Reading a paper on Pastlit needs no account and collects nothing about you beyond ordinary web traffic. This policy explains what changes when you sign up, subscribe, or link an account — and how we treat information about young people.
The data controller is PASTLIT (SMC-PRIVATE) LIMITED, Rawalpindi, Pakistan. Contact: hello@pastlit.com. Where Paddle sells you a subscription (see section 5), Paddle is a separate controller for the payment itself.
2 · What we collect
If you only read
Nothing personal. Our servers and content network see the ordinary technical details of any web request — IP address, browser, pages requested — and we keep short-lived logs of that for security and to keep the site running.
If you create an account
Identity: your email address, name if you give one, and whether your email or phone has been verified. Sign-in is handled by Clerk (section 5); we store only the verification flags and an identifier, not your password.
Role: whether you signed up as a student, teacher or parent.
Study data: the subjects on your shelf, papers you build or save, practice attempts, the answers you enter, marks awarded, and the topic-level progress derived from them.
Links: which teacher shares you have opened, and which parent account (if any) is linked to yours — and vice versa.
Referrals: if you arrived through someone’s referral link, we record that so they get credit.
If you subscribe
Paddle handles the payment. We never see or store your card number or bank details.
We receive from Paddle: your plan, its status (active, past due, cancelled), the current billing period, and Paddle’s customer and subscription identifiers, so we can switch paid features on and off.
Analytics
With your consent (asked on first visit) we use Google Analytics and Microsoft Clarity to understand how the site is used. These set cookies and collect usage data such as pages viewed, approximate location and device type. You can decline, and nothing on the site changes if you do.
3 · Why, and on what legal basis
To provide the service you asked for — an account, practice, marking, sharing, subscriptions. Basis: performance of a contract with you.
To keep the service secure and working — logs, abuse prevention, rate limits. Basis: our legitimate interest in running a safe service.
To understand and improve the service — analytics. Basis: your consent.
To tell you things about your account — receipts, renewal notices, changes to terms. Basis: contract and legal obligation.
To tell you about Pastlit — new features, study resources and offers, by email. Basis: your consent, or, where the law allows it for existing customers, our legitimate interest in telling you about similar services. Every such email carries an unsubscribe link, and opting out never affects your account or your plan.
To meet legal obligations — tax, accounting, responding to lawful requests.
We do not sell personal data, and we do not use it for advertising.
4 · Children and young people
Most Pastlit students are between 14 and 18. We design for that:
Under 13: you may not create an account. If we learn that a child under 13 has one, we will delete it.
13 to 17: an account may be created only with the knowledge and consent of a parent or guardian.
Privacy by default: a student’s progress is visible only to the student, to a teacher whose share they have opened, and to a parent they have linked. There are no public profiles, leaderboards show only what a student chose to submit to a share, and nothing is indexed by search engines.
No profiling for advertising, ever. We do not build interest profiles, and we do not show ads.
Minimal data. We collect what the tools need — answers and marks — and not more. We do not ask for date of birth, school, or address.
Parents can ask us to see, correct or delete their child’s data, and can remove a parent link at any time from their own account.
If you are a parent or guardian with a question about a young person’s account, email hello@pastlit.com and we will prioritise it.
5 · Who we share data with
Only the providers needed to run the service, each under a contract that restricts what they can do with the data:
Clerk — authentication. Holds your email, password and sign-in sessions.
Supabase — our database, where account and study data live.
Cloudflare — hosting, content delivery and file storage for papers and images.
Paddle — payments, as merchant of record. Paddle receives your email and billing details directly from you at checkout. Paddle’s privacy policy covers what it does with them.
Google Analytics and Microsoft Clarity — analytics, only with your consent.
Google (Gemini) — automated marking of written answers, where that feature is enabled. The text of the answer and the question are sent for marking; your identity is not.
We will disclose data if the law requires it, or to protect the rights or safety of Pastlit or its users. If Pastlit is ever acquired, data may transfer to the new owner under this policy.
6 · Where data is stored
Pastlit is operated from Pakistan and its providers run infrastructure outside Pakistan — principally in Japan (database), the United States (authentication, analytics) and the United Kingdom (payments), with content delivered from Cloudflare’s global network. By using the service you understand that your data is processed in those places. Where the law of your country requires safeguards for such transfers (for example the UK or EU), we rely on our providers’ standard contractual clauses.
7 · How long we keep it
Account and study data: for as long as your account exists.
Subscription records: for as long as tax and accounting law requires after the last payment.
Server logs: a short rolling window, typically under 30 days.
Analytics: per the retention settings of the analytics provider, which we keep at the shortest available.
When you close your account we delete your study data. Some records may persist in backups for a limited period before they are overwritten.
8 · Your rights
You can ask us to show you the data we hold about you, correct it, delete it, give it to you in a portable form, or stop processing it in a particular way. If you are in the UK or EU you have these rights under the UK GDPR and GDPR, including the right to complain to your data protection authority; residents of other places have equivalent rights under their local law. To exercise any of them, email hello@pastlit.com from the address on your account. We answer within 30 days.
9 · Cookies
Essential: the sign-in session, a preference for your region, and a referral marker if you arrived by referral link. These make the site work and need no consent.
Analytics: set only after you consent. Declining is a single click and is remembered.
Advertising: none. We do not use advertising cookies or trackers.
10 · Security
Data is encrypted in transit, access is limited to what running the service requires, and passwords are never stored by us at all — they live with Clerk. No system is perfectly secure; if we ever discover a breach that affects you, we will tell you and the relevant authorities as the law requires.
11 · Changes
We will update this policy as the service changes. Material changes are announced on the site or by email before they take effect, and the effective date at the top always reflects the current version.