Cookie Policy

Last updated: August 8, 2026

This Cookie Policy explains how Flowstart Kft. (registered seat: Szugló utca 161. 1/2., 1141 Budapest, Hungary; company reg. no. 01 09 429426) — the operator of PapersIn (papersin.com) — uses cookies and similar technologies.

What we use

The cookies and browser storage PapersIn itself sets in your browser are:

Authentication cookies — keep you signed in to your account (session tokens issued at sign-in). When you sign out, the cookie that proves your sign-in is removed from your browser. A second cookie, which remembers the organisation you last viewed, stays in your browser after sign-out; on its own it grants no access to anything, and you can delete it in your browser at any time.
Security cookies — protect the sign-in flow against abusive requests started from another site.
Language preference cookie — if you switch the interface language, a cookie remembers that choice for your next visit. It lasts one year and can be deleted in your browser at any time.
Local storage — your browser's local storage keeps the choice you made on the consent bar (papersin:replayConsent) and, inside the signed-in app, a few convenience settings, such as which starting checklist you last picked when adding a client. This stays in your browser and is not sent to us.
Session recording and error monitoring — our error-monitoring provider's script loads with every page, on the public site as well as inside the signed-in app, and reports faults to us so that we can reproduce and fix problems. A session recording is only made with your permission: if you allow it on the consent bar, a sample of browsing sessions — currently one in ten, and every session in which an error occurs — is recorded. For this the script keeps an identifier for the current recording (sentryReplaySession) in your browser's session storage, which your browser clears when you close the tab. This is browser storage, not a cookie. The provider is named as a subprocessor in our Privacy Policy, which also describes the feedback form the same script places on our pages.
Product analytics (PostHog) — we measure visits to our pages, on the public site as well as inside the signed-in application, and which features of the application are used, so that we can improve the service. The analytics state is kept in your browser's session storage, which your browser clears when you close the tab; this is browser storage, not a cookie. Events are tied to a random identifier — once you are signed in, to an internal account identifier — and not to your name or e-mail address. The provider is named as a subprocessor in our Privacy Policy.

None of the above is used for advertising or cross-site tracking. We do not set advertising cookies, cross-site tracking cookies, or analytics cookies, and we do not sell data derived from cookies. Cookies set by third parties are governed by those parties' own policies; the main ones are described below.

The cookies PapersIn itself sets are all strictly necessary to provide the service, and placing strictly necessary cookies does not require consent — so we do not ask for consent to use them.

The bar you see on our pages is therefore not about cookies: it asks whether you allow us to record a sample of browsing sessions in order to diagnose errors. A recording is only made if you have allowed it on the bar. Your choice is kept in your browser's local storage (papersin:replayConsent), so the bar does not reappear on your next visit.

You can withdraw consent as easily as you gave it: reopen the bar on this page and choose "Only what's necessary".

If we ever use a cookie that is not strictly necessary, we will provide the legally required information in advance and give you a choice; no such cookie is set without your consent.

Third parties

Payment processing is handled by Stripe; when you enter checkout on stripe.com, Stripe sets its own cookies under its own policy.

If our support chat widget is present on a page, its provider's script loads together with the page and sets that provider's cookies at that point — before you open the chat, not when you open it. If the widget is not on the page, none of its cookies are set.

Managing cookies

You can delete or block cookies in your browser settings. Because our own cookies are strictly necessary, blocking them will prevent sign-in from working. Browser storage entries — including your consent choice (papersin:replayConsent) — can be viewed and deleted in your browser's site-data settings; deleting the choice simply makes the bar ask again on your next visit.

Contact

Questions: hello@papersin.com.

Language

This Cookie Policy is published in English and in Hungarian (Süti tájékoztató). Each version is binding in its own right: if you subscribed to PapersIn and contracted with us in Hungarian, the Hungarian version governs as between us, and the English version governs otherwise.

If you are not the contracting customer — for example, you are a visitor to our website — the version you were given governs.

What we use

The cookies and browser storage PapersIn itself sets in your browser are:

Authentication cookies — keep you signed in to your account (session tokens issued at sign-in). When you sign out, the cookie that proves your sign-in is removed from your browser. A second cookie, which remembers the organisation you last viewed, stays in your browser after sign-out; on its own it grants no access to anything, and you can delete it in your browser at any time.

Security cookies — protect the sign-in flow against abusive requests started from another site.

Language preference cookie — if you switch the interface language, a cookie remembers that choice for your next visit. It lasts one year and can be deleted in your browser at any time.

Local storage — your browser's local storage keeps the choice you made on the consent bar (papersin:replayConsent) and, inside the signed-in app, a few convenience settings, such as which starting checklist you last picked when adding a client. This stays in your browser and is not sent to us.

Session recording and error monitoring — our error-monitoring provider's script loads with every page, on the public site as well as inside the signed-in app, and reports faults to us so that we can reproduce and fix problems. A session recording is only made with your permission: if you allow it on the consent bar, a sample of browsing sessions — currently one in ten, and every session in which an error occurs — is recorded. For this the script keeps an identifier for the current recording (sentryReplaySession) in your browser's session storage, which your browser clears when you close the tab. This is browser storage, not a cookie. The provider is named as a subprocessor in our Privacy Policy, which also describes the feedback form the same script places on our pages.

Product analytics (PostHog) — we measure visits to our pages, on the public site as well as inside the signed-in application, and which features of the application are used, so that we can improve the service. The analytics state is kept in your browser's session storage, which your browser clears when you close the tab; this is browser storage, not a cookie. Events are tied to a random identifier — once you are signed in, to an internal account identifier — and not to your name or e-mail address. The provider is named as a subprocessor in our Privacy Policy.

The consent bar and session recording