Privacy Policy

This Privacy Policy explains how EasyPPAP LLC ("EasyPPAP", "we", "us") collects, uses, and protects personal data when you use our Service at easyppap.com.

1. Who We Are

EasyPPAP LLC is the data controller for personal data collected directly from Account holders. When EasyPPAP processes personal data contained in PPAP Material on behalf of a Customer, EasyPPAP acts as a data processor under GDPR Article 28; the relevant terms are in our Data Processing Agreement.

Contact for privacy matters: admin@easyppap.com

2. Personal Data We Collect

2.1 Data you provide directly

• Account information: name, email address, and company. Sign-in is passwordless (email magic links) — no password is ever created, transmitted, or stored
• Profile information: company name (optional), role (optional), country (optional)
• Billing information: Stripe handles payment data. EasyPPAP does not store full card numbers; we receive only the last four digits and brand for receipts
• Communications: the content of any email, support ticket, or feedback you send us

2.2 Data collected automatically

• Technical log data: server request logs generated by our hosting infrastructure for security and operations (IP address, browser user-agent, timestamps). We do not run product analytics or behavioral tracking
• Performance data: application errors and latency measurements

2.3 Data contained in PPAP Material

PPAP Material may contain personal data such as employee names, signatures, or contact information of Customer's personnel. EasyPPAP processes this data only as a processor on behalf of Customer, and only to provide the Service.

3. How We Use Personal Data and the Legal Basis

• Provide and operate the Service — Performance of contract (GDPR Art. 6(1)(b))
• Process payments and prevent fraud — Performance of contract; legitimate interest
• Send transactional emails (signup verification, password reset, analysis-complete notification, billing receipts) — Performance of contract
• Respond to support requests — Performance of contract
• Improve the Service via aggregated, anonymized analytics — Legitimate interest
• Comply with legal obligations (tax records, lawful demands) — Legal obligation
• Send marketing emails (only if you opt in) — Consent

We do not use personal data or PPAP Material to train AI models. Anthropic's commercial terms prohibit Anthropic from training its models on customer content submitted through its API, and your files are deleted from our systems within approximately 60 seconds after the analysis completes (see Section 11).

4. Sharing Personal Data with Sub-processors

EasyPPAP uses several sub-processors to provide the Service. Each is bound by a written agreement requiring it to process personal data only on EasyPPAP's instructions and consistent with this Privacy Policy.

For the complete current list, see our Sub-processors page.

EasyPPAP will provide thirty (30) days advance notice before adding a sub-processor that materially increases the geographic footprint of personal-data processing, allowing Customer to object.

5. International Data Transfers

EasyPPAP is established in Ohio, USA. Personal data and PPAP Material processed by EasyPPAP and its sub-processors are stored primarily in the United States.

For Customers in the European Economic Area, the United Kingdom, or Switzerland, transfers to the United States are made under the Standard Contractual Clauses (SCC) issued by the European Commission, supplemented by additional safeguards as required by the Schrems II decision.

6. Your Rights Under GDPR / UK GDPR

You have the right to:

• Access the personal data we hold about you
• Rectify inaccurate personal data
• Erase your personal data, subject to legal retention obligations
• Restrict processing in certain circumstances
• Data portability — receive your personal data in a structured, machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent for processing based on consent
• Lodge a complaint with a supervisory authority

To exercise any right, email admin@easyppap.com. We will respond within thirty (30) days.

7. Cookies and Similar Technologies

EasyPPAP uses only strictly necessary cookies for session management and security (sign-in sessions). These are exempt from consent requirements.

We do not use analytics cookies, advertising cookies, or third-party trackers of any kind. There is no tracking to consent to, which is why you will not see a cookie banner.

8. Security

EasyPPAP implements technical and organizational measures appropriate to the risk:

• TLS 1.2+ for all network traffic, with HTTP Strict Transport Security and hardened security headers on every response
• Encryption at rest and in transit for the database and object storage (MongoDB Atlas, Supabase)
• Passwordless authentication — no password database exists to breach; sign-in requests are rate-limited
• Server-side validation of uploaded file types and sizes, and rate limiting on sensitive operations
• Role-based access control; access to production data is restricted to a single administrator
• Automated integrity and cleanup checks every 15 minutes, including enforcement of the deletion schedule in Section 11

EasyPPAP does not yet hold its own SOC 2 certification; our infrastructure providers (Vercel, MongoDB Atlas, Supabase, Stripe) maintain independent security certifications for the layers they operate.

9. California (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, delete personal information (subject to exceptions), correct inaccurate information, and opt out of the sale or sharing of personal information. EasyPPAP does not sell personal information and does not share personal information for cross-context behavioral advertising. To exercise California rights: admin@easyppap.com.

10. Children

The Service is not intended for individuals under 18. We do not knowingly collect personal data from children under 16.

11. Retention

• Account information: Active period of Account + 30 days grace + ongoing legal retention obligations (e.g., tax records: 7 years)
• PPAP Material (input): Up to 60 seconds after analysis completion
• Output (analysis report): 15 days from generation
• Audit logs: 13 months
• Email logs: 90 days
• Backups: Up to 30 days after deletion from primary store

12. Changes to This Policy

We will notify Account holders by email of material changes at least fifteen (15) days before they take effect.

13. Contact

EasyPPAP LLC
Ohio, USA
admin@easyppap.com