Legal
Privacy Policy
Last updated September 2026
1. Information We Collect
PaperWorking collects information necessary to provide real estate investment project management, deal underwriting, and workflow automation. This includes account credentials (name, email), investment project parameters (property addresses, purchase price, rehab budgets, loan details, ledger transactions), uploaded transaction documents, and support inquiries.
2. Real Data Flows & Third-Party Subprocessors
We do not sell personal data. To deliver platform functionality, PaperWorking routes data strictly through the following verified subprocessors and service providers:
Plaid Technologies, Inc. (Banking & Liabilities)
When you connect a financial institution, Plaid retrieves account balances, transactions, and mortgage liabilities to automate holding cost tracking and debt servicing. Access tokens are envelope-encrypted using AES-256-GCM with KMS-managed keys. PaperWorking never sees or stores your bank login credentials. Use of this integration is subject to the Plaid End User Privacy Policy (https://plaid.com/legal/#end-user-privacy-policy).
RentCast (Property & Rent Valuation)
When underwriting deals, property addresses are queried against RentCast to obtain public record attributes, automated valuation models (AVMs), rent estimates, and comparable sales. Query responses are normalized and cached in Neon PostgreSQL (30-day TTL for estimates, 24-hour TTL for comps) to minimize external data sharing.
Google Maps & Places (Address Verification)
Address autocomplete and geocoding utilize Google Places APIs using session tokens. Address queries are processed under Google’s privacy standards and displayed with Google attribution.
SendGrid / Twilio (Transactional Email)
We use SendGrid exclusively for transactional notifications: account verification, project collaborator invitations, deal status alerts, and password resets. We do not provide customer contact lists for third-party marketing.
AI Assistant ("Pepper") & Model Providers
The Pepper support assistant provides grounded answers retrieved from PaperWorking public FAQs and glossaries. User queries are filtered to redact email addresses and personal data before processing. Pepper does not provide investment or legal advice.
Stripe, Inc. (Payment Processing)
Subscription billing and payment management are processed through Stripe under PCI-DSS Level 1 compliance. Credit card numbers, expiration dates, and CVVs are handled directly by Stripe and never stored on PaperWorking infrastructure.
Cloud Infrastructure (GCP & Neon)
Application services, databases, and secure document vaults are hosted on Google Cloud Platform (us-central1) and Neon Serverless PostgreSQL. All data is encrypted in transit via TLS 1.3 and at rest via AES-256.
3. Telephone Numbers & Support Call-Backs (Strict Zero SMS Policy)
When you submit a telephone number via our Support Call-Back form, you consent to receive a one-time telephone call-back from PaperWorking support staff regarding your inquiry. PaperWorking does not send marketing text messages, nor do we operate automated SMS broadcasting. Phone numbers are stored with timestamped consent solely for transactional customer support.
4. Bank Disconnection & Data Retention
You may disconnect your bank account at any time from Settings → Data & Privacy or Bank Connections. Disconnecting triggers an immediate call to Plaid’s /item/remove endpoint, hard-deletes the access token and per-item encryption key, and purges or anonymizes derived transaction data according to our retention policy.
5. Account Deletion, Crypto-Shredding & Data Rights (DSR)
In accordance with GDPR (Art. 15, 17), CCPA/CPRA, and ~20 US state privacy laws, you have comprehensive rights to access, export, and erase your data. Underwriting snapshots are engineered with cryptographic immutability: when you export your data (Art. 15), you receive your deal history with SHA-256 seal hashes and command-line verification instructions to prove projection integrity to lenders and partners. When you exercise your right to erasure (Art. 17), your personal Data Encryption Key (DEK) is destroyed (crypto-shredding), permanently rendering property addresses mathematically unrecoverable, while identity mapping links are severed. The remaining anonymous snapshot shells preserve formula integrity without personal identification. Statutory closing settlement and tax basis documents are preserved for 3 years pursuant to 26 U.S.C. § 6001, after which they are permanently purged.
6. Cookies & Session Management
PaperWorking uses essential first-party session cookies (__session, __acct, __sub) required for authentication, CSRF mitigation, and multi-tenant routing. Analytics cookies are optional and disabled by default.
Questions? Contact us