Privacy Policy

1. Who we are

PaperRoute is a product of Saunders Simmons Ltd, a company registered in England and Wales (company number available on request), with its registered office in Yeovil, Somerset.

For the purposes of UK data protection law, Saunders Simmons Ltd is the data controller for personal data collected through this website and the PaperRoute software platform.

Contact us: hello@paperroute.co.uk

2. What data we collect and why

2.1 Free-trial and product enquiries

When you request a free trial or make a product enquiry, we collect your name, business name, work email address and phone number. You may also provide your type of business and approximate numbers of users and vehicles. We record technical and attribution information associated with the submission, which may include your IP address, landing page, referring page, Google click identifier and UTM campaign parameters.

Purpose: To respond to your request, contact you, prepare an appropriate trial setup, protect the form against abuse, and understand which marketing activity generated the enquiry. We may send a confirmation email when the request is received.
Legal basis: Steps at your request before entering a contract where applicable (Article 6(1)(b) UK GDPR), and our legitimate interests in responding to business enquiries, securing our service and measuring marketing effectiveness (Article 6(1)(f) UK GDPR).

2.2 Free compliance tools (WTN, CoD, HWCN generators)

When you use our free Waste Transfer Note, Certificate of Destruction, or Hazardous Waste Consignment Note generators, we collect the information you enter into the form — which may include business names, addresses, contact names, email addresses, and details about the waste or materials involved.

We use this data to generate and email you the requested PDF document. We also retain a copy of the submission in our secure database for audit and service improvement purposes.

Purpose: To generate and deliver the document you requested, and to maintain a record for service quality purposes.
Legal basis: Legitimate interests (providing a free tool you have actively requested — Article 6(1)(f) UK GDPR).

2.3 PaperRoute software subscribers

If you subscribe to the PaperRoute platform, we process personal data as set out in your subscription agreement and data processing addendum. As a software provider, we act as a data processor on your behalf for data entered into the platform by you or your staff, and as a data controller for account management data (name, email, billing information).

2.4 Website analytics and advertising measurement

We use the following third-party tools to measure how visitors use our website and to measure whether paid advertising drives successful free-trial requests and signups:

• Google Analytics 4 — aggregate traffic patterns (pages visited, referrer, country-level location, device type). Retention: 14 months. Cookies set: _ga, _ga_*.
• Google Ads conversion tracking — measures whether a successfully submitted free-trial request or signup came from a paid Google ad. The conversion event is sent only after the form request succeeds. A hashed version of your email and phone number may be sent to Google so it can match the conversion to the ad click. Cookies set: _gcl_au, _gcl_aw.
• Meta (Facebook) Pixel — measures page views and (historically) lead events for Facebook/Instagram advertising. The ad account is currently paused and lead events are not fired; we retain the page-view pixel so audience data is available should we resume advertising. Cookies set: _fbp.

Legal basis: Legitimate interests — measuring site usage and advertising effectiveness in a proportionate way (Article 6(1)(f) UK GDPR). You can opt out at any time using the mechanisms in section 6.

A granular cookie consent banner is planned and has not yet been deployed. Until it ships, these cookies are set on page load; section 6 describes how to opt out in the meantime.

2.5 Business visitor identification

We use Leadinfo to understand which organisations visit our public business website. Leadinfo processes the visitor's public IP address and attempts to match it against its business network database. Where a reliable match is available, we may see the probable organisation's name and public business information, together with the PaperRoute pages requested and referral source.

This process identifies a probable organisation, not the individual employee using the website. Any decision-maker or employee details shown separately by Leadinfo are business contact data and are not evidence that those people visited our website.

Purpose: To understand interest from organisations that may benefit from PaperRoute and to prioritise proportionate, human-reviewed business follow-up.
Legal basis: Legitimate interests — developing our business and responding to demonstrated interest from relevant corporate prospects (Article 6(1)(f) UK GDPR).

3. How we store and protect your data

Personal data is stored in Supabase (a cloud database platform with servers located within the EU/EEA) and is transmitted via Resend (an email delivery service). Both providers are bound by data processing agreements and maintain appropriate technical and organisational security measures.

We do not sell, rent, or trade your personal data to third parties.

4. How long we keep your data

5. Your rights under UK GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your data where there is no compelling reason for us to continue processing it.
• Restriction — ask us to restrict how we process your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Stop direct marketing — object at any time to the use of your personal data for direct marketing; this right is absolute.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@paperroute.co.uk. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

6. Cookies and opting out

We use three categories of cookies:

• Strictly necessary — session cookies used for form submissions, CSRF protection, and maintaining your login on the PaperRoute application. These are required for the site to function and cannot be disabled.
• Analytics — Google Analytics 4 (_ga, _ga_*).
• Advertising — Google Ads (_gcl_au, _gcl_aw) and Meta Pixel (_fbp).

How to opt out today (while the cookie banner is still being built):

• Install Google's Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.
• Adjust Google ads personalisation at adssettings.google.com.
• Adjust Facebook/Meta ads personalisation in Settings → Ads within your Meta account.
• Block third-party cookies in your browser settings — this disables analytics and advertising cookies across most sites including ours.

If you would prefer all analytics and advertising cookies removed from your visit, email us at hello@paperroute.co.uk and we'll confirm the next steps with you manually while the banner is in development.

Leadinfo is configured in Cookieless Tracking mode for our domain. In this mode it does not place Leadinfo cookies; company recognition uses the public IP address that is transmitted when the browser requests its tracker. You can object to this processing by contacting us at the address above.

7. Third-party services

Our website and platform integrate with the following third-party services:

• Supabase — database and authentication infrastructure (data stored in EU/EEA).
• Resend — transactional and marketing email delivery.
• Vercel — website hosting and CDN (data centres in EU/EEA and globally).
• Stripe — payment processing for paid subscriptions. Stripe is a PCI-DSS Level 1 certified payment processor; card details are entered directly into Stripe-hosted fields and never touch our servers.
• Google — Google Analytics 4 and Google Ads conversion tracking (see section 2.4).
• Meta (Facebook) — Meta Pixel page-view tracking (see section 2.4).
• Leadinfo — cookieless company-level website visitor identification (see section 2.5).
• Intuit (QuickBooks Online) — accounting integration for subscribers who connect a QuickBooks account. See section 7.1 below.

Each provider maintains its own privacy and security controls. We have data processing agreements in place where required.

7.1 QuickBooks Online integration

Subscribers may optionally connect their QuickBooks Online account to PaperRoute via OAuth 2.0. When a connection is established:

• We request access to your QuickBooks company data under the com.intuit.quickbooks.accounting scope, which allows us to read and write invoices, customers, vendor bills, and payments on your behalf.
• We store OAuth access and refresh tokens in your tenant database, encrypted at rest by Supabase. These tokens are used solely to perform accounting actions you initiate within PaperRoute (such as raising an invoice or recording a payment).
• We do not sell, share, or use QuickBooks data for any purpose other than providing the PaperRoute service to your organisation.
• You can revoke access at any time by clicking Disconnect in PaperRoute Settings → Integrations → QuickBooks, or by revoking access directly in your Intuit account at accounts.intuit.com. On disconnection, stored tokens are immediately invalidated.

QuickBooks® is a registered trademark of Intuit Inc. PaperRoute is not affiliated with, endorsed by, or sponsored by Intuit Inc.

Intuit's own privacy practices are described at intuit.com/privacy/statement.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated to active subscribers by email. The "last updated" date at the top of this page always reflects the most recent version.

9. Contact

If you have any questions about this policy or how we handle your data, please contact us: