Privacy Policy

1. Who is responsible

Pastefield is run by an individual sole proprietor based in Malaysia, who is responsible for your personal data under Malaysia’s Personal Data Protection Act 2010 and, where they apply to you, other data protection laws such as the GDPR. Contact: support@pastefield.com.

2. What we collect

• Account: your email address. If you sign in with Google, we receive your email address and a Google account identifier, and nothing else from your Google account.
• Your content: the boards you create and what is on them — images and files you upload, text, links and their previews, and what Pastefield AI adds.
• Billing: if you subscribe, Stripe collects your payment details. We never see or store your card number. We keep your Stripe customer and subscription identifiers, plan, billing interval and renewal date.
• Usage and security: a session cookie, hashed API tokens, counts of Pastefield AI credits and API calls, and your IP address, which we use briefly to limit abuse.
• Messages: what you send us when you email support.

We do not use advertising, analytics or tracking cookies, and we do not sell or rent personal data.

3. How we use it

• to provide the service: signing you in, storing and syncing your boards, and running the features you use;
• to bill you and manage your plan;
• to keep Pastefield secure and prevent abuse, including rate limits;
• to answer support requests and send essential service emails (sign-in codes, billing and policy notices).

We rely on performing our contract with you, on our legitimate interest in running a secure service, and on legal obligations for billing records. We do not send marketing email without your consent.

4. AI features and link previews

When you use Pastefield AI, your request and the relevant content from your board are sent to Google’s Gemini API to generate a response, and search queries may be sent to Brave Search. Place cards may use Google Maps. When you paste a link, our server fetches that page, or the site’s official preview service (for example YouTube, Vimeo, TikTok, Dailymotion, Reddit, Giphy or Stack Exchange), to build the preview. Those sites see a request from our server, not from you.

5. Who processes data for us

• Supabase — database, file storage and live sync
• Railway — application hosting
• Stripe — payments and subscriptions
• Resend — sign-in and service emails
• Google — Google sign-in, the Gemini API and Google Maps
• Brave — web search for Pastefield AI

Each receives only what it needs for its task. These providers may process data outside Malaysia, including in the United States. We rely on their contractual and security commitments to protect it.

6. How long we keep it

• Account data and boards: while your account is open.
• Deleted boards: removed with their files by our daily cleanup. Individually deleted cards are kept for up to 45 days so undo and sync across devices work, then purged.
• Sessions: until you sign out or they expire (30 days by default). Sign-in codes: purged within a day of expiring.
• IP-based rate-limit records: about 2 days. API usage counts: 14 days.
• Billing records: as long as tax and accounting law requires.
• Closed accounts: deleted within 30 days of your request, apart from records we must keep by law. Backups held by our providers expire on their own schedules.

7. Cookies and local storage

We use one essential session cookie to keep you signed in, and a short-lived cookie that protects Google sign-in. Your browser’s local storage remembers small preferences such as where you were on each board. None of these are used for advertising or tracking, so there is nothing to opt out of.

8. Security

Connections are encrypted with HTTPS. Session tokens and API tokens are stored only as hashes, access to data is restricted per account, and payment details stay with Stripe. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

9. Your rights

You can ask to access, correct, export or delete your personal data, to withdraw consent, or to object to or restrict how we use it. Email support@pastefield.com from your account’s address; we will reply within 30 days. You can also complain to Malaysia’s Personal Data Protection Commissioner or your local data protection authority.

10. Children

Pastefield is not meant for children under 13. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes

We will update this page when our practices change and tell you by email or in the app about significant changes.