Privacy Policy

This Privacy Policy explains how Paperclip collects, uses, discloses, and protects personal information when you visit papercliphq.com, create an account, or use Paperclip's applications and services. “Paperclip,” “we,” “us,” and “our” refer to the independent Paperclip software service and its operator.

Paperclip is responsible for the personal information described in this policy. For privacy questions or requests, contact hello@papercliphq.com.

We receive personal information:

• directly from you when you create an account, enter data, or contact us;
• from services you choose to connect, within the permissions you approve;
• automatically from your browser or device when you use Paperclip;
• from service providers involved in authentication, billing, and product operation.

We use personal information to:

• create, authenticate, maintain, and secure your account;
• provide the features and integrations you request;
• process subscriptions and maintain transaction records;
• send account, service, security, and support communications;
• respond to requests and resolve technical problems;
• understand product use, diagnose errors, and improve Paperclip;
• prevent fraud, abuse, and security incidents;
• comply with legal obligations and enforce our terms.

Where data-protection law requires a legal basis, we rely on performance of our agreement with you, our legitimate interests in operating and securing Paperclip, your consent where requested, and compliance with legal obligations. You may withdraw consent at any time, without affecting earlier processing.

We do not sell personal information. We disclose it only as needed for the purposes in this policy, including to the following categories of recipients:

• infrastructure and storage providers, including Supabase and hosting providers;
• payment and subscription providers, including Polar;
• email-delivery providers, including Resend;
• analytics and reliability providers, including Google, Vercel, and PostHog;
• AI-processing providers used for the feature you invoke, which may include OpenCode Zen, Google Gemini, Groq, and OpenRouter;
• connected services such as Google and TikTok when you direct Paperclip to interact with them;
• professional advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, or complete a business reorganization.

Providers process information under their own terms and privacy commitments or under arrangements that limit their use of information to providing services to us.

If you connect Gmail, Paperclip requests permission to send email only when you direct it to do so. Paperclip does not use this permission to read your inbox. We store your Google email address and encrypted authorization credentials so the connection can function until you disconnect it or the authorization expires or is revoked.

Paperclip's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

If you connect TikTok, Paperclip requests only the permissions shown during TikTok's authorization flow. Depending on the permissions you approve, Paperclip may receive your TikTok display name, username, avatar, profile link, account identifier, follower count, following count, likes count, and video count.

We use this information to display and maintain your connected TikTok profile in Paperclip and to support creator-business features you request. Paperclip does not use this connection to publish videos, read private messages, manage advertisements, or access permissions you have not approved.

We store authorization credentials securely so the connection can function. You can disconnect TikTok in Paperclip and can also revoke access through TikTok. After disconnection, we stop requesting new TikTok data and delete or de-identify stored connection credentials and imported TikTok data unless retention is required for security, legal, or recordkeeping reasons.

When you use an AI-assisted feature, Paperclip sends the prompt, document text, attachment, and relevant account context needed to complete your request to an AI-processing provider. Do not submit sensitive information that is unnecessary for your request.

Paperclip does not use private account content to train a general-purpose AI model. Temporary AI attachments are scheduled for deletion after 24 hours. Temporary import previews and extracted metrics are scheduled for deletion after one hour. Saved conversations and information you choose to add to your account follow the retention rules below.

Paperclip uses cookies and similar browser storage for authentication, security, preferences, analytics, and product performance. Google Analytics, Vercel Analytics, Vercel Speed Insights, and PostHog may collect usage and device information. PostHog may also record interactions such as page views, clicks, and navigation so we can identify usability and reliability problems.

These tools are used for product analytics and service improvement, not third-party behavioral advertising. Browser settings can block or delete cookies, although disabling essential storage may prevent sign-in or other features from working.

We keep account and service data while your account is active and for as long as reasonably needed to provide Paperclip. Retention periods vary according to the type of information, why it was collected, security needs, and legal or financial recordkeeping obligations.

After a verified account-deletion request, we delete or de-identify account data within 30 days unless we must retain limited information for legal compliance, fraud prevention, dispute resolution, security, or backup integrity. Residual backup copies are removed through normal backup rotation.

Paperclip and its providers may process information in countries other than the one where you live. Those countries may have different data-protection laws. Where required, we use recognized safeguards for international transfers and require providers to protect information appropriately.

We use technical and organizational safeguards designed to protect personal information, including encrypted network connections, access controls, and secure cloud infrastructure. No internet service can guarantee absolute security. You should use a strong, unique password and protect access to your email account and devices.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to processing of, or receive a portable copy of your personal information. You may also have the right to withdraw consent and complain to a local data-protection authority.

To exercise a privacy right, email hello@papercliphq.com from your account address. We may request information needed to verify your identity and authority. We will not discriminate against you for exercising a privacy right.

You can disconnect supported third-party accounts through Paperclip or the provider's own settings. You can unsubscribe from optional marketing email using the link in the message, while necessary account and service notices will continue.

Paperclip is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided personal information in violation of this policy, contact us so we can investigate and delete it where appropriate.

Paperclip does not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects. AI-assisted outputs are tools for you to review and use at your discretion.

We may update this policy as Paperclip, our providers, or applicable requirements change. We will post the updated policy and change the date above. If a change materially affects how we use personal information, we will provide additional notice when reasonably required.

Send privacy questions, complaints, and requests to hello@papercliphq.com.