The short version: We collect only what we need to run the service. We don't sell your data. Your documents stay yours. You can delete everything at any time.
1. Who we are
Paperocket is operated by Paperocket Ltd, a company registered in New Zealand. We provide a document intelligence platform that ingests, classifies, and manages documents for businesses.
For questions about this policy, contact us at [email protected].
2. What we collect
Account information
When you sign up, we collect your name, email address, and organisation details. This is used to create and manage your account.
Documents and content
We store documents you upload or that are ingested via connected channels (email, WhatsApp, Google Drive). These are stored securely and used solely to provide the service to your organisation.
Usage data
We collect anonymised usage data (pages visited, features used, session duration) to improve the product. This data is not linked to individual documents or file contents.
Communication data
If you connect a WhatsApp number or email account, we process inbound messages to extract and file documents. Message content is not stored beyond what is needed to process the document.
Billing information
Payment details are handled entirely by our payment processor (Stripe). We never store card numbers or full payment data on our servers.
3. How we use your data
- To provide, operate, and improve the Paperocket service
- To process documents ingested via connected channels
- To send transactional emails (receipts, alerts, account notifications)
- To respond to support requests
- To detect and prevent fraud or abuse
- To comply with legal obligations
We do not use your documents or their contents to train machine learning models shared across customers. Your data stays within your organisation's workspace.
4. Data sharing
We do not sell your personal data. We share data only with:
- Service providers — infrastructure partners (Supabase, Twilio, Google) who process data on our behalf under data processing agreements
- Legal requirements — if required by law, court order, or government authority
- Business transfers — in the event of a merger or acquisition, with notice to you
5. Data storage and security
Your data is stored on servers located in Australia (AWS ap-southeast-2). We use industry-standard encryption in transit (TLS 1.2+) and at rest (AES-256).
Access to production systems is restricted to authorised personnel. We conduct regular security reviews and promptly address vulnerabilities.
6. Data retention
We retain your data for as long as your account is active. When you delete your account:
- Your documents are permanently deleted within 30 days
- Anonymised usage statistics may be retained for product analytics
- Billing records are retained for 7 years as required by New Zealand tax law
7. Your rights
Under the New Zealand Privacy Act 2020 and (where applicable) GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data
- Export your data in a machine-readable format
- Withdraw consent at any time
- Lodge a complaint with the NZ Privacy Commissioner
To exercise any of these rights, email [email protected]. We'll respond within 20 working days.
8. Cookies
We use essential cookies to keep you logged in and remember your preferences. We do not use advertising or tracking cookies. You can disable cookies in your browser settings, though this may affect some functionality.
9. Third-party integrations
When you connect third-party services (Google Drive, Xero, WhatsApp), you are also subject to those providers' privacy policies. We only request the minimum permissions necessary to deliver the integration.
10. Children's privacy
Paperocket is a business tool intended for users aged 18 and over. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us immediately.
11. Changes to this policy
We may update this policy from time to time. We'll notify you of significant changes via email or an in-app notice at least 14 days before they take effect. Continued use of the service after that date constitutes acceptance.
12. Contact
For any privacy-related questions or requests:
- Email: [email protected]
- Post: Paperocket Ltd, Auckland, New Zealand