Legal
Privacy policy
Last updated 20 September 2026
This policy explains what personal data Pareto Paradigm collects when you use the Pareto Paradigm platform, why, and what rights you have under the General Data Protection Regulation.Pareto Paradigm is the controller for account data; for the contents of the project documents you upload, your organisation is the controller and we act as its processor.
What we collect
- Account data: email address, name, workspace membership and role, and the time of sign-ins. Sign-in uses one-time email links; we store no passwords.
- Project data: the documents, models and cost data you upload, what our analysis extracts from them, the savings proposed, and the decisions, comments and feedback your team records, with the name and role of the person who made them.
- Usage data: which features are used and how many AI tokens each analysis consumed, for metering and improving the Service. We do not run third-party advertising or tracking.
Why we process it
- To provide the Service you signed up for (performance of a contract).
- To keep an audit trail of who approved what, which your organisation needs for its records (legitimate interest).
- To secure the Service, meter usage and bill (legitimate interest and contract).
- To send transactional messages such as sign-in links and invitations. We send no marketing without consent.
Who processes it for us
Data is stored with Supabase (database, file storage and authentication) and served through Vercel. Document analysis and the AI Engineer use Anthropic's API; document contents are sent to Anthropic for processing and are not used by Anthropic to train its models under our commercial terms. Emails may be sent through Resend. Each provider is bound by a data processing agreement. Some providers process data outside the European Economic Area under standard contractual clauses.
How long we keep it
Project data stays as long as your workspace exists. Deleting a document, project, workspace or account removes the associated data; files are removed from storage at the same time. Backups expire within 30 days. Usage records are kept in aggregate for accounting.
Your rights
You can see and change your name in Settings and delete your account there. You may also ask us for access, correction, erasure, restriction or portability of your data, or object to processing, by writing to privacy@paretoparadigm.com. You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.
Security
Data is encrypted in transit and at rest. Access to workspace data is enforced at the database level so that members only ever see their own organisation's records. File links are signed and expire within minutes.
Contact
Pareto Paradigm, Estonia. privacy@paretoparadigm.com. We update this policy when our processing changes and note the date above.