Privacy Policy

This Privacy Policy explains how Paperclip collects, uses, discloses, and protects personal information when you visit papercliphq.com, create an account, or use Paperclip's applications and services. “Paperclip,” “we,” “us,” and “our” refer to the independent Paperclip software service and its operator.

Paperclip is responsible for the personal information described in this policy. For privacy questions or requests, contact hello@papercliphq.com.

We receive personal information:

• directly from you when you create an account, enter data, or contact us;
• from services you choose to connect, within the permissions you approve;
• automatically from your browser or device when you use Paperclip;
• from service providers involved in authentication, billing, and product operation.

We use personal information to:

• create, authenticate, maintain, and secure your account;
• provide the features and integrations you request;
• identify relevant brand and deal email, notify you, and prepare or send email according to your Gmail settings and approval;
• process subscriptions and maintain transaction records;
• send account, service, security, and support communications;
• respond to requests and resolve technical problems;
• understand product use, diagnose errors, and improve Paperclip;
• prevent fraud, abuse, and security incidents;
• comply with legal obligations and enforce our terms.

Where data-protection law requires a legal basis, we rely on performance of our agreement with you, our legitimate interests in operating and securing Paperclip, your consent where requested, and compliance with legal obligations. You may withdraw consent at any time, without affecting earlier processing.

We do not sell personal information. We disclose it only as needed for the purposes in this policy, including to the following categories of recipients:

• infrastructure and storage providers, including Supabase and hosting providers;
• payment and subscription providers, including Polar;
• email-delivery providers, including Resend;
• analytics and reliability providers, including Google, Vercel, and PostHog;
• AI-processing providers used for the feature you invoke, which may include OpenCode Zen, Google Gemini, Groq, and OpenRouter;
• connected services such as Google and TikTok when you direct Paperclip to interact with them;
• professional advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, or complete a business reorganization.

Providers process information under their own terms and privacy commitments or under arrangements that limit their use of information to providing services to us.

If you connect Gmail and enable email processing, Paperclip accesses new messages and their threads in your Gmail Inbox and Spam folders. Paperclip uses message headers, labels, sender and recipient addresses, and message text to identify brand deals and deal updates, summarize relevant messages, decide whether a response may be useful, and prepare a reply draft. Paperclip does not process Trash or email attachments for these features.

You control Gmail features through Paperclip's settings. Paperclip can create drafts in your Gmail account when drafting is enabled. It sends an email from your connected Gmail account only after you request the email and approve its recipient, subject, and content. Paperclip does not send AI-generated replies to incoming email automatically.

To provide these features, Paperclip sends the relevant email thread and Paperclip business context to the selected AI-processing provider. When notifications are enabled, Paperclip sends your Paperclip account email address, the connected Gmail address, the incoming sender address, a summary, any prepared draft, and the received message text to Resend so Resend can deliver the notification to you. We do not use Gmail data to train or improve a general-purpose AI model, serve advertisements, determine creditworthiness, or sell user data.

Paperclip stores your Google email address and encrypted authorization credentials so the connection can function. Paperclip also stores Gmail message and thread identifiers, processing status, timestamps, and created draft identifiers to prevent duplicate processing and operate the integration. Paperclip does not store Gmail message bodies in its application database as part of this automation. Draft content remains in Gmail, and notification content is handled by Resend under its applicable data-protection commitments.

You can disable individual Gmail features or disconnect Gmail in Paperclip. You can also revoke Paperclip's access through your Google Account. After disconnection or revocation, Paperclip stops requesting new Gmail data. Stored connection credentials are deleted when you disconnect; limited processing records remain subject to the retention and deletion terms below.

Paperclip's use of information received from Google Workspace APIs adheres to the Google Workspace API User Data and Developer Policy, including its Limited Use requirements.

If you connect TikTok, Paperclip requests only the permissions shown during TikTok's authorization flow. Depending on the permissions you approve, Paperclip may receive your TikTok display name, username, avatar, profile link, account identifier, follower count, following count, likes count, and video count.

We use this information to display and maintain your connected TikTok profile in Paperclip and to support creator-business features you request. Paperclip does not use this connection to publish videos, read private messages, manage advertisements, or access permissions you have not approved.

We store authorization credentials securely so the connection can function. You can disconnect TikTok in Paperclip and can also revoke access through TikTok. After disconnection, we stop requesting new TikTok data and delete or de-identify stored connection credentials and imported TikTok data unless retention is required for security, legal, or recordkeeping reasons.

When you use an AI-assisted feature, Paperclip sends the prompt, document text, attachment, and relevant account context needed to complete your request to an AI-processing provider. Do not submit sensitive information that is unnecessary for your request.

Paperclip does not use private account content to train a general-purpose AI model. Temporary AI attachments are scheduled for deletion after 24 hours. Temporary import previews and extracted metrics are scheduled for deletion after one hour. Saved conversations and information you choose to add to your account follow the retention rules below.

Paperclip uses cookies and similar browser storage for authentication, security, preferences, analytics, and product performance. Google Analytics, Vercel Analytics, Vercel Speed Insights, and PostHog may collect usage and device information. PostHog may also record interactions such as page views, clicks, and navigation so we can identify usability and reliability problems.

These tools are used for product analytics and service improvement, not third-party behavioral advertising. Browser settings can block or delete cookies, although disabling essential storage may prevent sign-in or other features from working.

We keep account and service data while your account is active and for as long as reasonably needed to provide Paperclip. Retention periods vary according to the type of information, why it was collected, security needs, and legal or financial recordkeeping obligations.

After a verified account-deletion request, we delete or de-identify account data within 30 days unless we must retain limited information for legal compliance, fraud prevention, dispute resolution, security, or backup integrity. Residual backup copies are removed through normal backup rotation.

Paperclip and its providers may process information in countries other than the one where you live. Those countries may have different data-protection laws. Where required, we use recognized safeguards for international transfers and require providers to protect information appropriately.

We use technical and organizational safeguards designed to protect personal information, including encrypted network connections, access controls, and secure cloud infrastructure. No internet service can guarantee absolute security. You should use a strong, unique password and protect access to your email account and devices.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to processing of, or receive a portable copy of your personal information. You may also have the right to withdraw consent and complain to a local data-protection authority.

To exercise a privacy right, email hello@papercliphq.com from your account address. We may request information needed to verify your identity and authority. We will not discriminate against you for exercising a privacy right.

You can disconnect supported third-party accounts through Paperclip or the provider's own settings. You can unsubscribe from optional marketing email using the link in the message, while necessary account and service notices will continue.

Paperclip is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided personal information in violation of this policy, contact us so we can investigate and delete it where appropriate.

Paperclip does not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects. AI-assisted outputs are tools for you to review and use at your discretion.

We may update this policy as Paperclip, our providers, or applicable requirements change. We will post the updated policy and change the date above. If a change materially affects how we use personal information, we will provide additional notice when reasonably required.

Send privacy questions, complaints, and requests to hello@papercliphq.com.