from (to offer Paidwhere only where it is available).

3. What we do not collect

  • Your invoices, receipts and other documents, your ledger, your folder contents, and the questions you ask in the App. These stay on your computer.
  • Your mailbox. Neither the App nor our servers sign in to it; only the messages you choose to forward reach us (section 2).
  • The App’s logs, which stay on your computer unless you send them to us for support.
  • Files you convert with the free Invoice to CSV tool, which runs in your browser.

4. Why we use it and our legal bases

  • To provide the Service (performance of a contract): activating licenses, applying plan limits, AI reading, sending the emails you asked for.
  • To tell you once when the download is ready, if you joined the early-access list (consent, which you can withdraw at any time).
  • To keep the Service secure and working, prevent abuse and fix errors (legitimate interests).
  • To bill you and meet tax and accounting rules (contract and legal obligation).
  • We do not sell personal data, do not use it for targeted advertising and do not use your documents to train AI models.

5. Automated processing

An AI model reads the text of pages the App could not read itself. This does not produce decisions with legal or similarly significant effects on you; you review and confirm the results.

6. Service providers (subprocessors)

  • Anthropic: AI reading of page text, under terms that prohibit training on customer data (United States).
  • Paddle: payments, tax and invoicing as merchant of record (United Kingdom / United States).
  • Cloudflare: hosting of the website and of the database for the early-access list, accounts, licenses and mail records; receiving forwarded mail and keeping it, encrypted, until it is picked up; DNS, network security and bot protection (United States and data centers worldwide).
  • Resend: sending email, such as the launch email and license emails (United States).
  • Exchange rates: the App requests rates for dates and currencies directly from public sources (European Central Bank via Frankfurter, or Korea Eximbank with your own key). No personal data is sent.

7. International transfers

The data we keep is stored and processed in the United States, and some providers listed above process it in other countries. We require each provider by contract to protect it and use it only to provide the Service.

For users in Japan (APPI)

  • Personal data is provided to the service providers in section 6, located in the United States (and, for Paddle, the United Kingdom).
  • The United States has no comprehensive federal privacy law. Protection comes from sector-specific federal laws, the Federal Trade Commission’s enforcement against unfair or deceptive practices, and state laws such as the California Consumer Privacy Act. The United Kingdom has the UK GDPR and is recognized by Japan’s Personal Information Protection Commission as having an equivalent level of protection.
  • Each provider is bound by contract to measures equivalent to those required by the Act on the Protection of Personal Information, including use limited to providing the Service, security controls, confidentiality and deletion. We check their measures at least once a year. You can ask for more information at privacy@paidwhere.com.

For users in Korea (PIPA)

  • The recipients, countries, items, purposes, timing, method and retention of each transfer, and how to refuse it, are listed in our Korean Privacy Policy at paidwhere.com/ko/privacy.

8. How long we keep data

  • Early-access list: until the apps launch and up to 12 months after, unless you unsubscribe sooner.
  • Account and license data: while your license is active and for up to 12 months after it ends, so you can reactivate it. Billing records are kept as long as tax law requires.
  • Page text sent for AI reading: not stored; it is discarded once the result is returned.
  • Forwarded mail: encrypted, until one of your computers picks it up and never longer than 7 days. Mail records (date, sender, subject, size, outcome): 12 months, or until you delete your account.
  • Shared between your computers: encrypted invoice details until the invoice is removed or the computer signs out; encrypted files until the other computer picks them up, never longer than 7 days.
  • Security and error logs: up to 90 days.

9. Your rights

Depending on where you live (including California and other US states, Korea, Japan, Australia and Hong Kong), you have the right to access, correct or delete your personal data, to restrict or object to its processing, to data portability, and to withdraw consent. Email privacy@paidwhere.com; we answer within 30 days. Your documents and ledger are on your computer, so you can view, copy or delete them yourself at any time.

You can complain to your local data protection authority. We will not treat you differently for exercising your rights.

10. Cookies and local storage

  • The public website does not use advertising or cross-site tracking cookies, so no cookie banner is shown. Your light/dark theme choice is kept in your browser’s local storage. Our network provider may set a strictly necessary security cookie.
  • If we add optional analytics, we will ask for consent first where the law requires it.

11. Security

Everything we receive travels over encrypted connections (TLS). Page text for AI reading is processed in memory and not written to storage. Access to the data we keep is limited to people who need it to run the Service. If a breach affects your personal data, we will notify you and the authorities as the law requires.

12. Children

Paidwhere is not meant for anyone under 18 and we do not knowingly collect their data.

13. Changes

We will tell you by email or in the App before material changes to this policy take effect.