Privacy notice

Who is responsible

The data controller is Amir Ehsan Hosseini, trading as Range Paper, at flat 2, AJC Residence, Triq Ta Giorni, STJ 1120, Malta.

For privacy questions or to exercise a data-protection right, email rangepaper.business@gmail.com. RangePaper may ask for information reasonably needed to confirm your identity and protect another person’s data.

Data RangePaper processes

Public pages and hosting

Railway hosts the website and may process ordinary request and security data needed to deliver it, such as IP address, request time and path, and browser or device information. RangePaper’s own public analytics collector does not accept IP addresses, user agents, page URLs or full referrers in its event payload.

Optional public analytics

Analytics is off unless you choose Accept on a public product page. If accepted, RangePaper sends a short random visit identifier and fixed categories for the page, actions, referral source, internal entry and errors. It does not send product lists, photos, contacts, prices, quantities, form values, filenames or purchase state. The identifier is hashed with the date and environment; receipt hashes older than eight days are removed opportunistically, while aggregate daily counts remain.

Your analytics choice is stored in your browser’s local storage under rangepaper.analytics-consent.v2. You can change the choice from the analytics control on a public product page. The four policy pages do not load analytics or any other script.

Local document tools

Catalog data, prices, contacts, quantities and imported photos entered in the public demo or downloaded offline edition are processed in your browser. RangePaper does not receive them through those tools. Files you save stay wherever you choose to store them.

Purchases and delivery

Stripe receives checkout, payment, billing and verified email information. RangePaper receives and stores provider and order identifiers, the quoted subtotal and discount, tax and paid totals, entitlement and payment state, event and reconciliation timestamps, and a keyed digest of the verified email address. The payment ledger does not store that email address in plaintext and RangePaper does not receive full card details.

Resend receives the verified email address and the recovery-email content to send the private link. RangePaper’s delivery record can include a hashed recipient, provider message identifier, delivery-attempt times and a bounded error code. Open and click tracking is not enabled for the recovery email.

An essential __Host-rp_purchase cookie connects the browser to its order and download entitlement. It is Secure, HttpOnly, SameSite=Lax and set for up to one year. The private recovery token is placed after the # in the email link, cleared from the address by the purchase page, and exchanged for the same type of essential cookie.

Support and refunds

If you contact RangePaper, it receives your email address, message and any information you choose to provide. Support may use limited purchase details to locate an order, answer the request, process a refund or handle a complaint. Do not send card numbers, passwords or a private recovery link.

Why the data is used

• Contract: to create and confirm an order, deliver the purchased edition, provide recovery and purchase support, and administer the 14-day refund policy.
• Legitimate interests: to secure the service, prevent fraud and duplicate fulfillment, diagnose failures, keep necessary business records, and respond to non-purchase enquiries. RangePaper considers these uses necessary and limited to running and protecting the service.
• Consent: to collect the optional aggregate public analytics described above. You can withdraw that choice from a public product page without affecting earlier lawful processing.
• Legal obligations: to keep or disclose records when applicable accounting, tax, consumer, regulatory or legal requirements require it.

RangePaper does not use purchase or support data for solely automated decisions that have legal or similarly significant effects.

Service providers and recipients

RangePaper uses service providers only for the functions described here:

• Stripe for checkout, payment, fraud controls, refunds and payment records.
• Resend for the purchase recovery email.
• Railway for application hosting, request handling and durable service data.
• Google for the Gmail support mailbox and its messages.

Information may also be disclosed when required by law, to protect legal rights, or to a professional adviser under an appropriate duty of confidence. RangePaper does not sell personal data.

International processing

Stripe, Resend and Railway may process data outside Malta or the European Economic Area. Their linked notices describe their locations and transfer arrangements. Railway states that transfers may use a data-processing agreement with standard contractual clauses and/or the EU–US Data Privacy Framework; Stripe publishes a data-transfer addendum; Resend states that it processes data in the United States and applies controls to transfers.

Which safeguard applies depends on the provider, service and transfer. RangePaper does not claim that one mechanism covers every transfer and will use the protection required by applicable data-protection law.

How long data is kept

RangePaper does not publish a fixed deletion date where the necessary period depends on the record. Purchase, payment, refund, dispute and support records are kept only as long as needed to deliver and recover the product, handle enquiries and claims, protect the service, and meet applicable accounting, tax, consumer and legal obligations. They are then deleted or anonymised when no longer needed.

The analytics consent choice remains in your browser until you change it, clear site data or the storage is otherwise removed. Aggregate analytics counts may be retained as non-identifying business statistics. Provider-held data is subject to each provider’s retention practices and legal duties.

Your rights

Depending on the applicable law, you may have rights to be informed, access personal data, correct it, erase it, restrict its use, object to processing, receive portable data, and withdraw consent. These rights can have lawful limits, including where records must be kept for a legal obligation or legal claims.

Send a request to rangepaper.business@gmail.com. You may also complain to Malta’s Information and Data Protection Commissioner using its complaint process, or to another competent supervisory authority.

The European Commission provides more information about individual data-protection rights.

Changes to this notice

RangePaper may update this notice when its services, providers or legal obligations change. The effective date identifies the current published version. Material changes affecting existing customers will be communicated where applicable law requires it.