Legal

Privacy Policy

Last updated: November 2026

We collect only what we need

Papigrows collects the minimum data required to run your account and generate content. Customer data is encrypted at rest and in transit, payment details are handled entirely by Stripe, and we never sell your data or use it to train AI models. The processors we rely on are listed below.

1. Who we are

Papigrows is operated by Monti Labs AB, based in Lidingö, Sweden. We build SEO and GEO content automation software. Contact: [email protected].

2. Data we collect

  • Account data: email address, organisation name, website URL.
  • Pre-account onboarding data: website domain, generated website analysis and plan, organisation name, brand preferences, and, when you request a sign-in link, your email address.
  • Usage data: articles generated, keywords, CMS connection metadata (no CMS credentials are stored - OAuth tokens are encrypted at rest).
  • Billing data: handled exclusively by Stripe. We never see or store card numbers.
  • Session data: cryptographically signed cookies stored in your browser.

3. How your data is stored

Account and usage data is held in a managed PostgreSQL database (Supabase). Backups are encrypted. Some of our processors operate infrastructure outside the EU/EEA; where that is the case, transfers are covered by the relevant safeguards (such as Standard Contractual Clauses) under the processor's data processing terms.

4. GDPR compliance

Papigrows processes personal data as a data processor under GDPR Art. 28. We offer a Data Processing Addendum (DPA) on request. Your rights:

  • Right to access your data (export available on request)
  • Right to erasure (contact us and we delete within 30 days)
  • Right to portability
  • Right to object to processing

5. Data retention

Active account data is retained for the lifetime of your subscription plus 30 days. After account deletion, backups are purged within 90 days.

If you start onboarding but do not provide an email address or create an account, we delete the onboarding record after seven days. If you provide an email address but do not create an account, we retain your saved plan and contact details to help you complete setup until you request deletion. You can delete saved lead records in account settings or email [email protected]. Optional personalized follow-ups use your website analysis and proposed topics; you can unsubscribe in every message. If you create an account, the account retention period above applies to data transferred into your account.

6. Third-party processors

  • Supabase (database hosting). DPA in place.
  • Stripe (payments) - PCI-DSS Level 1 compliant.
  • Anthropic (AI generation) - content processed transiently for article generation; not stored by Anthropic per their API terms.
  • Resend (transactional email).

7. Cookies

We use first-party cookies only: a session cookie when you sign in (httpOnly, Secure, SameSite=Lax); preference cookies for language, currency and app layout; short-lived cookies for sign-in, onboarding and connecting a CMS; a referral cookie if you follow a referral link; and a pricing cookie with a random identifier, kept for up to one year, so you keep seeing the same price while we test different prices. No third-party tracking cookies. No advertising pixels. We also remember your cookie choice. In the EU, EEA, UK and Switzerland, the pricing cookie is set only if you accept it. Without it you see our standard price.

Change your cookie choice

8. Changes to this policy

Material changes will be communicated by email and displayed in the app changelog at least 14 days before taking effect.

9. Contact

For privacy-related requests: [email protected]