privacy policy.

Who we are and what this covers

paperclip.it web services operates this website and Paperclipit CMS (also called Paperclip CMS). Contact us about privacy at [email protected]. This policy covers website visitors, enquiries, CMS users and our optional Google Sheets integration.

We are the controller for our own enquiries, customer relationships, account administration and service security. Where a customer uses the CMS to collect or manage information about other people, that customer normally decides why and how it is used and is the controller; we process it on their instructions. Their privacy notice and our agreed data processing terms apply to that customer data. This policy does not replace a customer data processing agreement.

Information we handle

• Enquiries: your name, email address, subject, message and any other information you choose to provide.

• CMS accounts: account and organisation details, authentication information, website membership and permissions, support correspondence and account activity.

• CMS content and forms: pages, media, form definitions, submissions and uploaded files where enabled. Form submissions can include an IP address, browser information, submission identifier and time, as well as the submitted fields.

• Service operation: technical request information, error records and security logs needed to deliver and protect the website and CMS.

• Google connections: the Google account email address and account identifier, access and refresh tokens, selected spreadsheet and tab identifiers and names, column mappings and delivery status.

We receive information directly from you, from people submitting customer forms and, when you authorise a connection, from Google. Do not include passwords, payment card details or sensitive personal information in general enquiry forms.

Why we use information

We use enquiry information to respond and discuss requested work; account and content information to operate the CMS; and technical records to secure, troubleshoot and support the services. Our legal bases are contract or steps you request before a contract, legitimate interests in business communications and secure service operation, and legal obligations for required records. Consent applies where we specifically request it for an optional use.

Providing enquiry or account details is voluntary, but without the required information we may be unable to respond, provide access or carry out your instructions. We do not make decisions with legal or similarly significant effects based solely on automated processing.

Google Sheets: access and use

The integration is optional. An authorised CMS user connects their Google account through Google's authorisation screen, chooses a spreadsheet and tab, maps form fields and enables delivery. We request access to files you select or authorise for the app using Google's per-file permission, together with account identity and email information to identify the connection. We do not request general access to every file in your Google Drive.

We read spreadsheet and tab details, column headings and existing submission identifiers to check the destination, arrange columns and avoid duplicate delivery. A selected empty tab may also be read to confirm it is empty. When delivery is enabled, we write mapped submission fields, the submission identifier, submission time and form handle to the selected tab. We may update headings and add columns needed for that delivery. Access is used to provide this feature and its support and security functions.

Tokens are stored encrypted in the CMS database so the connection can continue without asking you to sign in for every submission. Your Google password is not provided to us. Google account permissions are separate from consent or another legal basis for collecting information from form respondents: the website owner is responsible for that collection and for who can access the destination spreadsheet.

Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not sold, used for advertising or used to train general-purpose AI models. Human access is limited to circumstances permitted by that policy, such as your specific agreement for support, necessary security investigations or a legal requirement.

Disconnecting Google and deleting information

You can turn off delivery or disconnect a form in its CMS Google Sheets settings. Disconnecting removes that form's saved connection details and tokens from the active CMS record and prevents future deliveries through that connection. It does not delete submissions already stored in the CMS or rows already written to Google Sheets. You can also revoke the app's access in your Google Account connections; doing so can affect other connections using that Google authorisation.

Manage spreadsheet rows and sharing in Google Sheets. Ask us at [email protected] for help deleting CMS information or closing an account. For information collected by a customer, contact that website's owner first; we assist them with requests relating to data we process on their behalf.

Who receives information

Access is limited to authorised staff, the customer's permitted CMS users and providers needed to operate the service, such as hosting, storage, email delivery and technical support. Google receives data sent to a connected spreadsheet, and anyone with access to that spreadsheet may be able to view it. We may disclose information where required by law or necessary to protect legal rights.

This website loads fonts from Google, which receives technical request information such as your IP address and browser details. If Cloudflare Turnstile is enabled on a form, Cloudflare processes device and connection signals to check for automated abuse. See Google's Privacy Policy and the Cloudflare Turnstile Privacy Addendum. Our Cookies Policy explains browser storage.

International processing and security

Google, Cloudflare and other providers may process information outside the UK. Where we make a restricted transfer, applicable UK safeguards are required, such as adequacy regulations or approved contractual safeguards. Contact us for details of the providers, locations and safeguards relevant to your service.

We use access controls and other technical and organisational measures appropriate to the service, including encrypted storage of Google connection tokens. No online service can eliminate all security risks. Keep account credentials secure and review CMS membership and spreadsheet sharing regularly.

How long we keep information

We retain enquiries while needed to respond and manage follow-up; account records while needed to provide the service and resolve account matters; and operational logs while needed for troubleshooting and security. We also consider legal record-keeping requirements and the time reasonably needed to handle disputes. Customer content and form submissions follow the customer's instructions and agreed service terms. Google connection details remain while the connection is maintained and are removed from the active record on disconnection. Backups may retain older copies until their normal rotation. Copies in Google Sheets remain under the spreadsheet owner's control until removed there.

Your choices and rights

Depending on the circumstances, you can request access, correction, deletion, restriction or a portable copy of your information. You can withdraw consent for processing based on consent, without affecting earlier lawful use.

You can object to processing based on legitimate interests, and to direct marketing at any time. Email [email protected] to exercise your rights or raise a complaint. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

Changes to this policy

We update this page when the services or information practices change. The date above identifies the current wording; material changes will be communicated where required.