Privacy Policy

This policy explains how HiggsCredit Technologies (“we”, “us”) handles personal data when you use PenPaper AI — the website at penpaperai.com, the web app at app.penpaperai.com, the desktop and mobile apps, and PenPaper AI on WhatsApp (together, the “Service”). We process personal data in line with India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules. For this policy we are the “Data Fiduciary”.

1. What we collect

• Account details — your email address, and optionally a name, username and phone number (for WhatsApp and reminders).
• What you give the agent — your chats, voice notes, files and screenshots you upload, bank or card statements you import, facts you ask it to remember, reminders, goals and tasks.
• Connected apps — when you connect an app such as Gmail or Google Calendar, the data the agent reads from it to do what you asked (for example, order and bill emails to build your spending dashboards). You choose which apps to connect and can make any app read-only or disconnect it at any time.
• Location and time zone — the city you set or your device’s location, used to get dates, local times, weather and nearby places right.
• Payments — if you subscribe, our payment processor (Razorpay) handles your card or UPI details. We receive only the payment status, plan and a reference — never your full card number.
• Technical data — signed-in devices and sessions, IP address, app version, error logs and usage counts (for example, messages per day) used to run, secure and bill the Service.

2. Why we use it

• To provide the Service: answer you, carry out the tasks you ask for, keep your dashboards, reminders and memories, and sync them across your devices.
• To keep you in control: every send, payment, booking and deletion waits for your approval, and every action is recorded in your activity log.
• To keep the Service and your account secure, prevent abuse, and fix problems.
• To manage your subscription and meet our legal, tax and accounting obligations.
• To send you service messages you asked for (sign-in codes, reminders, notifications). We send marketing only if you opt in.

We rely on your consent for processing your content and connected apps, which you can withdraw at any time, and on legitimate uses permitted by law for security, billing and legal compliance.

3. AI models and who we share data with

To answer you, the relevant parts of your conversation and data are sent to AI model providers, which process it on our behalf. Paid plans use providers, such as Anthropic, that do not use API data to train their models. On the Free plan, some answers may come from providers whose free tiers can use content to improve their models — the app says so under the chat box. Don’t share anything on the Free plan that you wouldn’t want used that way.

We also use these service providers, only for running the Service:

• Microsoft Azure (application hosting and file storage) and Neon (database) — servers in the United States.
• Cloudflare (website, downloads and network security).
• Resend (sign-in code and notification emails).
• Meta WhatsApp Business Platform (if you chat or get reminders on WhatsApp).
• Composio (secure connections to the apps you choose to connect).
• Razorpay (payments), plus search and map services used to answer your questions.

We do not sell your personal data, and we do not share it with advertisers. We may disclose data if the law requires it, to protect people from harm, or as part of a merger or acquisition, in which case this policy continues to apply.

4. Where your data is stored

Your data is stored and processed outside India, mainly in the United States, by the providers above. We transfer data only to countries not restricted by the Government of India and require providers to protect it.

5. How we protect it

• Encryption in transit (HTTPS) and for stored secrets such as your own API keys.
• Sign-in with one-time email codes, sessions you can see and sign out of from any device.
• Sentinel, our safety layer: hidden instructions in web pages, emails and files are removed before the AI reads them, one-time passwords and password-reset links in your mail are masked from the agent, and nothing is sent or paid without your approval.

No system is perfectly secure. If a breach affects your personal data we will tell you and the Data Protection Board of India as the law requires.

6. How long we keep it

We keep your data while your account is active. When you delete your account (Settings → Security and login → Delete account), we delete your chats, memories, files and records from our systems within 30 days, except what we must keep by law (for example, payment and tax records). Backups roll off on their normal cycle.

7. Your rights

• Access and download your data — Settings → Export data.
• Correct or update it, or ask the agent to forget a memory.
• Delete your account and data.
• Withdraw consent — disconnect apps, turn off features, or stop using the Service.
• Nominate a person to exercise your rights if you die or become unable to.
• Raise a grievance with us, and then with the Data Protection Board of India.

8. Children

PenPaper AI is meant for people aged 18 and over. A child may use it only with the verifiable consent and supervision of a parent or lawful guardian, for example through a parent’s account with parental controls turned on. We do not track children or target advertising at them.

9. Cookies

The website’s use of cookies is explained in our Cookie Policy.

10. Grievance Officer and contact

For any question, request or complaint about your personal data, write to our Grievance Officer at support@penpaperai.com. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.

11. Changes

We will update this page when our practices change and tell you in the app or by email about significant changes before they take effect.