Last updated: 2026-05-10

PaperJSX Privacy Policy

Effective: May 10, 2026

Summary

PaperJSX is local-first by design. Installing or running PaperJSX packages locally or in CI does not send your source code, generated documents, document contents, or build artifacts to us unless you use a hosted PaperJSX feature, online license service, support channel, or integration that transmits data to us. We collect account, license, billing-administration, support, security, and limited usage data needed to operate PaperJSX. We do not sell personal data and do not share it for cross-context behavioral advertising.

This summary is not legally binding. The full Privacy Policy below controls.

1. Who we are

PaperJSX is operated by The Plain Works Co., Ltd. (주식회사 더플레인웍스), a Korean company. This Privacy Policy explains how we handle personal data for visitors to paperjsx.com, account holders, license holders, package users who interact with PaperJSX services, contributors, support contacts, and people whose data is submitted to PaperJSX hosted features.

When we process Customer Personal Data on behalf of a customer, the DPA applies and overrides this Privacy Policy for that processing.

2. Categories of data we collect

Account Data

We collect account and relationship information such as name, email address, organization name, role, workspace or organization membership, authentication data, login records, plan, entitlement status, and communication preferences.

License and entitlement data

For commercial access, we collect data needed to issue, manage, validate, revoke, renew, and support licenses, including license identifiers, entitlement records, package access records, subscription status, organization identifiers, license-key hashes or truncated identifiers, validation outcome, package name and version, request timestamps, IP address, user agent, and environment metadata necessary to troubleshoot license issues.

License validation is not intended to collect your generated documents, source code, document contents, or build artifacts.

Website, documentation, and usage data

When you visit the website, documentation, account portal, or hosted features, we collect request logs, IP address, user agent, browser and device information, pages viewed, referrer, timestamps, feature events, error events, performance data, and security logs.

Customer Content

We process Customer Content only when you send it to us or use a feature that sends it to PaperJSX systems. Customer Content may include code snippets, document definitions, generated documents, templates, files, prompts, examples, support attachments, and hosted-rendering inputs.

Local or CI use of PaperJSX packages does not give us access to Customer Content unless you transmit it to us.

Payment data

Paddle processes payments as merchant of record or authorized reseller. Paddle may collect billing name, billing email, billing address, tax information, payment method data, and transaction data. We receive transaction identifiers, product, plan, subscription status, renewal status, tax jurisdiction, invoice metadata, and limited buyer contact information. We do not receive full card numbers or bank account credentials.

Support and communications

If you contact us, we collect your contact details, message content, attachments, diagnostic information you choose to provide, and records of our responses.

Contributor data

If you contribute through GitHub, npm, email, or another public platform, we may process your username, public profile, commit metadata, issue comments, pull requests, reviews, and contribution history. Public contribution activity may remain public according to the platform’s terms and repository history.

3. How we use data

We use data to:

provide, maintain, secure, and improve PaperJSX;
create and manage accounts, licenses, entitlements, package access, and subscriptions;
validate commercial licenses and prevent license abuse, fraud, and unauthorized redistribution;
provide documentation, support, troubleshooting, and security notifications;
process purchases, renewals, cancellations, refunds, invoices, and tax records through Paddle;
monitor performance, errors, abuse, and security events;
communicate service updates, product announcements, and marketing where permitted;
comply with legal obligations and enforce our Terms, License Policy, and rights;
analyze aggregated or de-identified Service Data that does not identify a customer, user, or individual.

4. Legal bases for EEA, UK, and Swiss users

Where GDPR, UK GDPR, or Swiss FADP applies, we rely on:

contract performance to provide accounts, subscriptions, license access, hosted features, support, and transactional communications;
legitimate interests to secure PaperJSX, prevent abuse, validate entitlements, improve the Service, maintain business records, and send non-promotional product updates;
consent where required for marketing emails or non-essential cookies;
legal obligation for tax, accounting, compliance, and lawful requests;
customer instructions under the DPA when we process Customer Personal Data as a processor.

5. Local-first package use

PaperJSX packages may run locally, in your development environment, or in CI/CD. Local or CI execution does not automatically transmit generated documents, source files, document contents, build artifacts, or customer data to us.

The following interactions may transmit data to us:

signing in to a PaperJSX account;
purchasing, renewing, or managing a commercial subscription;
receiving or validating a commercial license or accessing account documentation;
validating a license key or license certificate through a PaperJSX license service;
using hosted playgrounds, hosted rendering, template hosting, cloud compilation, or other hosted features;
sending logs, examples, generated files, source snippets, or attachments to support;
enabling optional telemetry, analytics, or integrations.

6. AI processing

PaperJSX does not include AI processing by default in this policy. We do not use Customer Content to train AI models. If we add an AI-enabled feature that sends Customer Content to an AI provider, we will update this Privacy Policy and the Subprocessors page before using that provider for Customer Content.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising.

We share data with service providers that help operate PaperJSX. The current list is maintained at paperjsx.com/legal/subprocessors. We require processors that handle personal data for us to commit to appropriate confidentiality, security, and data-protection obligations.

We may also disclose data:

to Paddle for payment and billing operations;
to GitHub, npm, package registries, CI/CD providers, or other third-party platforms when you choose to use them;
to comply with law, court orders, legal process, or lawful government requests;
to protect rights, security, users, and the Service;
in connection with a merger, acquisition, financing, reorganization, or sale of assets;
with your consent or instructions.

Paddle, GitHub, npm, and customer-controlled integrations may act as independent controllers or independent platform providers under their own terms and privacy notices.

8. International transfers

We are based in the Republic of Korea. Data may be processed in Korea, the United States, the European Economic Area, and other countries where our subprocessors operate.

Where required for transfers from the EEA, UK, or Switzerland to countries without an adequacy decision, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, the UK International Data Transfer Agreement, Swiss transfer adaptations, or other lawful transfer mechanisms. The DPA describes transfer safeguards for Customer Personal Data.

For Korean users, cross-border transfer details are provided in this Privacy Policy and the Subprocessors page.

9. Retention

We retain personal data only as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required by law.

Data category	Retention
Account Data	While the account is active, then generally up to 90 days after deletion unless needed for legal, security, billing, or dispute purposes
License and entitlement records	During the subscription or entitlement term, then generally up to 7 years for billing, audit, fraud-prevention, tax, and dispute records
License-validation logs	Generally up to 24 months, unless needed longer for security, abuse prevention, billing disputes, or legal obligations
Customer Content in hosted features	During the active feature term and deletion/export period stated in the product or Order Form, then deleted or anonymized
Support messages and attachments	Generally up to 36 months after the last interaction, unless needed longer for legal, security, or dispute purposes
Website and security logs	Generally up to 90 days, unless needed longer for security, abuse prevention, or legal obligations
Analytics data	Generally up to 24 months in pseudonymous or aggregated form
Billing and tax records	As required by applicable tax and accounting law, generally 5 to 10 years
Aggregated or de-identified data	May be retained indefinitely if it does not identify a customer, user, or individual

Backups are encrypted and deleted on a rolling schedule. Data deleted from live systems may remain in backups until the backup expires.

10. Your rights

Depending on where you are located, you may have rights to access, correct, delete, restrict, object to, or export your personal data, withdraw consent, opt out of marketing, or lodge a complaint with a regulator.

To exercise rights, email privacy@paperjsx.com. We may need to verify your identity before fulfilling a request. If your request concerns Customer Personal Data that we process on behalf of a customer, we may refer the request to that customer or process it according to that customer’s instructions.

11. California privacy notice

We do not sell personal information and do not share personal information for cross-context behavioral advertising. We do not knowingly sell or share personal information of consumers under 16.

California residents may request to know, access, correct, delete, or receive a copy of personal information, and may opt out of sale or sharing. Because we do not sell or share personal information for cross-context behavioral advertising, we do not provide a separate sale/share opt-out. We honor Global Privacy Control signals as described in the Cookie Policy.

We will not discriminate against you for exercising privacy rights.

12. Korean PIPA notice

We are subject to Korea’s Personal Information Protection Act where applicable.

Personal Information Protection Manager (개인정보 보호책임자): Jake Kim (김진용), Representative Director.
Contact: privacy@paperjsx.com.
Purposes, categories, retention, and transfers: described in this Privacy Policy and the Subprocessors page.
Complaints: Korean residents may also contact the Personal Information Protection Commission or the KISA Personal Information Infringement Report Center.

13. Cookies and similar technologies

Our Cookie Policy explains cookies, localStorage, sessionStorage, analytics, and Global Privacy Control handling. We do not use third-party advertising cookies.

14. Security

We use technical and organizational measures designed to protect personal data, including encryption in transit, access controls, monitoring, vulnerability management, and incident response. The Security Overview provides more detail.

No system is perfectly secure. Report suspected vulnerabilities to security@paperjsx.com.

15. Children

PaperJSX is intended for business and developer use by people at least 18 years old. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, email privacy@paperjsx.com.

16. Changes

We may update this Privacy Policy. We will post the updated version and notify affected customers of material changes by email or in-product notice at least 30 days before they take effect, unless legal, security, or platform requirements require faster action.

17. Contact

The Plain Works Co., Ltd. (주식회사 더플레인웍스) Cheonan, Chungcheongnam-do, Republic of Korea

Privacy: privacy@paperjsx.com Legal: legal@paperjsx.com Support: support@paperjsx.com

paperjsx.com

Privacy Policy