Privacy Notice — PAPER customer service

Controller and contact

The controller is the operator stated below. Its licensed address is documented by Commercial License No. 1471379; the separate registered-office status is not established. The monitored privacy contact is info@pmgi.ae. Remaining legal details must be completed and approved before registration opens. Owner approval is not a claim of lawyer or regulator approval.

Information processed

Profile: first/last name, normalized email, generated customer ID, native tenant reference, verification/status, language, tier and accepted notice versions/timestamps. Authentication: scrypt password hash, hashed verification/reset tokens, session references and expiry; a one-time email-bound private invitation hash if private onboarding is authorized. Account: your simulated ledger, positions, account values and tenant-scoped PAPER statements, including observed modeled fees and missing period valuations. Security: login/creation/reset/verification/operator events and rate-limit request metadata.

Purposes and legal bases

Purposes are provision of the requested PAPER account, email verification/recovery and protecting access. OWNER_DECISION_REQUIRED: approve a category-specific lawful-basis mapping for service operation, authentication/security, acceptance evidence and any applicable legal obligations before opening. Acknowledging this notice is not blanket consent for all processing. No marketing consent is requested.

Recipients and processors

Only authorized operator/support staff may access necessary operational data; owner credentials and wallets are not customer context. DigitalOcean hosts the application database in its Frankfurt (fra1) region; Cloudflare serves the site through its network/tunnel; Hostinger Mail delivers verification and reset emails by HTTPS API. AUTHORITATIVE_EVIDENCE_REQUIRED for their relevant processing locations, terms, subprocessors and transfer safeguards; OWNER_DECISION_REQUIRED for approval before registration opens.

Email and AI

Email verification/reset messages contain time-limited links, never passwords. Necessary account security notices may be sent only to a verified customer address. Customer AI is disconnected; no customer context is sent to the owner-global model, another customer, marketing service or internal research agent.

Retention and deletion

OWNER_DECISION_REQUIRED: approve and implement a category-specific retention and deletion schedule before registration opens. Verification links expire after 24 hours, reset links after 30 minutes, and authenticated sessions after 30 minutes; expiry does not remove their database rows. Customer records, security logs and backups have no approved deletion interval or automated purge. Until a policy is approved, a verified closure request can disable access and revoke sessions and tokens, with records retained pending a documented deletion decision.

Your rights

Where applicable you can request access, correction, erasure, restriction, portability or object to processing; withdraw consent where processing relies on consent. Contact info@pmgi.ae for a data request; do not send a password or recovery link. Identity checks may be needed without collecting a password. You may complain to the competent supervisory authority; the competent authority and any UAE or customer-location requirements must be established for the Dubai, UAE operator before opening.

Website cookies and access logs

AITS uses a necessary secure, HttpOnly, SameSite=Lax session cookie for sign-in and CSRF protection. The authenticated session lifetime is 30 minutes. Current AITS application source contains no marketing or analytics cookies or third-party tracking scripts. Cloudflare and hosting services may generate access, network-error and security logs, and Cloudflare may set security cookies when its controls require them. Their settings, retention and processing locations require verification. The AITS app has no optional cookie; whether an additional consent interface is required for a particular audience remains OWNER_DECISION_REQUIRED.

Security and choices

Secrets and raw recovery links are excluded from owner reports. TLS, scoped authorization, hashed passwords and expiring sessions reduce exposure but do not promise absolute security. The current local Droplet disk and same-host database backups are not encrypted at rest; registration is closed pending verified protection and recovery controls. No ID document is requested. Required account information is needed to provide the PAPER service; without it a customer account cannot be created. No automatic decision with legal or similarly significant effects is provided by this PAPER service.

Final-review package

The complete V9 preparation at /legal-review-package includes risk, custody/access, concrete proposed retention, processor disclosures, complaints and incident procedures. EXTERNAL_APPROVAL_REQUIRED applies to professional/operational approval, not missing drafting. Proposed retention is not activated deletion. Registration remains CLOSED.

Details requiring approval

Operator / controller

P M G I PROJECT MANAGEMENT SERVICES L.L.C

Licensed operator address (Commercial License No. 1471379; registered-office status separate)

Office C1802-51, Business Bay, Dubai, UAE

Privacy contact

info@pmgi.ae

Support contact

info@pmgi.ae

Transactional mail provider

Hostinger Mail

Approved legal bases

OWNER_DECISION_REQUIRED

Actual retention policy

OWNER_DECISION_REQUIRED

Processors / locations / transfer safeguards

AUTHORITATIVE_EVIDENCE_REQUIRED