Privacy Policy
PaperPlane Assessment Generator
Effective Date: January 5, 2026
1. Introduction and Scope
1.1 About This Policy
This Privacy Policy ("Policy") explains how PaperPlane ("we," "us," "our," or "the Service") collects, uses, stores, shares, and protects your personal information. We are committed to safeguarding your privacy and ensuring that your personal data is handled responsibly and in compliance with applicable data protection laws.
1.2 Legal Framework
This Policy is designed to comply with:
- Republic Act No. 10173 – the Philippines Data Privacy Act of 2012 ("DPA")
- Implementing Rules and Regulations (IRR) of the DPA
- National Privacy Commission (NPC) Circulars and Advisories
1.3 Who This Policy Applies To
This Policy applies to:
- All users who access or use PaperPlane
- Visitors to our website
- Individuals whose personal data we process in connection with our services
1.4 Your Consent
By creating an account, logging in, or using any part of PaperPlane, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree to this Policy, please do not use our Service.
2. Definitions
For the purposes of this Policy:
| Term | Definition |
|---|---|
| Personal Information | Any information, whether recorded in material form or not, from which the identity of an individual is apparent or can be reasonably ascertained. |
| Sensitive Personal Information | Personal information about an individual's race, ethnic origin, marital status, age, color, religious/philosophical/political affiliations, health, education, genetic or sexual life, or any proceeding for any offense committed. |
| Processing | Any operation performed on personal information including collection, recording, organization, storage, updating, modification, retrieval, consultation, use, consolidation, blocking, erasure, or destruction. |
| Data Subject | An individual whose personal information is processed (i.e., you, the user). |
| Personal Information Controller (PIC) | A natural or juridical person who controls the processing of personal data. PaperPlane acts as a PIC for user account data. |
| Personal Information Processor (PIP) | A natural or juridical person to whom a PIC outsources or instructs the processing of personal data. Our third-party service providers act as PIPs. |
3. Personal Information We Collect
3.1 Information You Provide Directly
3.1.1 Account Registration Data
When you register for PaperPlane using OAuth authentication, we collect:
| Data Field | Source | Purpose |
|---|---|---|
| Email address | Google or Microsoft OAuth | Account identification, communication |
| Display name | OAuth provider (if available) | Personalization |
| Profile picture URL | OAuth provider (optional) | User interface display |
| OAuth provider identifier | Google/Microsoft account ID | Secure authentication linking |
3.1.2 User-Generated Content
When you use our Service, you may provide:
- Teaching Materials: Documents you upload for assessment generation (PDF, DOCX, TXT files containing educational content)
- Assessment Configurations: Table of Specifications (TOS), competency descriptions, difficulty preferences, question type selections
- Generated Assessments: Questions, answer options, explanations, and related content produced by our AI
- Feedback and Communications: Bug reports, feature suggestions, and support inquiries you submit
3.2 Information Collected Automatically
3.2.1 Usage and Transaction Data
| Data Type | What We Collect | Retention |
|---|---|---|
| Credit balance | Current credits, transaction history | Account lifetime |
| Generation history | Timestamps, question counts, completion status | Account lifetime |
| AI usage metrics | Tokens consumed, latency measurements, model used | 1 year |
| Error logs | Failed operations, error messages (anonymized) | 90 days |
3.2.2 Session and Authentication Data
| Data Type | What We Collect | Retention |
|---|---|---|
| Session identifiers | Randomly generated session IDs | 7 days (auto-expiry) |
| Login timestamps | Date and time of authentication | Account lifetime |
| OAuth state tokens | CSRF protection tokens | Session only |
| PKCE verifiers | Code verification tokens for OAuth security | Session only |
3.2.3 Technical Data
We may collect technical information necessary for service operation:
- Browser type and version
- Device information (for responsive design)
- IP address (for security and abuse prevention)
- Referring URL (how you found us)
3.3 Information We Do NOT Collect
We want to be clear about data we do NOT collect:
- Passwords: We never see, store, or have access to your Google or Microsoft passwords
- Payment card information: We do not currently process payments directly
- Location data: We do not track your precise geographic location
- Sensitive personal information: We do not collect data about your race, religion, health, political opinions, or similar categories as defined under the DPA
4. How We Use Your Information
4.1 Primary Purposes
We process your personal information for the following purposes:
| Purpose | Description | Legal Basis (DPA Section 12) |
|---|---|---|
| Service Provision | Authenticate your identity, maintain your account, and enable you to use PaperPlane features | Contractual necessity |
| Assessment Generation | Process your uploaded documents and generate educational assessments using AI | Contractual necessity |
| Credit Management | Track your usage credits, process transactions, and maintain account balance | Contractual necessity |
| Communication | Send service-related notifications, respond to support inquiries | Contractual necessity / Legitimate interest |
| Security | Detect and prevent fraud, abuse, and unauthorized access | Legitimate interest |
| Legal Compliance | Comply with applicable laws, regulations, and legal processes | Legal obligation |
4.2 Secondary Purposes
With appropriate safeguards, we may also use your information for:
- Service Improvement: Analyze aggregated, anonymized usage patterns to improve features
- Quality Assurance: Review generated content for accuracy (admin access is logged)
- Technical Troubleshooting: Investigate and resolve technical issues
4.3 What We Do NOT Use Your Data For
We commit to NOT using your personal information for:
- Selling your data to third parties for their marketing purposes
- Advertising or profiling for commercial targeted advertising
- AI training – Cloudflare (our AI provider) explicitly confirms they do NOT train models on customer data
- Sharing with unrelated third parties for their independent purposes
6. Cross-Border Data Transfers
6.1 International Processing
Due to our use of Cloudflare's global infrastructure, your personal information may be processed in countries outside the Philippines, including the United States and European Union member states.
6.2 Safeguards for International Transfers
In compliance with Section 21 of the DPA, we ensure that any cross-border transfer is protected by:
- Contractual Protections: Cloudflare's Data Processing Addendum incorporates EU Standard Contractual Clauses (SCCs)
- Organizational Measures: Cloudflare maintains ISO 27001 certification and SOC 2 Type II attestation
- Your Consent: By using PaperPlane, you consent to international data transfers
7. Data Retention
7.1 Retention Schedule
We retain your personal information only for as long as necessary:
| Data Category | Retention Period | Rationale |
|---|---|---|
| Account Information | Until account deletion + 30 days | Account recovery |
| Uploaded Documents (Teacher Materials) | 48 hours | Automatic deletion; data minimization |
| Generated Assessments | Until you delete them | You control your content |
| Session Data | 7 days | Security and continuity |
| AI Usage Logs | 1 year | Cost analytics |
| Credit Transaction History | 3 years | Financial record-keeping |
| Admin Audit Logs | 2 years | Security and accountability |
7.2 Deletion Procedures
Upon expiration of retention periods or upon your request:
- Data is permanently deleted from active systems
- Deletion cascades to related records
- Backup copies are overwritten within 90 days
8. Your Rights as a Data Subject
Under the Data Privacy Act of 2012, you have the following rights:
8.1 Right to Be Informed (Section 16(a))
You have the right to know what data we collect and why. This Privacy Policy serves to fulfill this right.
8.2 Right to Access (Section 16(c))
You have the right to obtain confirmation that we process your data and request a copy. Contact us and we will respond within 30 days.
8.3 Right to Object (Section 16(b))
You have the right to object to processing based on legitimate interests. Contact us to raise an objection.
8.4 Right to Erasure or Blocking (Section 16(d))
You can delete your account through app settings, or contact us for complete erasure. Account deletion removes all associated data through CASCADE deletion.
8.5 Right to Rectification (Section 16(e))
To update your email or name, update it with Google/Microsoft directly. Changes will reflect on your next login.
8.6 Right to Data Portability (Section 16(f))
Contact us to request a data export in JSON format. We will provide it within 30 days.
8.7 Right to File a Complaint
If you believe your rights have been violated, contact the National Privacy Commission (NPC):
- Website: privacy.gov.ph
- Email: complaints@privacy.gov.ph
- Phone: (02) 8234-2228
8.8 Responding to Your Requests
- We will acknowledge receipt within 5 business days
- We will fulfill valid requests within 30 days
- We may request identity verification
9. Data Security
9.1 Technical Security Measures
- Encryption in Transit: TLS 1.3 encryption (HTTPS)
- Encryption at Rest: AES-256 encryption in Cloudflare D1, R2, and Vectorize
- Authentication Security: OAuth 2.0 with PKCE
- Session Security: HttpOnly, Secure, SameSite cookies
- Password Protection: We never handle passwords—delegated to Google/Microsoft
9.2 Organizational Security Measures
- Role-Based Access Control: Admin access restricted to authorized personnel
- Audit Logging: All administrative actions logged with timestamps
- Cascade Deletion: Account deletion removes all related data automatically
9.3 Third-Party Security
Cloudflare maintains ISO 27001 certification, SOC 2 Type II attestation, and PCI DSS compliance.
10. Data Breach Notification
10.1 Our Commitment
In the event of a personal data breach that poses risk to your rights:
- Notify the NPC within 72 hours of becoming aware
- Notify affected data subjects without undue delay when high risk is likely
10.2 Notification Contents
Our notification will include the nature of the breach, data affected, consequences, measures taken, and contact information.
12. Children's Privacy
PaperPlane is designed for educators. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us immediately.
13. Changes to This Policy
We may update this Policy from time to time. When we make changes:
- We will update the "Effective Date"
- For material changes, we will notify you via email or in-app notification
- For significant changes, we may require you to re-consent
Your continued use after changes constitutes acceptance of the revised Policy.
14. Contact Information
14.1 Data Protection Contact
For any questions, concerns, or requests regarding this Privacy Policy:
Email: reayungao@gmail.com
We aim to respond within 5 business days.
14.2 National Privacy Commission
For complaints about data privacy violations:
- Website: privacy.gov.ph
- Email: complaints@privacy.gov.ph
- Phone: (02) 8234-2228
15. Governing Law
This Privacy Policy is governed by and construed in accordance with the laws of the Republic of the Philippines, including the Data Privacy Act of 2012 (RA 10173) and its Implementing Rules and Regulations.
This Privacy Policy was last updated on January 5, 2026.