1. Who we are
This website is operated by Papilla (“we”, “us”, or “our”), based in Dubai, United Arab Emirates. If you have questions about this policy or your data, contact us at hello@papilla.io.
2. What we collect
Depending on how you use the site, we may collect:
- Contact form: name, email address, phone number (optional), service interest, and message content when you submit the form.
- Newsletter: email address when you subscribe via the footer or blog signup forms.
- Daily case reminders: the email address or browser push address you give when you ask for a reminder, your time zone, and when each reminder was sent and opened. A push reminder is delivered through your browser maker's push service.
- Ratings and comments: the thumb and any comment you leave on a case or a session, with the marks you placed on that case. Comments are emailed to us. An email address you add to a comment is used only to reply to you.
- Account data: email address and authentication credentials when you create an account or sign in.
- Learning activity: when you use the course, we record what you answered, how long you took, and which lessons you have completed. This is what lets the course show your progress, schedule your reviews, and pick radiographs you have not seen before.
- Technical data: standard server logs (e.g., IP address, browser type, timestamps) needed to operate and secure the site.
- Signup context: when you submit a form or subscribe, we store the IP address, browser type, referring page, and approximate location (country, city, region, and time zone, derived from your IP by our hosting provider) alongside that record. We use it to detect abuse and to understand where our readers come from.
3. How we use your information
We use personal information to:
- Respond to enquiries and project requests.
- Send newsletter content you have opted in to receive.
- Authenticate you and provide access to protected features.
- Maintain security, prevent abuse, and improve the reliability of the website.
We do not sell your personal information.
4. Third-party services
We use trusted providers to run parts of this site. They process data on our behalf under their own strict privacy terms:
- Plunk — newsletter management.
- ZeptoMail — sign-in codes, reminders and other emails about your account.
- Supabase — user authentication and account-related storage.
- Yandex Metrica — website analytics. It sets its own cookies and records how pages are used, including a session-replay feature that captures mouse movement, clicks, scrolling and the pages you view, so that we can see where the site is confusing. Replay runs across the site, including the signed-in app and the sign-in page. What you type into a form is excluded: the site tells Metrica not to capture keystrokes or field contents, so passwords, email addresses and payment details do not appear in a recording.
5. Cookies and local storage
We use essential cookies and similar technologies to keep you signed in and to protect the site. We also use Yandex Metrica for website analytics, which sets its own cookies to recognise returning visitors and measure how the site is used. Under a random identifier kept in your browser, we record which pages you open, how long each stays on screen and how far you scroll it, your browser's language, the site that linked you here, and any campaign tags or ad click identifiers in that link. On the practice pages the same record covers which radiographs you were shown, where you tapped, and how long each read took. It is tied to your account when you are signed in, and we use it to see how people find the site and to improve the teaching. We do not use advertising cookies and we do not sell your data.
6. Retention
We keep information only as long as needed: enquiry records for a reasonable business period, newsletter data until you unsubscribe, account data while your account is active, and usage logs as required for billing and security. You may ask us to delete your account and your data at any time. We delete them 30 days after the request, and you can withdraw it until then.
7. Your rights
Depending on where you live (including under UAE and GDPR data protection laws), you may have rights to access, correct, delete, or restrict the use of your personal data. To exercise these rights, email hello@papilla.io.
8. Security
We take reasonable technical and organisational measures to protect your information. However, no method of transmission over the internet is completely secure.
9. Children
This site is not directed at children under 16, and we do not knowingly collect personal information from children.
10. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top reflects the current version. Continued use of the site after changes means you accept the revised policy.