Privacy Notice

What we use, why we use it, and how long we keep it.

Last updated: 19 July 2026. Notice version: privacy-notice-2026-07-19-private-data-boundary. This notice covers visitors, account holders and people who contact Paper Tiger.

Core service data

Account and study data are used to provide the service you ask for. Terms acceptance is not consent to optional analytics.

Optional analytics

Analytics stay off unless you consent. You can change your choice in Settings without losing the core service.

Temporary raw inputs

Paper Tiger does not save raw voice recordings, handwriting images or uploaded source files after the request.

Who is responsible for your data

Paper Tiger Learning Technologies Ltd is the controller for the processing described here.

Paper Tiger is operated by Paper Tiger Learning Technologies Ltd, a company registered in England and Wales under company number 17308917. Registered office: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.

167-169 Great Portland Street5th FloorLondonW1W 5PF

For privacy questions or requests, email hello@paper-tiger.co.uk. This mailbox is monitored.

Accounts are for learners aged 16 or over. Every purchaser must be aged 18 or over. Do not create or use an account if you are under 16.

For account holders aged 16 or 17

Paper Tiger asks you to confirm that you are at least 16. We do not ask for your date of birth or exact age, and we apply the relevant privacy safeguards to every learner account. If you are 16 or 17, an adult must complete any purchase.

The learning account belongs to the learner. If an adult pays for access, Stripe processes their payment and Paper Tiger records the transaction and adult-purchaser declaration. Paying does not give that adult access to the learner's answers, transcripts, progress or messages. Paper Tiger would disclose account information only where the learner asks us to, the law requires it, or a serious safeguarding or security situation makes disclosure necessary and lawful.

Optional analytics are off by default. Paper Tiger does not sell or license identifiable learner data, use learner content to train its own or another provider's general-purpose AI models, disclose learner profiles to employers, use behavioural advertising, or run exam proctoring. It may use properly anonymised statistics about broad patterns, but not a learner's transcript, answer, feedback, account or identifiable profile. It will not introduce model training, employer access, advertising or other materially different uses for 16- or 17-year-olds without a new assessment, age-appropriate notice and any legally required choice.

Read the shorter young learner privacy summary, or use the contact details above to ask a question or exercise a privacy right.

Private learner data and aggregate insights

Your learner account is private by default. A narrow aggregate-statistics option does not turn it into a data marketplace.

Paper Tiger does not sell, license or disclose identifiable or pseudonymised learner data. In particular, it does not provide learner records or progress profiles to employers, institutions or advertisers, and does not use learner content to train general-purpose AI models.

Paper Tiger may create statistics about overall service or learning patterns, such as broad topic-level trends, only after removing or aggregating information so that no individual learner can reasonably be identified. No raw transcript, answer, feedback, account identifier, small-group result or learner profile is included in an external report. No external aggregate report is currently enabled.

A learner can export the information Paper Tiger makes available and choose to share that export with someone else. That learner-directed action does not give the recipient ongoing account access and does not allow an adult purchaser to inspect the learner's account by default. Any materially different use, including model training, employer access, advertising or research reuse, would require a new assessment and updated information before it was introduced.

How we use personal data

Each row states the data, purpose, lawful basis, recipients, retention rule and whether you must provide it.

Account and sign-in data

Purpose: Create and secure your account, authenticate you and administer access.
Lawful basis: Contract for adult account holders. Legitimate interests in providing the requested age-appropriate core service to 16- and 17-year-olds, and in proportionate security and abuse prevention.
Recipients: Supabase; the OAuth provider you choose; Vercel for service delivery and logs.
Retention: While the account exists; deleted when account deletion completes.
Required or optional: Required for an account. OAuth is optional; email sign-in is available.

Access requests and invitations

Purpose: Review an access request, issue a private invitation and prevent unauthorised registration.
Lawful basis: Steps at your request before a contract; legitimate interests in access security and preventing invitation abuse.
Recipients: Supabase, Vercel when delivering the request, and the authentication email provider where an invitation is sent.
Retention: 90 days after the request was last updated or the invitation expired.
Required or optional: Optional. Paper Tiger stores the contact details and information you submit, but not a raw IP address or user agent in the access-request record.

Account agreements and minimum-age declaration

Purpose: Record which Terms and Privacy Notice you accepted, that you confirmed you are at least 16, and when and through which account route.
Lawful basis: Contract and legitimate interests in keeping necessary evidence of the agreement.
Recipients: Supabase and authorised Paper Tiger administrators.
Retention: At least 6 years after the case or account closes.
Required or optional: Required to create or continue using an account. We do not collect your date of birth or exact age.

Paid account-access safeguard records

Purpose: Allow several personal devices to remain signed in while limiting active paid study to one learner at a time, handling takeovers and investigating false conflicts.
Lawful basis: Contract and legitimate interests in proportionate account security, purchase protection and abuse prevention.
Recipients: Supabase, Vercel when delivering the request, and authorised Paper Tiger administrators.
Retention: The current lease lasts only while active. Warning, block, takeover and revocation outcomes are retained for 90 days. Exemptions last until they expire or are revoked.
Required or optional: Generated automatically for covered paid access. The random browser identifier is not a device fingerprint.

Saved study work

Purpose: Save topics, transcripts, attempts, feedback, progress, review schedules, flashcards and settings.
Lawful basis: Contract for adults. Legitimate interests in providing the requested age-appropriate educational service to account holders aged 16 or 17.
Recipients: Supabase; Vercel when delivering the service.
Retention: While the account exists; deleted when account deletion completes.
Required or optional: Required for saved study features. You choose the study content you enter.

AI grading and learning requests

Purpose: Compare your attempt with answer-key context and return study feedback or other requested learning support.
Lawful basis: Contract for adults. Legitimate interests in providing the requested age-appropriate educational service to account holders aged 16 or 17.
Recipients: OpenAI; Supabase for the saved attempt and result.
Retention: Saved results follow the account rule. A temporary retry-safe response is kept for up to 24 hours after the grading request completes or is last claimed. OpenAI API content may be held in abuse-monitoring logs for up to 30 days unless the production account has approved retention controls. 90 days, then deletion or anonymisation.
Required or optional: Required only when you ask for an AI-assisted feature.

Voice recordings

Purpose: Transcribe speech into an editable study transcript.
Lawful basis: Contract for adults. Legitimate interests in providing the requested optional learning feature to account holders aged 16 or 17.
Recipients: OpenAI's audio-transcription API.
Retention: Paper Tiger holds the recording only for the request and does not save it. OpenAI's current endpoint table lists no abuse-monitoring or application-state retention for audio transcription; legal or safety exceptions may apply.
Required or optional: Optional. You can type or paste a transcript instead.

Handwriting images

Purpose: Extract editable text or describe the structure of a diagram.
Lawful basis: Contract for adults. Legitimate interests in providing the requested optional learning feature to account holders aged 16 or 17.
Recipients: OpenAI; Vercel while carrying the request.
Retention: Paper Tiger does not persist the raw file. It is held only for the request. Provider-side retention is stated separately. OpenAI's applicable image-input retention rules, including legal or safety exceptions, may still apply.
Required or optional: Optional. You can type the answer instead.

Studio source files and extracted notes

Purpose: Extract text locally on the Paper Tiger server, let you review it, then suggest the recall structure you request.
Lawful basis: Contract for adults. Legitimate interests in providing the requested optional learning feature to account holders aged 16 or 17.
Recipients: Vercel carries the raw upload. OpenAI receives the reviewed extracted text only when you ask Studio to suggest a structure. Supabase stores a module you approve.
Retention: Paper Tiger does not persist the raw file. It is held only for the request. Provider-side retention is stated separately. Approved derived Studio content follows the account rule. OpenAI's applicable API retention rules may still apply to the reviewed text.
Required or optional: Optional. You can paste notes instead. Do not submit material you lack the right to use or sensitive personal material.

Optional product analytics

Purpose: Understand whether product routes and learning flows work, using coarse events that exclude study content.
Lawful basis: Consent.
Recipients: Supabase and Vercel Web Analytics.
Retention: 12 months. The browser choice cookie lasts 12 months. the matching local-storage choice remains until it is changed or browser storage is cleared.
Required or optional: Optional. You can reject or withdraw consent in Settings without losing the core service.

Security and operational records

Purpose: Protect accounts, enforce rate limits, investigate failures and prevent abuse. Account-sharing decisions use a random browser identifier hash, the Supabase session ID, activity timestamps and conflict outcomes.
Lawful basis: Legitimate interests, balanced against your rights. Legal obligation where a record is required by law.
Recipients: Supabase, Vercel, OpenAI where relevant, and authorised Paper Tiger administrators.
Retention: 90 days, then deletion or anonymisation. 7 days after the bucket window starts. Ended AI-access suspension decisions are retained 90 days after the suspension ends or is revoked.
Required or optional: Generated automatically when you use the service. Paper Tiger does not use a device fingerprint or raw IP address or user-agent data to make paid account-sharing decisions.

Support and issue reports

Purpose: Investigate your report, answer you and improve reliability.
Lawful basis: Contract and legitimate interests in support and troubleshooting.
Recipients: Supabase and authorised Paper Tiger administrators; relevant service providers if needed to diagnose the issue.
Retention: 24 months after resolution, then deletion or anonymisation.
Required or optional: Optional, but we need enough information to investigate a report.

Privacy requests and necessary audit evidence

Purpose: Respond to rights requests and show how they were handled.
Lawful basis: Legal obligation and legitimate interests in necessary accountability evidence.
Recipients: Supabase, authorised Paper Tiger administrators and professional advisers where necessary.
Retention: At least 6 years after the case or account closes.
Required or optional: Required if you ask us to exercise a privacy right; optional details should be kept to what is necessary.

Purchase, adult-purchaser and billing records

Purpose: Record the 18+ purchaser declaration, take payment, provide purchased access, handle refunds and keep required financial records.
Lawful basis: Contract and legal obligation.
Recipients: Stripe, Supabase and authorised Paper Tiger administrators or professional advisers.
Retention: Until immediately after 6 complete financial years following the relevant 30 June year-end, in minimised form.
Required or optional: Required only for a purchase. The purchaser must be 18 or over. Paper Tiger does not receive the full card number.

Data collected	Purpose	Lawful basis	Recipients	Retention	Required or optional
Account and sign-in data	Create and secure your account, authenticate you and administer access.	Contract for adult account holders. Legitimate interests in providing the requested age-appropriate core service to 16- and 17-year-olds, and in proportionate security and abuse prevention.	Supabase; the OAuth provider you choose; Vercel for service delivery and logs.	While the account exists; deleted when account deletion completes.	Required for an account. OAuth is optional; email sign-in is available.
Access requests and invitations	Review an access request, issue a private invitation and prevent unauthorised registration.	Steps at your request before a contract; legitimate interests in access security and preventing invitation abuse.	Supabase, Vercel when delivering the request, and the authentication email provider where an invitation is sent.	90 days after the request was last updated or the invitation expired.	Optional. Paper Tiger stores the contact details and information you submit, but not a raw IP address or user agent in the access-request record.
Account agreements and minimum-age declaration	Record which Terms and Privacy Notice you accepted, that you confirmed you are at least 16, and when and through which account route.	Contract and legitimate interests in keeping necessary evidence of the agreement.	Supabase and authorised Paper Tiger administrators.	At least 6 years after the case or account closes.	Required to create or continue using an account. We do not collect your date of birth or exact age.
Paid account-access safeguard records	Allow several personal devices to remain signed in while limiting active paid study to one learner at a time, handling takeovers and investigating false conflicts.	Contract and legitimate interests in proportionate account security, purchase protection and abuse prevention.	Supabase, Vercel when delivering the request, and authorised Paper Tiger administrators.	The current lease lasts only while active. Warning, block, takeover and revocation outcomes are retained for 90 days. Exemptions last until they expire or are revoked.	Generated automatically for covered paid access. The random browser identifier is not a device fingerprint.
Saved study work	Save topics, transcripts, attempts, feedback, progress, review schedules, flashcards and settings.	Contract for adults. Legitimate interests in providing the requested age-appropriate educational service to account holders aged 16 or 17.	Supabase; Vercel when delivering the service.	While the account exists; deleted when account deletion completes.	Required for saved study features. You choose the study content you enter.
AI grading and learning requests	Compare your attempt with answer-key context and return study feedback or other requested learning support.	Contract for adults. Legitimate interests in providing the requested age-appropriate educational service to account holders aged 16 or 17.	OpenAI; Supabase for the saved attempt and result.	Saved results follow the account rule. A temporary retry-safe response is kept for up to 24 hours after the grading request completes or is last claimed. OpenAI API content may be held in abuse-monitoring logs for up to 30 days unless the production account has approved retention controls. 90 days, then deletion or anonymisation.	Required only when you ask for an AI-assisted feature.
Voice recordings	Transcribe speech into an editable study transcript.	Contract for adults. Legitimate interests in providing the requested optional learning feature to account holders aged 16 or 17.	OpenAI's audio-transcription API.	Paper Tiger holds the recording only for the request and does not save it. OpenAI's current endpoint table lists no abuse-monitoring or application-state retention for audio transcription; legal or safety exceptions may apply.	Optional. You can type or paste a transcript instead.
Handwriting images	Extract editable text or describe the structure of a diagram.	Contract for adults. Legitimate interests in providing the requested optional learning feature to account holders aged 16 or 17.	OpenAI; Vercel while carrying the request.	Paper Tiger does not persist the raw file. It is held only for the request. Provider-side retention is stated separately. OpenAI's applicable image-input retention rules, including legal or safety exceptions, may still apply.	Optional. You can type the answer instead.
Studio source files and extracted notes	Extract text locally on the Paper Tiger server, let you review it, then suggest the recall structure you request.	Contract for adults. Legitimate interests in providing the requested optional learning feature to account holders aged 16 or 17.	Vercel carries the raw upload. OpenAI receives the reviewed extracted text only when you ask Studio to suggest a structure. Supabase stores a module you approve.	Paper Tiger does not persist the raw file. It is held only for the request. Provider-side retention is stated separately. Approved derived Studio content follows the account rule. OpenAI's applicable API retention rules may still apply to the reviewed text.	Optional. You can paste notes instead. Do not submit material you lack the right to use or sensitive personal material.
Optional product analytics	Understand whether product routes and learning flows work, using coarse events that exclude study content.	Consent.	Supabase and Vercel Web Analytics.	12 months. The browser choice cookie lasts 12 months. the matching local-storage choice remains until it is changed or browser storage is cleared.	Optional. You can reject or withdraw consent in Settings without losing the core service.
Security and operational records	Protect accounts, enforce rate limits, investigate failures and prevent abuse. Account-sharing decisions use a random browser identifier hash, the Supabase session ID, activity timestamps and conflict outcomes.	Legitimate interests, balanced against your rights. Legal obligation where a record is required by law.	Supabase, Vercel, OpenAI where relevant, and authorised Paper Tiger administrators.	90 days, then deletion or anonymisation. 7 days after the bucket window starts. Ended AI-access suspension decisions are retained 90 days after the suspension ends or is revoked.	Generated automatically when you use the service. Paper Tiger does not use a device fingerprint or raw IP address or user-agent data to make paid account-sharing decisions.
Support and issue reports	Investigate your report, answer you and improve reliability.	Contract and legitimate interests in support and troubleshooting.	Supabase and authorised Paper Tiger administrators; relevant service providers if needed to diagnose the issue.	24 months after resolution, then deletion or anonymisation.	Optional, but we need enough information to investigate a report.
Privacy requests and necessary audit evidence	Respond to rights requests and show how they were handled.	Legal obligation and legitimate interests in necessary accountability evidence.	Supabase, authorised Paper Tiger administrators and professional advisers where necessary.	At least 6 years after the case or account closes.	Required if you ask us to exercise a privacy right; optional details should be kept to what is necessary.
Purchase, adult-purchaser and billing records	Record the 18+ purchaser declaration, take payment, provide purchased access, handle refunds and keep required financial records.	Contract and legal obligation.	Stripe, Supabase and authorised Paper Tiger administrators or professional advisers.	Until immediately after 6 complete financial years following the relevant 30 June year-end, in minimised form.	Required only for a purchase. The purchaser must be 18 or over. Paper Tiger does not receive the full card number.

“Contract” means processing needed to provide the account or feature you request. “Legitimate interests” means a proportionate operational need that we have assessed against your rights. “Legal obligation” means processing needed to comply with law. Consent applies only to optional processing and can be withdrawn.

Where the data comes from

We receive personal data from:

you, when you register, study, upload material, buy a pack, change settings, contact support or make a privacy request
Google or Apple if you choose that sign-in method
the person or organisation that sends you an invitation, where invited access is used
your device, browser and our service logs when you use Paper Tiger
Stripe when a payment succeeds, fails, is refunded or is disputed
our service providers when they return a transcription, AI result, delivery status or security signal

Please do not submit sensitive information about real people or material you do not have the right to use. Paper Tiger is a study service, not a place to store client, patient, employee or case files.

AI processing, voice and uploads

AI features are used for study support. They do not make legal or similarly significant decisions about you.

Grading and learning support

When you ask Paper Tiger to grade an attempt, we send the transcript, the relevant prompt and answer-key context, and limited technical instructions to OpenAI. We use the response to show and save study feedback. The transcript remains editable before grading. AI output may be incomplete or wrong and should be checked as study support.

OpenAI's default API abuse-monitoring logs may retain customer content for up to 30 days unless approved Modified Abuse Monitoring or Zero Data Retention controls apply. Some endpoint-specific and legal or safety exceptions apply. See OpenAI's API data-controls information.

Voice transcription

Paper Tiger holds a recording in memory only while the transcription request is in progress. We do not save the audio. The recording is sent to OpenAI's audio- transcription endpoint. OpenAI's current endpoint table lists no abuse-monitoring or application-state retention for that endpoint, although legal or safety exceptions may apply. The returned text becomes an editable transcript; it is saved only when the study flow saves it.

Handwriting

Images are sent to OpenAI only when you request handwriting extraction or a diagram description. Paper Tiger does not save the raw image after the request. Text you choose to place in the composer may later be saved with the attempt. OpenAI's applicable API retention rules still apply to the provider copy.

Studio source files

Paper Tiger extracts text from an uploaded DOCX, text PDF, TXT or Markdown file on the server and does not save the raw file. You can review and trim the extracted text. The raw file is not sent to OpenAI. When you choose “Suggest recall structure”, the reviewed text is sent to OpenAI. A module is saved only after you review and create it.

Cookies, browser storage and optional analytics

Essential cookies support sign-in, session refresh and security. The browser cookie that records your analytics choice lasts 12 months. The matching local-storage value remains until you change it or clear browser storage.

Optional analytics are off unless you consent. If you consent, Paper Tiger records coarse route, feature, reliability and learning-flow events for up to 12 months. You can withdraw consent in Settings. We do not use advertising cookies, marketing pixels or session replay.

What optional analytics exclude

typed transcripts, answers, answer keys, source extracts or other study text
raw audio, images, uploaded files, audio URLs or image URLs
names, email addresses, support-message text or other free text
raw prompts, raw AI output or raw feedback text
keystrokes, click coordinates, DOM selectors, session replay or second-by-second timelines

Service providers and international transfers

Paper Tiger uses Supabase for authentication and database services, Vercel for hosting and delivery, OpenAI for requested AI features, and Stripe for checkout and payment processing. Each provider acts under its own contractual and data-protection terms for the service it supplies.

A provider may process personal data outside the UK. Where a destination is not covered by UK adequacy regulations, an appropriate safeguard is required, such as the UK International Data Transfer Agreement or UK Addendum to approved contractual clauses, together with a transfer risk assessment where required. Email hello@paper-tiger.co.uk to ask for current provider, processing-location or safeguard details.

Security and deletion

Paper Tiger uses access controls, row-level database policies, server-side secret handling and audit records. No online service can promise perfect security.

When account deletion completes, ordinary account and study data are deleted and the authentication identity is permanently removed. Necessary legal, privacy, billing and audit evidence may be kept in minimised form for the periods shown above. This means removing direct identifiers and free text where they are no longer necessary.

Your data-protection rights

Depending on the processing and lawful basis, you may ask us to access, correct or erase personal data; restrict how it is used; provide portable data; or consider an objection. Where processing relies on consent, you can withdraw consent at any time without affecting earlier lawful processing. Some rights do not apply in every case, and the law may require or permit us to keep limited records.

Account holders can export data and make a privacy or deletion request in Settings. Anyone can email hello@paper-tiger.co.uk. We may need to verify your identity. We normally respond within one month; we will explain if the law allows more time or if a request cannot be fulfilled in full.

Questions and complaints

Please email hello@paper-tiger.co.uk so we can investigate a privacy concern. Contacting us first is not a condition of complaining to the Information Commissioner's Office (ICO); you may contact the ICO at any time. See the ICO's data-protection complaint guidance.

Changes to this notice

We will update the date and version when this notice changes. If a change materially affects account processing, we will show it to signed-in users and ask for any confirmation the change requires. We do not reset analytics consent unless its purpose or processing changes in a way that requires a new choice.

Paper TigerGuided active recall Paper TigerGuided active recall