Privacy & Data Security Notice

The controller responsible for the personal data described in this notice, and full contact details, are listed in our Imprint.

When you use PaperPulse, we process:

• Your email address
• The topics and keywords you choose for your newsletter(s)
• Your chosen delivery day, time, and time zone
• Your plan and billing status, and — if you subscribe to a paid plan — a Stripe customer reference; we never see or store your card details, which Stripe collects directly
• Your referral code, if you use one
• Records of which papers were delivered to you, used to power your dashboard statistics
• Engagement events (opens and clicks) derived from signed links in your digest emails
• Feedback you send us
• If you ask to be notified when paid features become available: your email address, used solely for that one-time launch notification

We process this data on the following legal bases:

• Art. 6(1)(b) GDPR — to provide the newsletter service you signed up for, including confirming your subscription by email (double opt-in)
• Art. 6(1)(f) GDPR — our legitimate interest in maintaining aggregate usage statistics and preventing abuse, such as rate limiting
• Art. 6(1)(b) and (c) GDPR — to process payments and meet billing and accounting obligations

We share data with the following processors and recipients, only as needed to run the service:

• Mailgun (EU region) — to deliver newsletter and account emails
• Stripe — to process payments, if you subscribe to a paid plan
• Slack — only if you (Plus plan and above) add your own Slack webhook; your digest is then posted to your Slack workspace
• OpenAlex — queried using topic terms only, never personal data, to retrieve scholarly paper metadata
• An AI text service — sent paper titles and abstracts to generate summaries and audio digests, and the interest description you type when requesting topic suggestions; never other subscriber data
• Our hosting provider, Hetzner (Germany)

Mailgun processes newsletter email within the EU region. Stripe may process payment data outside the EU/EEA under its own contractual safeguards. Our AI text service provider processes the topic-suggestion text you type in Switzerland (exceptionally within the EU/EEA); the European Commission recognises Switzerland as providing an adequate level of data protection. We do not otherwise transfer personal data outside the EU/EEA.

Usage events, such as page views, are deleted after 180 days. Records of which papers were delivered to you are kept to power your dashboard statistics. If you unsubscribe or request deletion, your subscriber record is removed and your email address is anonymised in any stored events that remain. Audio versions of digests are deleted after 30 days. Database backups are kept for 14 days, so deleted data disappears from them within that period. The scholarly-paper metadata cache we maintain is reference data, not personal data, and is kept indefinitely.

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Request erasure of your data
• Restrict processing
• Receive your data in a portable format
• Object to processing based on legitimate interest
• Withdraw consent at any time, without affecting processing carried out before the withdrawal
• Lodge a complaint with a data protection supervisory authority, such as the one responsible for the operator's federal state (Land)

To exercise any of these rights, contact us using the details in our Imprint. Unsubscribing or deleting your account is also available directly from your dashboard at any time.

We do not use third-party trackers, advertising networks, or third-party analytics. Fonts are self-hosted rather than loaded from a third-party font host. Your dashboard, unsubscribe, and billing links use a signed link rather than a cookie. If our operator is signed in to the admin dashboard, one strictly necessary session cookie is set for that admin account only — ordinary visitors and subscribers are never given a cookie.

We may update this notice from time to time. Last updated: 12 October 2026.