Privacy Policy

1.Introduction

This Privacy Policy explains how PaperThread Ltd trading as PaperThread collects, uses, stores and protects personal data when individuals visit the PaperThread website, create accounts, access the Services, or interact with PaperThread through Customer Workspaces and Connected Systems.

This Privacy Policy should be read together with the PaperThread Terms of Service.

2.Who We Are

PaperThread is operated by PaperThread Ltd, incorporated in England and Wales.

• Company number: 17372021
• Registered office: Uncommon Fulham, 126 New Kings Road, London, Greater London, England, SW6 4LZ
• Privacy contact: dpo@paperthread.ai

3.Our Role in Data Processing

PaperThread's role depends on how personal data is processed.

4.Information We Collect

• Website and enquiry information including names, contact details and communications.
• Account information including authentication details, subscription information and workspace configuration.
• Customer Data including employee information, HR information, documents, policies, workflow information, approvals and Thread records.
• Information accessed through authorised Connected Systems and Integrations.
• Technical information including usage information, security information, performance information and system logs.

5.Sources of Personal Data

PaperThread may collect personal data directly from individuals, from Customers, from authorised Users, through Connected Systems and through customer-approved Integrations.

6.How We Use Personal Data

• Providing and operating the Services.
• Supporting AI-powered retrieval, classification, summarisation, drafting and workflow assistance.
• Maintaining Threads, workflow records and approvals.
• Managing accounts, subscriptions and customer support.
• Protecting security and preventing misuse.
• Complying with legal obligations.

7.AI Processing and Automation

PaperThread uses AI Systems to support information retrieval, classification, summarisation, drafting, workflow assistance and action preparation.

Customers determine the level of automation enabled through permissions, integrations, workflow settings and approval rules.

PaperThread does not independently determine its own authority or expand permissions granted by Customers.

AI Outputs may contain errors, omissions or unexpected results and may require human review before reliance or action.

8.AI Training and Model Providers

PaperThread does not use Customer Data to train general-purpose AI models.

PaperThread may use AI providers and technology providers, including OpenAI, Google and Anthropic, to provide functionality within the Services.

Third-party providers remain responsible for their own services, policies and security practices.

9.Lawful Bases for Processing (UK GDPR)

Depending on the processing activity, PaperThread may rely on contract, legitimate interests, legal obligations or consent where required.

Examples include service delivery, account management, security, billing, legal compliance and communications.

10.Data Sharing

PaperThread may share personal data with trusted providers supporting infrastructure, authentication, payments, AI functionality and integrations.

PaperThread does not sell personal data or share personal data for behavioural advertising.

11.International Data Transfers

Where personal data is transferred internationally, PaperThread uses appropriate safeguards where required, including recognised legal transfer mechanisms.

12.Retention

PaperThread retains personal data only for as long as necessary for legal, contractual, operational and security purposes.

Retention schedule by data category: To be confirmed before publication.

13.Security

PaperThread maintains technical and organisational measures designed to protect personal data, including access controls, authentication, permission management, encryption, monitoring and incident response practices.

14.Your Data Protection Rights

• Right of access to personal data.
• Right to correction of inaccurate or incomplete information.
• Right to deletion where applicable.
• Right to restriction of processing.
• Right to object to certain processing.
• Right to data portability where applicable.
• Right to withdraw consent where processing relies on consent.

15.Rights Relating to Customer Workspace Data

Where personal data is processed within a Customer Workspace, the Customer is generally responsible for responding to individual rights requests because the Customer determines the purposes and means of processing.

PaperThread will provide reasonable assistance where required by applicable law and contractual arrangements.

16.Automated Decision-Making and AI Rights

PaperThread uses AI to assist with workplace operations. Customers determine the level of automation enabled.

PaperThread does not make final decisions regarding hiring, termination, compensation, disciplinary matters, legal matters, immigration, medical matters or employee wellbeing.

17.Sensitive and Confidential Information

Depending on Customer configuration, PaperThread may process sensitive or confidential workplace information including HR information, payroll-related information, employee relations information and workflow records.

Customers remain responsible for ensuring appropriate permissions, lawful processing conditions and access controls are in place.

18.EU Privacy Alignment

Where EU data protection laws apply, PaperThread aims to align its privacy practices with applicable European privacy principles and requirements.

19.US Privacy Alignment

PaperThread aims to support internationally recognised privacy principles, including applicable US privacy requirements where relevant. Customers remain responsible for their own compliance obligations.

20.Children and Dependants

PaperThread is workplace technology and is not designed for direct use by children. Customers may provide limited dependent information where required for legitimate workplace purposes.

21.Complaints

Privacy questions or complaints may be submitted to dpo@paperthread.ai.

Individuals may also contact their applicable data protection authority.

22.Changes to This Privacy Policy

PaperThread may update this Privacy Policy from time to time to reflect changes to the Services, legal requirements or privacy practices.