Privacy
Updated: 6 October 2026
Operator and privacy contact
Hazem HokanKaule 85
51429 Bergisch Gladbach
Deutschland
hokan@koefman.de
Your account and letters
We process your email, account settings, language, uploaded pages, explanations, reply drafts, saved notes, related-letter links, dates and completion status to provide Papkram. Originals and results are stored in account-scoped private storage and database records. Support access may be needed to investigate a problem; letters are not public.
Why we process this data
Providing your account, analysis and saved correspondence is based on Article 6(1)(b) GDPR. Essential hosting, security, abuse prevention and technical logs are based on our legitimate interest in operating a reliable service, Article 6(1)(f). Optional analytics and the launch email use your consent, Article 6(1)(a). Without the required account and document data, we cannot provide these functions.
AI analysis
Uploaded pages and the correspondence relevant to your requested reply are sent to Google's paid Gemini API. Google states that paid-service inputs and outputs are not used to improve its products. Google may retain limited safety and security logs under its service terms. Papkram does not train AI models on your letters. Results can include quotes from the original; AI output can be wrong. It does not make decisions with legal effects on your behalf.
Service providers
Vercel hosts the app and handles web requests, including technical connection data. Supabase provides authentication, the database and private file storage. Google provides Gemini analysis. Resend sends welcome and optional launch emails; Supabase uses the configured email service for account recovery. PostHog receives optional usage analytics only after your cookie choice. Error diagnostics may use Sentry when configured. Each receives the data needed for its function.
Processing outside the EEA
These providers may process data outside the European Economic Area, including in the USA. Google's paid-service data processing terms provide transfer safeguards through applicable adequacy mechanisms or standard contractual clauses. Provider privacy and processing terms explain their locations, retention and safeguards; copies or further details can be requested from the contact above. We do not promise that all processing stays in Germany.
Cookies and optional emails
Essential cookies maintain sign-in, security and your language. Optional analytics starts only after consent and can be changed through cookie settings. The unchecked sign-up option requests one launch email, not an automatic newsletter subscription. Change this choice in Settings or withdraw it by email. Withdrawal does not affect earlier lawful processing or your access to the free pilot.
Retention and deletion
Saved letters and account data remain until you delete them, delete your account in Settings, or request deletion by email. There is no automatic expiry for inactive accounts. Security records, provider logs and backups can have separate retention periods; data required by law or needed for an unresolved claim may be retained for that purpose. Deleting a letter does not give back a used free analysis.
Payments
New purchases are disabled during the free pilot. If an existing Stripe customer or subscription record applies to your account, Stripe processes its billing information. Papkram stores identifiers and entitlement status, not card numbers. Activating future paid offers requires separate purchase information and your explicit order.
Your choices and rights
You may request access, correction, deletion, restriction and, where applicable, portability of your data. You may object to processing based on legitimate interests and withdraw consent. Contact hokan@koefman.de. You may complain to a data protection authority, including the LDI Nordrhein-Westfalen. Upload only documents you are entitled to use and redact information that is not needed, especially sensitive health, religion or other protected information.