Privacy Notice
Effective October 18, 2026
This notice explains what personal information The Paypr Company, LLC ("Paypr", "we", "us") collects, why, who helps us process it, how long we keep it, and the choices and rights you have. It covers:
- the MultiPaaS website at multipaas.com, including early-access sign-up;
- the MultiPaaS platform: accounts, the console, the command-line tool and the APIs it generates; and
- apps that Paypr itself builds and runs on MultiPaaS.
Together we call these the "Services".
1. Contact
The Paypr Company, LLC is responsible for the personal information described here. For any privacy question or request, email legal@multipaas.com.
2. Data in apps our customers build
MultiPaaS lets customers build their own apps and store their own data, including information about their own users. For that data, the customer decides what is collected and why, and is responsible to their users for it. We process it on the customer's behalf and under their instructions, to provide the Services to them. If you use an app built on MultiPaaS by someone other than Paypr, read that app's own privacy notice and contact its operator about your data.
3. What we collect
Early-access sign-up
When you ask for early access, we collect your email address and, if you choose to give them, your name and what you would like to build. We use this only to contact you about MultiPaaS.
Account and sign-in
When you create or use an account, we collect your email address and name. You sign in with a one-time link we email to you, or with Google if you choose. With Google sign-in, Google shares your email address and whether that address is verified. We never see your Google password.
People you invite
When a user invites someone to manage the customer's apps, or into an app the customer built on MultiPaaS, they give us that person's email address. We store it and use it to send the invitation, whether or not that person already has an account. An invitation into an app a customer built on MultiPaaS is that customer's app data (see section 2): the customer decides to send it, and we send it on the customer's behalf.
What you put into the Services
We store what you and your users create and upload, such as data models, records, files, and your conversations with the AI assistant.
Usage and technical information
Our request logs record the caller's IP address, browser or user agent, the address requested and the time, and our servers record errors and diagnostic events. We use them to run, secure and fix the Services.
Payment information
Paid plans are billed through a payment processor. The processor collects your card details directly. We never receive or store your full card number. We receive limited information from the processor, such as your name, billing address, card type, the last four digits and expiry date, and your payment history.
Analytics
We use, or may use, analytics and monitoring services to understand how the Services are used and to keep them fast and reliable. These services can collect information such as pages viewed, features used, device and browser details, and approximate location derived from your IP address, sometimes through cookies or similar technologies.
The AI assistant
When you use the AI assistant in the console, what you type and the records the assistant reads to answer you are sent to AI model providers through our cloud provider, to produce its responses. That processing may take place in other regions, including outside the United States.
Cookies and browser storage
The platform uses essential cookies to keep you signed in and to protect Google sign-in, and browser storage to remember preferences such as your colour theme and the app you last opened. Paypr's apps keep your sign-in in your browser's session storage, which is cleared when you close the tab. The website itself does not set cookies today. If we add analytics cookies, we will ask for your consent where the law requires it.
4. How we use it, and our legal basis
- To provide the Services you ask for: running your account, storing and serving your data, signing you in and answering the AI assistant. Basis: performing our contract with you.
- To keep the Services secure and working: preventing abuse and fraud, debugging and monitoring. Basis: our legitimate interest in operating a safe, reliable service.
- To send an invitation to someone a user has invited to manage the customer's apps. Basis: our legitimate interests in operating the service the inviting customer uses. Invitations into an app a customer built on MultiPaaS are sent on that customer's behalf (see section 2).
- To communicate with you: sign-in links, service and account notices, and early-access updates. Basis: performing our contract, or your request for early access.
- To understand and improve the Services, including through analytics. Basis: our legitimate interests, or your consent where the law requires it.
- To take payments for paid plans. Basis: performing our contract with you.
- To meet legal obligations and to establish or defend legal claims. Basis: legal obligation and our legitimate interests.
5. We do not sell your information
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
6. Who processes it for us
We share personal information only as needed, with these kinds of recipients:
- our cloud hosting provider, which runs the Services, stores their data and delivers our email;
- AI model providers, reached through our cloud provider, when you use the AI assistant;
- Google, if you choose Google sign-in;
- a payment processor, for paid plans;
- analytics and monitoring providers;
- professional advisers, such as lawyers and accountants;
- authorities, when the law requires it or to protect rights and safety; and
- a buyer or successor, if Paypr's business is sold or reorganised, under protections at least as strong as these.
7. Where it is processed
The Services are hosted in the United States. Some providers, including AI model providers, may process information in other countries. Where the law requires it, for example for information from the European Economic Area or the United Kingdom, we rely on recognised safeguards for those transfers, such as standard contractual clauses.
8. How long we keep it
- Account information and what you put into the Services are kept while your account is open. Removing something in the Services deactivates it first: it stops being used and shown, but is not yet erased. We erase personal information on request (see section 10).
- Invitations, including the invited person's email address, are kept with the inviting customer's data. An accepted or expired invitation is not deleted automatically.
- Early-access sign-ups are kept until you ask us to remove them or we no longer need them to contact you.
- Server and request logs are kept for about a month. Backups expire on their own schedules.
- Payment records are kept for as long as tax and accounting law requires.
9. How we protect it
Information is encrypted in transit and at rest. Each customer's data is kept separate from every other customer's, and each customer's files are encrypted with that customer's own key. Access is limited to the people and systems that need it. No system is perfectly secure, but we work to protect your information and will tell you of a breach that affects you where the law requires.
10. Your rights
Depending on where you live, you may have the right to:
- know what personal information we hold about you, and get a copy of it;
- correct information that is wrong;
- have your information deleted;
- receive your information in a portable format;
- object to or restrict how we use it, including opting out of analytics; and
- withdraw consent you have given, without affecting earlier use.
US residents, including in California and Texas, may also opt out of the sale of personal information, targeted advertising and profiling. We do none of these. You will not be treated differently for using your rights. You may use an authorised agent, and if we decline your request you may appeal by replying to our decision.
In the European Economic Area and the United Kingdom, you may also complain to your local data protection authority.
To use any of these rights, email legal@multipaas.com. We will confirm your identity before acting and respond within the time the law allows. For data in an app a customer built on MultiPaaS, contact that app's operator; we will help them respond.
11. Children
The Services are not meant for children under 16, and we do not knowingly collect their personal information. If you believe a child has given us information, contact us and we will delete it.
12. Changes to this notice
We may update this notice. The effective date at the top shows when it last changed. If a change is significant, we will tell you by email or in the Services before it takes effect.