Privacy Policy

The Paper Glade Pte Ltd  |  Effective Date: October 7, 2026

1. Introduction

Welcome to The Paper Glade, a platform operated by The Paper Glade Pte Ltd (UEN: 202530319R) and its affiliates ("The Paper Glade", "we", "us", or "our").

We are committed to protecting your privacy and handling personal data responsibly in accordance with applicable data protection and privacy laws, including the Personal Data Protection Act (PDPA), General Data Protection Regulation (GDPR), UK GDPR, California Consumer Privacy Act (CCPA), and other applicable regulations.

This Privacy Policy explains how we collect, use, disclose, and protect personal data when you access or use our website, applications, and related services (collectively, the "Platform").

If you do not agree with this Privacy Policy, please discontinue use of the Platform. For questions about our privacy practices, please contact us at hello@thepaperglade.com.

1.1 Definition of Personal Data

"Personal Data" means any information relating to an identified or identifiable individual, such as a name, email address, phone number, or information associated with an account or device.

1.2 Consent and Acceptance

Where required by applicable law, The Paper Glade relies on your explicit consent before collecting or using personal data through non-essential cookies or similar technologies, such as analytics or marketing cookies. You may manage, modify, or withdraw your consent at any time through our cookie settings or browser controls.

By registering for an account or using the Platform, you acknowledge that your personal data will be processed as described in this Privacy Policy, subject to your consent choices and applicable law.

1.3 Relationship with Other Agreements

This Privacy Policy operates alongside any other contractual agreements or terms of service you may have with The Paper Glade. In the event of a conflict, the terms of those agreements will prevail.

1.4 Who This Policy Applies To

This Privacy Policy applies to all users of the Platform, including customers, administrators, team members, and other authorised individuals who access or use our services.

2. When Does The Paper Glade Collect Personal Data?

We may collect personal data in the following situations:

  • When you create, manage, or access an account.
  • When you communicate with us via chat, email, or support channels.
  • When you complete forms, surveys, or participate in events or beta programs.
  • When you interact with our website or applications.
  • When you integrate third-party platforms or services with The Paper Glade.
  • When you voluntarily provide information in connection with our services.

These examples are illustrative and not exhaustive.

3. What Personal Data Does The Paper Glade Collect?

3.1 Categories of Personal Data

We may collect the following categories of personal data:

  • Basic Information: name, email address, profile details.
  • Contact Information: phone number or communication details.
  • Account & Identity Information: account identifiers, authentication and login credentials (managed by our third-party identity provider — see Section 10.4), organisation and role identifiers, profile details, and settings.
  • Usage Data: pages visited, features used, device and browser information.
  • Communication Data: messages sent through the Platform or support channels, and messages, reactions, media attachments (images, audio, video, documents), and associated metadata (sender identifiers such as phone number, Instagram handle, or page-scoped IDs; timestamps; delivery and read status) received from connected messaging channels via third-party platform webhooks (including WhatsApp Business, Instagram, and Facebook Messenger).
  • Integration Data: data exchanged with third-party integrations authorised by you, including where applicable, Google Calendar event data (event titles, times, dates, and recurrence rules) accessed solely for the purpose of importing session schedules during onboarding, and data exchanged with Meta Platforms (WhatsApp Business, Instagram, Facebook Messenger) — see Section 10.3.
  • User-Provided Content: files, media, or other information you upload.

3.2 Accuracy of Personal Data

You are responsible for ensuring that personal data you provide is accurate and up to date. You may update your information through your account settings where available.

3.3 Cookies and Similar Technologies

The Paper Glade uses cookies and similar technologies to operate the Platform, analyse usage, and support marketing activities. These include:

  • Essential cookies: Required for core functionality, security, and accessibility of the Platform.
  • Analytics cookies: Used to understand how visitors use our website and services in order to improve performance and user experience.
  • Marketing cookies: Used to measure advertising effectiveness and deliver relevant content.

Where required by law, analytics and marketing cookies are used only after you have provided explicit consent. You may change or withdraw your consent at any time via cookie settings.

4. How We Use Personal Data

We process personal data for legitimate business purposes, including to:

  • Operate, maintain, and provide the Platform.
  • Improve, customise, and enhance user experience.
  • Provide customer support and respond to inquiries.
  • Communicate service updates and administrative messages.
  • Monitor usage trends and platform performance.
  • Maintain security, prevent fraud, and ensure system integrity.
  • Comply with legal and regulatory obligations.

The Paper Glade does not sell personal data.

5. How We Share Personal Data

We may share personal data only in limited circumstances, including:

  • With trusted service providers who assist in operating the Platform.
  • With integration partners as authorised by you.
  • For legal, regulatory, or security reasons when required by law.
  • With your explicit consent.

All third parties are contractually required to process data securely and only for specified purposes. A list of our key sub-processors is set out in Section 12.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, comply with legal obligations, or resolve disputes. When data is no longer required, it is securely deleted or anonymised.

7. Data Security

We implement appropriate technical and organisational safeguards to protect personal data, including encryption, access controls, monitoring, and regular security reviews. While we take reasonable measures to protect data, no system can guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access your personal data.
  • Request correction or deletion.
  • Withdraw consent.
  • Object to or restrict processing.
  • Request data portability.

Requests can be submitted to hello@thepaperglade.com. We will respond in accordance with applicable law.

8.1 California Privacy Rights (CCPA)

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA), including the right to opt out of the sale or sharing of personal information. The Paper Glade does not sell personal data. You may contact us at hello@thepaperglade.com to exercise your rights.

9. International Data Transfers

Your personal data may be transferred to and processed in countries other than your country of residence. Where this occurs, we take steps to ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that required under the Personal Data Protection Act and other applicable data protection laws. Those obligations are set out in our contracts with the sub-processors listed in Section 12.

10. Google User Data and Third-Party Integrations

10.1 Google Calendar Integration

The Paper Glade offers an optional Google Calendar integration that keeps the Platform's calendar and your connected Google Calendar in step, in both directions. This integration is entirely optional and must be explicitly authorised by the administrator. Once connected, changes made in either place are synchronised automatically, including in the background.

Data accessed:

When you authorise this integration, The Paper Glade requests access to read your calendars and events (calendar.readonly scope), to create, change and delete events (calendar.events scope), to create and manage calendars and their properties (calendar.app.created and calendar.calendars scopes), to manage the list of calendars your account shows, including their colour and whether they are hidden (calendar.calendarlist scope), and to read your Google account email address (userinfo.email scope). We do not request access to calendar sharing settings.

How we use this data:

We use your Google Calendar data to show your calendars and events in the Platform, to keep them synchronised with Google Calendar, and to provide the Platform's scheduling features, including the AI features described in Section 11 (for example, answering an authorised administrator's questions about your schedule). We store the calendar and event data needed to provide these features for as long as the integration remains connected. We use your email address to identify and display the connected Google account within the Platform.

What we do not do:

  • We do not use your Google Calendar data for advertising or profiling.
  • We do not sell your Google Calendar data or share it with third parties, except with the sub-processors listed in Section 12 that are needed to provide these features, including the AI providers in Section 11.
  • We do not use your Google Calendar data, and do not permit our sub-processors to use it, to train general-purpose AI models.
  • Events marked private in Google Calendar are not used by the AI features described in Section 11.

Token storage:

To maintain your authorised connection, we securely store an encrypted OAuth refresh token issued by Google. This token is encrypted at rest and is used solely to synchronise calendar data on your behalf. You may revoke this access at any time.

Revoking access:

You may disconnect the Google Calendar integration at any time from the Integrations tab in your Settings page. This will immediately delete your stored credentials from our systems. You may also revoke The Paper Glade's access directly from your Google Account at myaccount.google.com/permissions.

10.2 Compliance with Google API Services User Data Policy

The Paper Glade's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

10.3 Meta Platform Integrations (WhatsApp Business, Instagram, Facebook Messenger)

The Paper Glade offers optional integrations with Meta Platforms — WhatsApp Business, Instagram, and Facebook Messenger — that allow service provider administrators to send and receive messages with their customers through a unified inbox and, where enabled, through an AI-assisted reply agent. These integrations are entirely optional and must be explicitly authorised by an administrator with the necessary rights on the connected business account.

Data accessed:

When you connect a Meta channel, The Paper Glade receives data delivered by Meta's webhook and Graph API systems, including:

  • Inbound and outbound message content (text, media attachments such as images, audio, video, stickers, and documents).
  • Message reactions and edits or deletions, where surfaced by Meta.
  • Sender and recipient identifiers (e.g. WhatsApp phone numbers, Instagram-scoped user IDs and handles, Facebook page-scoped IDs).
  • Message metadata: timestamps, delivery and read status, conversation/thread identifiers, and message IDs.
  • Business account metadata required to operate the integration (e.g. WhatsApp Business Account ID, phone number ID, Instagram business account ID, Facebook Page ID, connected account display name).

How we use this data:

We process Meta-channel data solely to provide the messaging features of the Platform — routing messages into the administrator's inbox, threading them by customer, displaying message status and reactions, allowing administrators (or the authorised AI agent) to compose and send replies, storing conversation history so it remains accessible to the administrator, and supporting operational features such as search, templates, and analytics scoped to the administrator's own account.

What we do not do:

  • We do not use Meta-channel message content, reactions, or media for advertising, profiling, or cross-customer analytics.
  • We do not sell Meta-channel data, and we do not share it with third parties except for sub-processors strictly necessary to operate the Platform (such as cloud hosting, object storage, and AI model providers), and only as needed to provide the Services.
  • We do not use Meta-channel message content to train general-purpose AI models. Message content is processed by third-party large language model providers (identified in Section 11) solely to provide the AI features described in Section 11 — drafting replies where you enable the AI reply agent, and answering questions from authorised administrators about their own organisation's data — under data processing agreements that prohibit those providers from retaining the content beyond what is necessary or using it for training or their own purposes.
  • We do not access Meta accounts or message history beyond what is delivered by Meta's webhook or required to fulfil an action you initiate on the Platform.

Media storage:

Media attachments delivered via Meta webhooks are re-hosted on our secure object storage to keep them accessible to administrators after Meta's short-lived media URLs expire. Media is stored under the administrator's organisation namespace and access-controlled.

Token storage:

To maintain your authorised connection, we securely store the access tokens issued by Meta for your connected business accounts. These tokens are encrypted at rest and used solely to send messages, fetch media, and receive webhook events on your behalf.

Retention:

Conversation history, message content, reactions, and re-hosted media are retained for as long as your account remains active and the connected channel is enabled, so that you can access your message history. You may delete individual messages or conversations through the Platform. On disconnection of a channel or termination of your account, data is handled in accordance with Section 6 (Data Retention).

Revoking access:

You may disconnect a Meta channel at any time from the Integrations area of your Settings page. Disconnecting removes the associated access tokens and stops further webhook ingestion for that channel. You may also revoke The Paper Glade's access directly from Meta Business Settings.

Compliance:

The Paper Glade's use of data received from Meta APIs and webhooks adheres to the applicable Meta Platform Terms, WhatsApp Business Solution Terms, and developer policies. End-customer communications routed through Meta channels are processed by The Paper Glade on behalf of the administrator (the data controller) — see Section 4 of our Terms of Service for the controller/processor allocation.

10.4 Identity and Authentication Provider (Clerk)

The Paper Glade uses Clerk, Inc. ("Clerk") as its identity and authentication provider to manage account sign-up, sign-in, session management, social login, multi-factor authentication, organisation membership, and related account-security functions. Clerk acts as our sub-processor for these purposes and processes the relevant personal data on our behalf under a data processing agreement.

Data processed by Clerk:

  • Account identifiers and profile information (name, email address, and, where you choose to provide them, phone number and profile image).
  • Authentication credentials. Where you sign in with a password, that password is stored and verified by Clerk in hashed form — The Paper Glade never receives or stores your account password.
  • Social login profile data, where you choose to sign in with a third-party provider such as Google or Facebook (for example, the name, email address, and profile image released to us by that provider).
  • Organisation membership and role information used to determine your access within the Platform.
  • Authentication and security metadata, such as session tokens, sign-in events, IP address, and device or browser information, used for authentication, fraud prevention, and account security.

How we use this data:

This data is processed solely to authenticate users, maintain sessions, manage profiles and organisation membership, enable social login, and protect accounts against unauthorised access. It is not used for advertising or profiling.

Location of processing:

Clerk is based in the United States, and your authentication data may be processed there. Where applicable, the safeguards for international transfers described in Section 9 apply.

More information:

For details of how Clerk handles personal data, see Clerk's Privacy Policy and its list of sub-processors at trust.clerk.io.

11. Artificial Intelligence Features and Tools

The Platform includes AI-assisted features, including the AI reply agent that drafts suggested replies to your customers' messages, Ask Papier, which answers questions from authorised administrators about their own organisation's data, and supporting capabilities such as knowledge-base search and message classification. This Section applies wherever those features are used — across all connected channels (including, but not limited to, Meta channels) and to content you provide to the Platform, such as your knowledge base and business information. It also covers the AI-assisted engineering tools our own personnel use to build and support the Platform.

11.1 How AI Features and Tools Process Data

When an AI feature is enabled for your account, the content needed to produce a result — such as inbound customer messages, your knowledge-base content, and relevant business information — is sent to third-party large language model and embedding providers. Those providers process the content solely to draft a reply, generate search embeddings, classify a message, or answer an administrator's question on your behalf, and to return the result to the Platform.

When an authorised administrator asks Ask Papier a question, the organisation's data needed to answer it is sent to these providers. Depending on the question, this may include customer records, messages and conversation history, notes the administrator can access, form submissions, schedules and bookings, staff records, and calendar events other than those marked private. Ask Papier only reads data; it does not change data or send messages. Only data from the administrator's own organisation is used.

Separately from those features, our authorised personnel use AI-assisted engineering tools to build, maintain, debug, and support the Platform. Where a task requires it — for example investigating a fault affecting your account — a limited amount of production data, which may include personal data, is sent to the provider of that tool so that it can assist with the task. Access is restricted to personnel who need it for that purpose, and the provider restrictions set out in Section 11.2 apply.

11.2 AI Sub-processors

We use the following third-party AI providers as sub-processors:

  • Google LLC — Gemini large language models and text-embedding services, used to draft replies, classify messages, generate search embeddings, and answer administrators' questions through Ask Papier.
  • Anthropic PBC — Claude large language models, used to draft replies, to answer administrators' questions through Ask Papier, and for related automated processing, and Claude-based engineering tools used by our authorised personnel to develop, maintain, debug, and support the Platform, which may involve access to production data.

We engage these providers on paid service tiers under agreements that (i) prohibit the use of your data, or your customers' data, to train their models, (ii) prohibit use of the data for the providers' own purposes, and (iii) limit retention to what is necessary to provide the service.

11.3 What We Do Not Do

  • We do not use your content, or your customers' messages, to train general-purpose AI models.
  • We do not permit our AI sub-processors to use your data to train their models or for their own purposes.

You remain responsible for the content of messages sent from your account, including replies drafted or sent by the AI agent.

11.4 AI Features Are Integral to the Platform

The AI features and tools described in this Section are an integral part of the Platform and are not separately switchable. By subscribing to the Platform and continuing to use it, you agree to the processing described in this Section. If you do not agree to it, your remedy is to stop using the Platform and close your account.

Where the personal data processed is that of your own customers — for example the messages they send to your connected channels — The Paper Glade acts on your behalf, as described in Section 10.3. Responsibility for notifying those individuals, and for obtaining any consent they are owed, remains with you.

12. Sub-processors

We engage third-party sub-processors to provide and operate the Platform. Each is bound by contractual terms requiring it to safeguard personal data and to process it only as necessary to provide its service to us. Our current key sub-processors are:

  • Clerk, Inc. — identity, authentication, and session management (see Section 10.4).
  • Google LLC — AI models and embeddings (see Section 11) and the optional Google Calendar import (see Section 10.1).
  • Anthropic PBC — AI models powering the AI features of the Platform, and Claude-based engineering tools used by our authorised personnel to develop, maintain, debug, and support the Platform (see Section 11).
  • Cloudflare, Inc. — object storage for media attachments and uploaded files.
  • Neon — managed PostgreSQL database hosting.
  • Render — application and server hosting.

These sub-processors may process personal data outside your country of residence; the transfer safeguards described in Section 9 apply. We may update this list as the Platform evolves and, where required by applicable law or your data processing agreement, will provide notice of material changes.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

The Paper Glade Pte Ltd (UEN: 202530319R)
Email: hello@thepaperglade.com

We will respond to privacy-related inquiries in accordance with applicable laws.