Privacy Policy for Folderling

Last updated: 16 September 2026

This policy explains how Folderling processes personal data when you use our website, web application, or mobile application (together, the “Service”). Folderling is the controller of the personal data described here. You can contact us at [email protected].

We do not sell your personal data, and we do not use your documents or activity for third-party advertising.

Data we process

  • Account and authentication data: your email address, password hash, sign-in and session records, and security tokens. If you belong to a shared Folderling account, we also process your membership and role.
  • Documents and document data: files you upload or share with the mobile app, filenames, extracted text, document images, titles, dates, tags, search indexes and embeddings, review suggestions, and processing status or errors.
  • Questions and AI context: questions you ask about your documents and the relevant document passages used to answer them.
  • Usage, device, and diagnostic data: IP address, browser or device type, operating system and app version, pages or features used, request and update identifiers, crash reports, performance traces, and security events. We configure our diagnostics to avoid document contents, authentication tokens, and directly identifying account data where practical.
  • Billing data: subscription status, customer and transaction identifiers, and limited billing details received from Stripe. Folderling does not receive your full payment-card number.
  • Communications: messages you send to support, feedback, and your newsletter preference.

How we receive data

We receive most data directly from you when you create an account, upload or share documents, review documents, search, ask questions, subscribe, or contact us. We also receive service and diagnostic data automatically from your browser, device, and our infrastructure, and receive subscription or payment status from Stripe.

We process personal data for the following purposes and legal bases:

  • To provide the Service and perform our contract with you: create and secure your account; store, process, search, display, export, and delete documents; provide Inbox review and AI-assisted features; and administer subscriptions.
  • For our legitimate interests: operate, secure, troubleshoot, and improve Folderling; prevent abuse and fraud; and understand aggregate product usage. We balance these interests against your rights and expectations.
  • With your consent: send optional marketing or newsletter messages. You may withdraw consent at any time using the unsubscribe link or by contacting us.
  • To comply with legal obligations: retain required billing records and respond to valid legal requests.

Document processing and AI

Folderling extracts text and other metadata from uploaded documents so that you can organize and search them. We use OpenAI's API to create search embeddings, suggest titles, dates, and tags for Inbox review, and answer questions using relevant document context. This means the document text, existing tag names, your question, or relevant passages may be sent to OpenAI when the corresponding feature is used.

AI suggestions can be incorrect. They are intended to assist your review, and do not make decisions with legal or similarly significant effects about you. See OpenAI's enterprise privacy information for information about how OpenAI handles business and API data.

The mobile app

The mobile app stores a sign-in credential in the device's protected secure storage and may store preferences such as your selected folder locally. PDFs opened in the app and files received through your device's share or file picker may be held temporarily in app or operating-system cache while they are viewed or uploaded. Folderling removes its temporary PDF copy on a best-effort basis when you close it. Files you export to another app or location are then controlled by that destination and your device settings.

We use Expo services to build and deliver compatible app updates. The app does not scan documents or request camera access as part of the features covered by this policy.

Service providers and international transfers

We use service providers to operate Folderling. They process data only for the services they provide to us and under their own contractual and legal obligations:

  • Neon — database hosting
  • Amazon Web Services — document and export storage
  • Fly.io — application hosting
  • Cloudflare — network delivery, security, and abuse protection
  • OpenAI — document AI and embeddings
  • Sentry — error and crash diagnostics
  • Honeycomb — operational tracing and performance diagnostics
  • Mailjet — transactional email delivery
  • EmailOctopus — optional newsletter delivery if you subscribe
  • Stripe — subscriptions and payment processing
  • Umami Cloud — website usage analytics
  • Expo — mobile build and update delivery

Providers may process data in the European Economic Area and in other countries. Where required, we rely on appropriate safeguards for transfers of personal data, such as adequacy decisions or standard contractual clauses.

How long we keep data

We keep your account and documents while your account is active. On a valid deletion or account-cancellation request, we delete account data and files from active systems within 30 days, except where continued retention is required for billing, legal, security, fraud-prevention, or dispute purposes. Residual backup copies are removed according to their normal rotation schedules.

Temporary uploads that are not completed are automatically expired and cleaned up. Diagnostic and security records are retained only for the period reasonably needed to investigate problems, protect the Service, and meet legal obligations.

Security

We use technical and organizational measures intended to protect personal data, including encrypted network connections, access controls, protected mobile credential storage, and monitoring. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

Cookies and analytics

The website uses essential cookies to maintain sessions and keep users signed in. Blocking them may prevent authenticated features from working. We also use Umami Cloud to understand website usage. We do not use advertising cookies or share browsing data with advertising partners.

Marketing

We send marketing or newsletter emails only when you have opted in. You can unsubscribe using the link in an email or by contacting us. Service messages needed to operate your account are not marketing.

Your data-protection rights

Depending on where you live and subject to applicable conditions, you may have the right to access, correct, erase, restrict, or object to processing of your personal data; receive portable data; and withdraw consent without affecting earlier processing. You may also lodge a complaint with the data protection authority in your country.

To exercise a right, email [email protected]. We may need to verify your identity. We normally respond within one month, or tell you if applicable law permits additional time.

Other websites and apps

Folderling may link to websites or apps that we do not control. Their own privacy policies govern how they process your data.

Changes to this policy

We may update this policy as Folderling changes. We will publish the current version here and update the date above. We will provide additional notice when required by law or when a change materially affects how we use your personal data.

Contact

Questions, privacy requests, and complaints can be sent to [email protected].