Privacy notice
Controller
Yan Malinovskiy, Belchenstr. 2, 79276 Reute, Germany, hello@paqso.com. For personal data processed inside a customer organization's workspace — products, packaging facts, evidence, supplier contacts — that organization is the controller and Paqso acts as its processor under the data processing agreement.
What is processed, and why
Account: name, e-mail address, a password hash, and verification state, to authenticate you (Art. 6 (1) (b) GDPR). Sign-in attempts, lockouts, and their timestamps are kept to protect the account (Art. 6 (1) (f)).
Organization and membership: the organization you belong to, your role, and invitations you send or receive, to resolve what you may do (Art. 6 (1) (b)).
Workspace content: products, packaging components, evidence requests, supplier names and contact addresses, and the decisions your organization records. Processed on the organization’s instructions (Art. 28 GDPR).
Supplier tasks: a supplier who follows an evidence-request link sees the question asked and may answer it. The link carries a one-time token; no account is created and only the digest of the token is stored.
Billing: the organization’s subscription is handled by Polar Software Inc. as merchant of record, which processes the billing contact and payment details under its own privacy notice. Paqso receives the subscription state and the organization it belongs to, not payment details.
Technical data: IP address, request metadata, and a correlation identifier per request, in server logs for security and fault diagnosis (Art. 6 (1) (f)), retained for a short period.
Audit trail: who did what and when inside an organization, with actor, action, target, and outcome, so decisions stay accountable (Art. 6 (1) (b) and (f)). The trail carries no document contents.
Cookies
Paqso sets a session cookie after sign-in and nothing else. There is no tracking, no advertising, and no third-party analytics. The chosen language is carried in the address, not in a cookie.
Recipients and processors
Cloudflare, Inc. hosts the applications and delivers transactional e-mail; Neon (a Databricks company) hosts the databases in the EU (Frankfurt); Polar Software Inc. handles subscriptions as merchant of record. Processors are bound by Art. 28 GDPR agreements. Where a processor may access data from outside the EU, transfers rest on the EU–US Data Privacy Framework or the Standard Contractual Clauses.
Retention
Account data is kept while the account exists. Workspace content is kept while the organization holds it; compliance evidence may be subject to statutory retention periods the organization decides. Server logs are kept for a short period. Audit records are kept for as long as the decisions they describe are relevant. Data is erased within 30 days of an erasure request where no retention duty applies.
Your rights
You may request access, rectification, erasure, restriction, and portability, and object to processing based on legitimate interests (Art. 15–21 GDPR). Write to the address above. You may also complain to a supervisory authority, in particular the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (https://www.baden-wuerttemberg.datenschutz.de/).
No automated decisions
Paqso makes no automated decision with legal effect about you. Any assisted analysis in the product is a draft that an authorized person in your organization reviews.