Privacy Policy

This Privacy Policy explains how Indulgy Inc. ("Indulgy", "we", "us"), operator of PaperChase.HELP ("PaperChase", the "Service"), handles personal data. It covers our marketing site, the accounts of subscribing firms ("Firms"), and the documents that Firms' clients ("Clients") submit through the Service.

1. Our roles: controller and processor

• For our marketing site and Firm-account data (e.g. visitor inquiries, account registration, billing), Indulgy is the controller.
• For Client documents and the data extracted from them, the Firm is the controller and Indulgy is a processor acting on the Firm's instructions. If you are a Client, please direct privacy requests to the Firm you are working with; we will assist them.

2. Data we collect

• Contact & inquiries — name, firm, email, and message you send via our contact form.
• Firm account — name, email, organization, and authentication data of registering users.
• Client submissions — documents and the information extracted from them, processed on a Firm's behalf.
• Billing — subscription and usage records; card details are handled by our payment processor, not stored by us.
• Technical & usage — log data, device/browser information, and limited analytics needed to operate and secure the Service.

3. How we use data

To provide, secure, and improve the Service; to communicate with Firms about their accounts; to respond to inquiries; to process payments; and to comply with legal obligations. We do not sell personal data. We do not use Client documents to train general-purpose AI models.

4. How contact data reaches us

When you submit our contact form, the message is delivered to an internal team channel so we can respond. PaperChase never initiates first contact with a Client — communications are always in response to an inbound request or to an already-engaged, opted-in relationship.

5. Service providers (subprocessors)

We use vetted providers to operate the Service, including cloud hosting and storage, payment processing, document extraction, communications delivery (email, SMS, voice, chat), and internal notifications. Each is bound to appropriate confidentiality and data protection terms. A current list of subprocessors is available on request.

6. Security

All Client data is encrypted at rest and isolated per Firm; no Firm can access another Firm's data. We decrypt only transiently and in-process to run extraction or to serve a document to an authorized person. No Indulgy staff has standing access to decrypted Client data; any exceptional operator access is individually justified, time-boxed, and logged to an immutable audit record.

7. Retention & deletion

• Real deletion. When content is deleted — by request, offboarding, or retention expiry — it becomes provably unrecoverable within a bounded window, including from backups and replicas.
• Surviving record. A redacted audit skeleton may be kept to prove an event occurred (e.g. that a document was received and later deleted) without retaining the document or personal data.
• Legal hold & retention floors. Data under a legal or regulatory hold, or subject to a mandated retention period, is kept until the hold lifts or the period ends.
• Commercial lapse. A Firm's non-payment never instantly destroys a Client's data; access is suspended, a retention window follows, and an explicit notice precedes any deletion.

8. Your rights

Depending on your location, you may have rights to access, correct, delete, or port your personal data, or to object to or restrict certain processing. A Client can always access their own submitted data within a Firm relationship. To exercise rights regarding data we control, contact us below; for Client documents, contact the relevant Firm and we will support them.

9. International transfers

We may process data in the United States and other countries. Where required, we use appropriate safeguards for cross-border transfers. Data residency may be configured per Firm or vertical.

10. Cookies

Our marketing site uses only the cookies and similar technologies needed to function and to understand aggregate usage. We do not use them to build advertising profiles.

11. Children

The Service is intended for use by firms and their clients, not by children, and is not directed to children under the age defined by applicable law.

12. Changes to this policy

We may update this policy; material changes will be notified through the Service or by email, and the "last updated" date above will change.

13. Contact

Indulgy Inc. — privacy questions and requests: privacy@paperchase.help.