Privacy policy

1. Data controller

The data controller is the publisher of the Website, a private individual acting in a non-professional capacity (see the legal notice). For any question about your data: .

This policy is written in accordance with Regulation (EU) 2016/679 of 27 April 2016 (the “GDPR”) and the amended French Data Protection Act No. 78-17 of 6 January 1978.

2. Files and data processed by the tools

The Papetal tools run entirely in your browser, using JavaScript programs downloaded with the page. The files you open (PDFs, photos, scans, ID documents…), the signatures you draw and the text you type:

• are never transmitted to the publisher, the hosting provider or any third party;
• are only used to display the preview and produce the file you download;
• are only kept on your device, and only in the cases described below (history, templates, remembered signatures).

The publisher therefore does not process this data in any way. You can check this yourself: once the page has loaded, the tools work even without an internet connection.

3. Cookies and local storage

The Website sets no cookies.

Some features save information in your browser’s storage, on your device only:

• File history (IndexedDB): a copy of the files you create, so you can download them again. You can delete each file, clear everything or turn history off from the History page. It is limited to 60 files; the oldest are deleted automatically.
• Your letter templates, remembered signatures, sender details and photo report draft (localStorage): only if you create them or tick the matching option.
• Preferences: light or dark theme (key theme) and whether history is enabled.

This information is never transmitted and cannot identify you. As it is strictly necessary for features you explicitly requested, it does not require consent. You can delete it at any time from the Website or by clearing your browser data.

4. Hosting provider’s technical logs

As with any website, when you visit the Website, the hosting provider’s server automatically records certain technical data in its access logs: IP address, date and time of the request, requested page, response code, browser type and referring page.

• Purposes: keeping the Website running and secure, preventing abuse and attacks, troubleshooting incidents.
• Legal basis: the publisher’s legitimate interest in securing the Website (Article 6(1)(f) GDPR) and the hosting provider’s legal obligations.
• Recipient: LWS (Ligne Web Services), hosting provider, acting as a processor. The publisher only looks at these logs when needed for technical or security reasons and never uses them for statistical or commercial purposes.
• Retention period: a limited period set by the hosting provider in accordance with its legal obligations.
• Location: the servers are located in France; no data is transferred outside the European Union.

5. No third-party services

All the Website’s resources (fonts, icons, scripts) are hosted on the Website itself. No external service is contacted during your visit: no Google Fonts, no CDN, no analytics, no social media buttons, no advertising.

Some pages contain links to third-party websites (for example, Iris QR, our sister website, in the footer). These are plain links: no button, script or tracker from these services is embedded in the Website. These websites are only contacted if you click the link, in which case their own privacy policy applies.

6. If you write to us

If you contact the publisher by email, your address and the content of your message are used only to reply to you (legal basis: legitimate interest in handling your request). They are kept for as long as needed to handle your request, then for no more than three years after the last exchange, and are never shared with third parties.

7. Your rights

Under the GDPR and the French Data Protection Act, you have the right to access, rectify, erase, restrict and object to the processing of your data, the right to data portability, and the right to set instructions regarding your data after your death.

To exercise these rights, write to . You will receive a reply within one month. Please note that since the publisher collects no identifying data, it may be unable to find you in the technical logs (Article 11 GDPR).

If, after contacting us, you believe your rights have not been respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at cnil.fr, or with the supervisory authority of your country of residence.

8. Security

The Website is served exclusively over HTTPS and applies strict security headers (Content Security Policy, HSTS) that, among other things, prevent external scripts from being loaded.

9. Changes

This policy may be updated, in particular if the Website or regulations change. The date of the last update is shown at the top of this page.