Paperline

Paperline Privacy Policy

Effective date: November 1, 2026

DAYLAB (the "Company") operates the Paperline mobile app (iOS, bundle ID: dev.daylab.paperline). This policy applies to users worldwide, including the EU, EEA and UK.

1. Purposes of processing

Category Purpose
Document conversion Reading the photos and PDFs you choose and returning them as Excel, Word, PDF or text files
Free and remaining pages Counting each device's 3 free pages and purchased pages, and preventing repeated abuse of free pages
Completion notice Notifying you when a conversion finishes while the app is closed
RevenueCat Verifying page pack purchases, restoring purchases and applying refunds
Problem reports Reviewing what you send through "Report a problem" in the app and fixing errors

2. Data we process

The Company offers no sign-up or login and does not collect names or phone numbers. We do not process GPS location, contacts, microphone, sensitive data or pseudonymized data. The app contains no advertising or analytics SDKs.

Category Data Storage and transfer
Documents to convert The photos and PDFs you take or choose, and the text and tables in them Sent to the Company's server (Seoul, Republic of Korea) when you convert; the server sends them to Google Cloud Vertex AI (Gemini models) to read the text
Conversion results The Excel, Word, PDF and text files produced, and job status Kept in the Company's storage (Google Cloud Storage, Seoul) for 1 day, then deleted automatically
On-device records Original photos you chose, the recent files list and files, app settings Stored only on your device
Device ID A random ID created when the app first runs (unrelated to device model or advertising ID) Sent to the Company's server and RevenueCat with conversion and purchase requests
Page records Free pages used per device ID Company database (Supabase, Seoul)
IP address The IP address when a new device is first seen, and that day's count of new devices Kept in the Company database for that day only
Notification token Apple push notification token (if you allow notifications) Kept with the conversion job status for 1 day; used to send notifications through Apple
RevenueCat Device ID, product ID, transaction ID, purchase date, price and currency, store receipt, OS type and version, app version, country/store region, IP address Sent to RevenueCat
Problem reports Report type, what you write, your email if you enter one, screen name and its state at the time (format, page count, etc.), app version, device type, device ID Sent to Google Forms only when you send a report. Does not include document contents or photos

3. Reading documents with AI

The text and tables in your photos are read by Google Cloud Vertex AI (Gemini models). The Company sends only the photos and PDFs needed for conversion. Under the Google Cloud terms, Google processes this data only on the Company's instructions and does not use it to train AI models. However, Google may cache requests for up to 24 hours to speed up responses, and may log some requests for abuse monitoring for the period set by its own policies. Original photos stay in the Company's server memory only while being converted (up to 30 minutes) and are not stored. By tapping Convert, you agree to this processing. If you do not want it, do not convert.

4. Children under 14

The service is not directed at children under 14, and we do not knowingly collect their personal data. If we learn of it, we delete it without delay. In the EU, national digital consent ages (13–16) may apply.

5. Retention periods

Category Retention
Original photos (server) While converting, up to 30 minutes
Conversion results, job status, notification token (server) 1 day
On-device records Until you delete them or delete the app
Device ID, page records While the service is provided; deleted on request
IP address That day only
RevenueCat While the purchase relationship continues, then for the period required by law (Korean E-Commerce Act: payment and supply records 5 years, consumer complaint and dispute records 3 years)
Problem reports 1 year after handling

6. Deletion

Original photos, conversion results, job status and IP addresses on the server are deleted automatically when the periods above end. Original photos you chose can be deleted with "Remove all" in the app, and everything including recent files is deleted when you delete the app. Device IDs, page records and problem reports are deleted on request. RevenueCat data follows that company's retention and deletion procedures.

7. Provision to third parties

The Company does not provide personal data to third parties, except where required by law.

8. Processors

Processor Service
Google LLC (Google Cloud) Server operation (Cloud Run), temporary storage of conversion results (Cloud Storage), AI document reading (Vertex AI)
Supabase, Inc. Database for per-device page records
RevenueCat, Inc. Page pack purchase verification, purchase restoration and related processing
Apple Inc. Delivery of completion notices (Apple Push Notification service)
Google LLC (Google Forms) Receiving problem reports

Payment method details are handled by the Apple App Store under its own policies; neither the Company nor RevenueCat receives them.

9. International transfers

When you convert, purchase, receive notifications or send a problem report, the data below is transmitted over TLS-encrypted connections. The Company's server and database are in Seoul, Republic of Korea, but Vertex AI may read documents at any of Google's processing locations worldwide. For users in Korea, the legal basis is Article 28-8(1)(3) of the Personal Information Protection Act (outsourcing and storage necessary to perform the contract with the data subject, disclosed in this policy). For EU, EEA and UK users, we rely on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.

Recipient Country / contact Data When and how Purpose Retention How to refuse and effect
Google LLC (Vertex AI) USA and other Google processing locations / https://support.google.com/policies/contact/general_privacy_form Photos and PDFs to convert TLS transfer when you tap Convert Reading the text and tables Not retained by the Company. Google caches for up to 24 hours; abuse-monitoring logs follow Google's policy Nothing is sent if you do not convert, but you cannot use conversion
RevenueCat, Inc. USA / privacy@revenuecat.com RevenueCat items in Section 2 TLS transfer at app launch, payment and restore Processing page pack payments Same as Section 5 You may choose not to purchase and use only the free pages
Apple Inc. USA / https://www.apple.com/legal/privacy/contact/ Notification token, notification text TLS transfer when a conversion finishes Delivering completion notices Per Apple's policy Nothing is sent if you do not allow notifications
Google LLC (Google Forms) USA / https://support.google.com/policies/contact/general_privacy_form Problem report items in Section 2 TLS transfer when you send a report Receiving and fixing errors 1 year after handling Nothing is sent if you do not send a report

10. Device permissions

Permission When and why If refused
Camera When you scan a document You can still convert by choosing from Photos or Files
Photos When you choose photos (only the chosen photos are read) You can still convert using the camera or Files
Notifications To tell you a conversion has finished You can use the service without notifications

You can change permissions at any time in your device settings.

11. Your rights

You may request access, correction, deletion, suspension of processing and withdrawal of consent. Users covered by the GDPR also have the right to data portability, the right to object to processing and the right to lodge a complaint with a supervisory authority. Deleting the app removes all on-device records. For other requests, contact contact@daylab.dev or +82-505-007-7703. Because there are no accounts, to find your server records we may ask you to send the request through "Report a problem" in the app (which includes your device ID) or to give us your store order number.

12. Security measures

All transfers are encrypted with TLS. Access to server storage and the database is limited to the tasks that need it, and conversion results are set to be deleted automatically after one day.

13. Automatic collection

The app does not use web cookies. The RevenueCat SDK (react-native-purchases) sends the items needed for payment processing. The app contains no advertising, analytics or crash reporting SDKs (Google Analytics, Firebase, Meta, Sentry, PostHog, etc.). The website (https://paperline.daylab.dev) uses no cookies or analytics tools.

14. Behavioral data and targeted advertising

The app has no advertising, does not collect or use behavioral data for targeted advertising, and does not track you across other companies' apps or websites.

15. Automated decisions

AI is used only to read the text and tables in documents. The Company does not make automated decisions or profiling that produce legal effects or similarly significant effects on you.

16. Sensitive and pseudonymized data

The Company does not process sensitive or pseudonymized data. Documents you choose to convert may contain sensitive content, so do not convert documents you do not want processed. The Company does not view or use document contents for any purpose other than conversion.

17. Legal bases under the GDPR

Processing Legal basis
Document conversion, page management, purchases, completion notices Performance of a contract (GDPR Art. 6(1)(b))
Statutory record keeping Legal obligation (GDPR Art. 6(1)(c))
Preventing free page abuse (IP address) Legitimate interests (GDPR Art. 6(1)(f))
Problem reports Handling a request you sent (GDPR Art. 6(1)(b))

18. Privacy officer

Name Title Contact
Dasong Sim Representative contact@daylab.dev · +82-505-007-7703

19. Remedies

You may report or seek advice on privacy infringements from the authorities below. EU residents may also lodge a complaint with the supervisory authority in their country.

Authority Website Phone
Personal Information Infringement Report Center (KISA) privacy.kisa.or.kr 118 (in Korea)
Personal Information Dispute Mediation Committee www.kopico.go.kr 1833-6972
Personal Information Protection Commission www.pipc.go.kr -
Supreme Prosecutors' Office Cyber Investigation Division www.spo.go.kr 1301 (in Korea)
Korean National Police Agency Cyber Bureau ecrm.police.go.kr 182 (in Korea)

20. Changes to this policy

The Company announces changes in the app or on the web 7 days before they take effect, and important changes 30 days before.

Version Effective date Changes
1.0 November 1, 2026 First version

21. Business information and governing language

Item Details
Business name DAYLAB (데이랩)
Representative Dasong Sim
Business registration no. 401-23-55110
Mail-order business report no. 2026-Seoul Seocho-0911
Address 704, 5F, Intech Building, 512 Yeoksam-ro, Gangnam-gu, Seoul, Republic of Korea
Phone +82-505-007-7703
Inquiries and privacy contact@daylab.dev

This policy is provided in several languages for your convenience. If the versions differ, the Korean version prevails.