PagyzPrivacy Policy
Last updated: November 2, 2026
This policy explains what personal data Pagyz collects, why, and who helps us process it. Pagyz is a research workspace. You upload papers, write notes and highlights, and Pagyz suggests related research.
1. Who is responsible
The controller under the GDPR is:
Darshan Vaghani, Pagyz, Weidenauer Straße 51, 57076 Siegen, Germany
Email: hello@pagyz.com
We are not required to appoint a data protection officer (§ 38 BDSG). For all privacy questions, write to hello@pagyz.com.
2. What data we process
| Data | Types | Why | Legal basis (GDPR) |
|---|---|---|---|
| Account data | Name, email address, profile picture from Google or Microsoft, password hash (if you sign up by email) | To create and secure your account | Art. 6(1)(b) contract |
| Research content | Uploaded PDFs, notes, highlights, annotations, journal entries, mind maps, project descriptions, library entries | To provide the workspace and personal paper suggestions | Art. 6(1)(b) contract |
| Search and usage data | Search queries, papers you open, save or dismiss | To improve suggestions for your research | Art. 6(1)(b) contract |
| Technical data | IP address, browser type, time of access, error logs | To run the service safely and fix errors | Art. 6(1)(f) legitimate interest in a secure, working service |
| Emails | Sign-up confirmation, password reset, important service notices | To manage your account | Art. 6(1)(b) contract |
| Waitlist | Email address, field of study and role (optional), the time you agreed. We first send a confirmation link; every email has a link to leave the list, which deletes your address. | To confirm your address and to tell you about Pagyz | Art. 6(1)(a) consent |
| Contact form | Email address, your message | To answer you | Art. 6(1)(b) or (f) |
| Join Team applications | Name, email address, role, your message, LinkedIn and GitHub links (optional), up to 3 files (PDF or JPG) that you attach | To review your application and answer you. Only the founders read it. The files are kept in a private store and shared with us only through links that expire after 7 days. | Art. 6(1)(a) consent (you agree in the form) and Art. 6(1)(b) steps before a contract |
We do not sell your data. We do not use your research content for advertising. We do not use it to train our own or third-party AI models.
3. Cookies and local storage
Pagyz stores a sign-in token in your browser's local storage. Without it, you would have to sign in on every page. This is technically necessary, so no consent is needed (§ 25(2) No. 2 TDDDG). We use no tracking, analytics or advertising cookies. [If this changes, we will ask for your consent first.]
4. Service providers who process data for us
These providers process data only on our instructions, under a data processing agreement (Art. 28 GDPR).
| Provider | What they do | Data they see | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase Inc., USA | Database, file storage, sign-in, server functions; also stores waitlist, contact and job-application form entries | All account data, research content and form entries | Servers in Frankfurt, Germany (EU) | DPA; Standard Contractual Clauses for any access from the USA |
| Vercel Inc., USA | Hosts the website and app | Technical data (IP address, logs) | EU region / global edge network | DPA; EU–US Data Privacy Framework and Standard Contractual Clauses |
| Scaleway SAS, France | Sends account emails and the emails of our website forms (from noreply@send.pagyz.com), including the notification that an application or message arrived | Email address, email content | EU (France) | Within the EU |
| OpenAI, L.L.C., USA | AI analysis: reads text from your project to understand your research, write short summaries of it (your project brief) and judge which papers fit; turns text into numbers (embeddings) so that similar passages can be found | For each task, only the text parts it needs: project title and description, notes, journal entries, highlights, passages of your PDFs, the text you select or type when you ask for related papers, lines of your project brief, and the titles and abstracts of candidate papers. No name, email address or account ID. | USA | DPA; Standard Contractual Clauses. OpenAI does not use API data to train its models. It may keep data up to 30 days for abuse checks |
| Spaceship, Inc., USA (Spacemail and domain name service for pagyz.com) | Hosts our mailboxes, so it receives emails you send us; runs the domain name service for pagyz.com | Name, email address, message of an email you send us; the domain name records of pagyz.com (no user data) | USA | [Safeguard] |
| OVHcloud SAS, France | Hosts the server on which we run our PDF reader (GROBID, open-source software that we operate ourselves): it extracts title, authors, sections and the reference list from your uploaded PDFs. It also relays the lookup of a reference (its title or DOI) to Crossref for us. | The full uploaded PDF file; titles and DOIs of references found in it | EU (France) | Within the EU |
5. Paper databases and other services our servers call
To find papers and check their details, Pagyz sends requests from our servers to open scholarly databases and public services:
- OpenAlex (OurResearch, USA): paper search and details
- Crossref (Crossref, USA/UK): details of a paper, retraction notices, DOI lookup
- Semantic Scholar (Allen Institute for AI, USA): paper search on our older search path, which we plan to retire; it is used only while the newer search is switched off
- Unpaywall (OurResearch, USA): finds a free legal copy of a paper
- arXiv (Cornell University, USA) and PubMed / NCBI (U.S. National Library of Medicine): details of a paper when you add it by its arXiv or PubMed ID
- doi.org (DOI Foundation): resolves a DOI to its publisher page
These requests come from our servers, not from your browser. They never contain your name, email address or account ID. They do contain what the search needs: the text you selected or typed when you ask for related papers (the first part of it, sent as written), search terms we derive from it, and the DOIs, titles or IDs of papers in your library or in a reference you add. Several of these services also receive our own contact address (api@pagyz.com) as the polite-use address they ask for. Please do not put personal data about other people into text you search with.
When you add an open-access PDF to your library, our server first checks that the link points to a public server. For that check it asks a public DNS service (Cloudflare, Inc., USA, cloudflare-dns.com) for the address of the link's host name. That service sees only the host name (for example "arxiv.org"), not the full link, your text or any account data. It then downloads the PDF from that host.
6. Sign-in with Google or Microsoft
You can sign in with Google (Google Ireland Limited, Ireland) or Microsoft (Microsoft Ireland Operations Limited, Ireland). The provider then shares your name, email address and profile picture with us. We use them only to create your account and show who is signed in. We request no access to your Gmail, Google Drive, calendar, contacts or Microsoft files.
Google and Microsoft also learn that you signed in to Pagyz. Their own privacy policies apply to that. Data may go to their parent companies in the USA; both are certified under the EU–US Data Privacy Framework.
Pagyz's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. How long we keep data
- Account and research content: as long as your account exists. When you delete your account, we delete this data within 30 days. Backups are overwritten within 30 days.
- Server logs: up to 30 days
- Waitlist: until you leave the list (link in every email) or Pagyz opens.
- Join Team applications and their files: deleted automatically after 6 months, unless we agree otherwise with you. You can ask us to delete them earlier.
- Contact messages: until your question is solved, then within 6 months, unless law requires longer.
8. Automated processing
Pagyz uses AI to suggest papers. These suggestions have no legal effect on you. There is no automated decision in the sense of Art. 22 GDPR. AI output can be wrong; always check the original source.
9. Your rights
You have the right to access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). You can withdraw consent at any time, with effect for the future. Write to hello@pagyz.com.
You can also complain to a data protection authority. Ours is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
10. Do you have to give us data?
You need an email address to use Pagyz. Everything else you upload or write is your choice. Without content, Pagyz cannot give personal suggestions.
11. Changes
We update this policy when Pagyz changes, for example when we add a service provider. The date at the top shows the latest version. We will tell users by email about important changes.