Privacy Policy

1. Who is responsible

Menoa ehf. makes and sells PaperKeys and is the controller of the personal data described here. When this policy says “we” or “us”, it means Menoa ehf.

Company

Menoa ehf.

Kennitala

620921-0840

Address

Mánatúni 15, 105 Reykjavík, Iceland

Phone

+354 663 9889

Email

menoa@menoa.is

We haven’t appointed a data protection officer. For anything about your data, email menoa@menoa.is.

This policy covers the PaperKeys app for Mac, this website and buying PaperKeys. It is written to meet the Icelandic Act no. 90/2018 on data protection and the processing of personal data, and the EU General Data Protection Regulation (GDPR), which that Act brings into Icelandic law.

2. What stays on your Mac

Most of PaperKeys works without the internet. What you type and dictate stays on your Mac, and so does everything PaperKeys learns or saves from it. None of it reaches us. Text only leaves your Mac when you use an AI feature or an action such as web search (section 3).

In password and other secure fields, PaperKeys learns nothing. API keys you add for AI features stay in your Mac’s Keychain. The free version needs no account and never contacts our license server.

3. When the app goes online

These are the only reasons PaperKeys goes online:

The identifier is your Mac’s hardware UUID, a fixed ID that macOS gives each Mac. The Mac’s name, such as “Anna’s MacBook Air”, lets you and us tell your Macs apart.

AI providers, model hosts and the apps and websites these actions open receive what’s listed above directly from you, not from us. We never see it, and each handles it under its own privacy policy and, for AI providers, your agreement with them. As with any internet connection, every request shows the server it goes to your IP address.

4. Licenses

Our license server stores:

• For each license: your email address, the license key, the plan, its status, when it expires if it does, how many Macs it allows, and when it was created and last changed.
• For licenses bought on paperkeys.app, also: your country, and our payment provider’s reference numbers for you as a customer, for your payment and for your subscription.
• For each Mac it’s activated on: the Mac’s identifier and name, when it was activated and when it last checked in.

We use this to issue and deliver your license, check it, keep it to three Macs, and help you when you write to us.

5. Buying PaperKeys

• At checkout you give us your email address and your country. We use the country to apply the right VAT, and the email address to send you your license key and reach you about your purchase.
• Borga, our payment provider, processes the payment. Your card details go straight to Borga, never to our servers. For Pro, Borga keeps your card on file so it can charge each month. We can see your card’s brand, last four digits and expiry date, never the full number.
• From Borga we receive confirmation of each payment, your email address and country, the amount and VAT, and Borga’s reference numbers for the customer, the payment and the subscription.
• PayDay is our accounting system. Each payment is recorded there as an invoice, with your email address (and your name, if you gave one), what you bought, the price and the VAT.
• Resend sends the email with your license key, so it handles your email address and that email.

Borga’s card acquirer, the card schemes and your bank also process your card data, as controllers in their own right.

6. Crash reports

• Crash reports are off unless you turn them on, and you can see a report before it’s sent.
• A report holds technical details of the crash and the versions of PaperKeys and macOS, with anything that could hold what you typed taken out.
• Nothing that identifies you, such as your license key, Mac identifier, email address or IP address, is stored with a report.
• Reports are deleted automatically after 90 days.
• Because a report can’t be linked to you, we can’t find yours to delete it on request. Turning crash reports off stops new ones, and any already sent are gone within 90 days.

7. This website

• paperkeys.app sets no cookies, runs no analytics or trackers, keeps nothing in your browser’s storage and loads nothing from other sites.
• The keyboard demo runs entirely in your browser. Nothing you type into it is sent anywhere.
• Cloudflare hosts the site. To deliver and protect it, Cloudflare processes your IP address and browser details and may keep them briefly in its own logs. We don’t use them to track visitors.

8. Email and support

When you email menoa@menoa.is, the message is kept in our mailbox, which Zoho hosts. We use your message and address to answer you and, where needed, to look up your license.

9. Why we may use your data

We don’t make automated decisions about you or build profiles.

10. How long we keep it

11. Who else handles it

These companies process personal data for us, under data processing agreements, and only to provide their service:

The card acquirer, the card schemes and your bank handle card data as described in section 5. Our accountant sees our books, and we share data with authorities such as Iceland Revenue and Customs (Skatturinn) when the law requires it. We don’t sell personal data or share it for advertising.

12. Transfers outside the EEA

Cloudflare, Resend and Zoho are based in the United States, and Cloudflare serves requests from data centres around the world. When personal data goes to a country outside the European Economic Area, the transfer is covered by the EU–US Data Privacy Framework, for companies certified under it, or by the European Commission’s standard contractual clauses in our agreement with the provider. Email us for a copy of the safeguards that apply.

If you use an AI feature, your text goes straight from your Mac to the provider you chose, which may process it outside the EEA, under your own agreement with them.

13. Security

• Every connection the app and this website make to us is encrypted with HTTPS.
• Card details never reach our servers.
• Your API keys stay in your Mac’s Keychain.
• The license server’s admin tools sit behind a separate sign-in, and only we can use them.
• We collect as little as we can, so there’s less to protect.

14. Your rights

You have the right to:

• see the personal data we hold about you and get a copy of it;
• have it corrected if it’s wrong;
• have it deleted;
• have its use restricted;
• get the data you gave us in a machine-readable format;
• object to uses based on our legitimate interests;
• withdraw consent at any time, without affecting what was done before.

To use any of them, email menoa@menoa.is, ideally from the address on your license. We may ask you to confirm it’s you. It’s free, and we answer within one month, or tell you within that month if a complex request needs up to two more.

Deleting your license data ends the license. Invoices and payment records have to be kept for as long as bookkeeping law requires, even if you ask us to delete them.

15. Complaints

If you’re unhappy with how we handle your data, please tell us first. You also have the right to complain to Persónuvernd, the Icelandic Data Protection Authority, at personuvernd.is. If you live elsewhere in the EEA, you can also complain to the data protection authority where you live.

16. Changes to this policy

When what PaperKeys does with data changes, this page changes with it, and the date at the top shows when. If a change matters to people who hold a license, we’ll email them before it applies.