Privacy Policy

Papertools provides cloud-based invoicing and business-management software for small and medium businesses. In this policy, “Papertools,” “we,” and “us” refer to Papertools (ABN 43 403 083 077), a sole trader based in Western Australia, Australia, which operates the Service. You can reach us at support@papertools.app.

• Account information — your name, email address, phone number, and authentication credentials. Passwords are stored only as salted hashes by our authentication provider; we never see them in plain text.
• Business & workspace data — the invoices, estimates, expenses, customers, vendors, projects, payroll, mileage logs, bank statement lines you import, and other records you create or upload within a workspace. This can include statutory identifiers of your own staff (for example tax file numbers), which we hold on your behalf as described in section 5.
• Bank connections — if you connect a bank account through one of the aggregators listed in section 6, we receive the account’s name, type, balance and transaction history from that provider and hold an access token for it. We use this only to bring your transactions into your own books for matching; we never see your online-banking credentials, which you enter with the provider, not with us. The token is encrypted at rest and is deleted when you disconnect.
• Voice input — if you use the assistant’s voice features, your audio is processed to convert it to text; the text is what the Service works with.
• Preferences — settings you choose, including whether you’ve opted in to product updates by email (and when you answered).
• Usage & device data — log data, IP address, browser and device type, and actions taken in the app, used to operate, secure, and improve the Service.
• Cookies — strictly necessary cookies that keep you signed in (see “Cookies” below).

We do not collect payment card numbers directly; any payments are handled by a third-party payment processor.

We use the information we collect to:

• provide, maintain, and improve the Service;
• authenticate you and protect account security;
• send transactional and security emails (e.g. confirmations, password resets, security alerts);
• send you occasional product updates and tips — only if you’ve opted in; every such email includes a one-click unsubscribe, and you can change your preference anytime in your account;
• provide customer support; and
• comply with legal obligations.

We do not sell your personal information.

The Service includes a built-in assistant (“Paper-Ai”) that can draft documents and answer questions about your workspace, with optional voice input and spoken replies. When you use these features, the content involved — your instructions and the workspace data needed to act on them — is processed by the AI service providers listed in section 6, under agreements that limit their use of it to providing the service to us. Nothing the assistant drafts is saved to your records until you review and confirm it. If you don’t use the assistant, no data is sent to these providers.

Your workspace holds personal data about your own customers, vendors, and staff — their names, contact details, statutory identifiers you record, and the documents you address to them. For that data you are the controller and we act as your processor: we handle it only to provide the Service to you and on your instructions. You are responsible for having a lawful basis to provide it to us and for its accuracy, and — when you send a document — for the content of the message and for having permission to contact the recipient. Documents you choose to share by public link are viewable by anyone who has the link. Business customers can request a data processing agreement (DPA) from us.

We share data with vendors who help us run the Service, under agreements that limit their use of it to providing services to us. We may also disclose information where required by law or to protect the Service and its users.

Our key sub-processors are:

• Supabase — database, authentication, and file-storage hosting.
• Vercel — application hosting and privacy-friendly, cookieless analytics.
• Resend — transactional email delivery (confirmations, invoices, receipts).
• Stripe — subscription and invoice payment processing. Card details go directly to Stripe; we never store them. If you connect your own Stripe account, payments your customers make on your documents go directly to your Stripe account — we are not in that money flow.
• Anthropic — AI processing for the built-in assistant (drafting and answering), only when you use the assistant.
• Deepgram — converts your speech to text, only when you use voice input.
• OpenAI — generates the assistant’s spoken replies, only when you use voice responses.
• Google Workspace — our business email, e.g. messages you send to support@papertools.app.

If you connect a bank account for live bank feeds, the connection runs through one of the following bank-data aggregators, depending on where the bank is. Each receives only what is needed to link the account you choose and return its transactions to us, under its own terms, and only for the account you connect through it:

• Finverse — banks in Malaysia and Southeast Asia.
• Envestnet | Yodlee — banks in the United States, United Kingdom, Australia and Canada.
• Plaid — banks in the United States and Canada. Connections made through Plaid are also subject to Plaid’s End User Privacy Policy.
• Enable Banking — banks in Europe and the United Kingdom.
• Lean Technologies — banks in the Gulf states.
• Basiq — banks in Australia and New Zealand.

Which aggregators are available to you depends on your region and plan; the connection screen names the provider before you proceed, and by proceeding you authorise us and that provider to retrieve the account’s details and transactions from your bank on your behalf, under the provider’s own terms and privacy policy.

We keep account and workspace data while your account is active. When you delete a workspace, its data is retained for a 7-day grace period (so you can restore it) and then permanently deleted. When you close your account, we confirm with an emailed code and permanently delete it after a short grace period — except where we are required to retain certain records to comply with law.

When you disconnect a bank account, the connection ends at the aggregator and we delete the access token immediately. Transactions already brought into your books remain part of your workspace data, because they are your records; they leave when the workspace does.

You can view and update your profile, export a copy of your account data, and close your account from within the app. You can opt out of marketing email anytime — via Email preferences in your account, or the unsubscribe link in any marketing message; emails your account needs (sign-in codes, receipts, security notices) are unaffected. Depending on where you live, you may have additional rights — such as access, correction, deletion, portability, or objection — which you can exercise by writing to privacy@papertools.app. We verify that a request comes from the account holder, then answer in writing within 30 days. Where a request concerns someone whose data one of our customers holds in their workspace — their customer, vendor or staff member — we refer it to that customer, who controls that data, and help them respond. We process your data to provide the Service under our agreement with you, to meet our legal obligations, and for our legitimate interest in operating and securing the Service.

If you have a privacy concern, contact us first and we’ll work to resolve it. Australian users may also complain to the Office of the Australian Information Commissioner (OAIC); users in the UK or EEA may complain to their local data-protection supervisory authority.

Data is encrypted in transit and at rest, access is restricted on a need-to-know basis, workspace boundaries are enforced in the database itself, and two-factor authentication is available on your account and mandatory for our staff. Credentials we hold for third-party services on your behalf, such as bank-connection tokens, are additionally encrypted at the application layer. Our Security page describes what is built, and business customers and partners can request our written Information Security Policy from security@papertools.app. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a data breach affects your data, we will tell you what happened, what was involved, what we have done and what you should do, no later than 72 hours after we confirm it, and we will notify the relevant regulator as required by law — including under Australia’s Notifiable Data Breaches scheme.

The Service runs on infrastructure in Singapore: our database and file storage, and the application servers that read from them. Our sub-processors operate globally, so your information may also be processed outside the country where you live — including in the United States, where several of the providers listed above are based, and in the country of any bank-data aggregator you connect through. Where data is transferred overseas, we take steps to ensure it remains protected consistent with this policy and applicable law.

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children.

We may update this policy from time to time. We will revise the “last updated” date above and, for material changes, provide additional notice.

We use only the cookies needed to run the Service:

• Essential cookies — keep you signed in and secure; the Service can’t function without them.
• Preference cookies — remember choices such as your light/dark theme.

Our analytics are cookieless, and we use no advertising or cross-site tracking cookies. Because we rely only on strictly necessary and functional cookies, we don’t gate the Service behind a cookie-consent prompt.

Questions about this policy? Email support@papertools.app. Requests about your personal data go to privacy@papertools.app; security reports to security@papertools.app.