Privacy Policy

1. Who we are

PaperRoute is a product of Saunders Simmons Ltd, a company registered in England and Wales (company number available on request), with its registered office in Yeovil, Somerset.

For the purposes of UK data protection law, Saunders Simmons Ltd is the data controller for personal data collected through this website and the PaperRoute software platform.

Contact us: hello@paperroute.co.uk

2. What data we collect and why

Demo bookings may include a short source label identifying the website page or campaign that led to the booking, so we can prepare for the enquiry and assess relevant marketing. Optional website analytics remain subject to your cookie choices.

2.1 Demo bookings and product enquiries

When you book a demo or make a product enquiry, we collect your name, business name, work email address and phone number. You may also provide your type of business, approximate numbers of users and vehicles, your target business go-live date, and whether and where you operate a permitted or licensed receiving site. We record technical and attribution information associated with the submission, which may include your IP address, landing page, referring page, Google click identifier and UTM campaign parameters.

Purpose: To respond to your request, contact you, prepare an appropriate demonstration and setup plan, protect the form against abuse, and understand which marketing activity generated the enquiry. We may send a confirmation email when the request is received.
Legal basis: Steps at your request before entering a contract where applicable (Article 6(1)(b) UK GDPR), and our legitimate interests in responding to business enquiries, securing our service and measuring marketing effectiveness (Article 6(1)(f) UK GDPR).

2.2 Free compliance tools (WTN, CoD, HWCN generators)

When you use our free Waste Transfer Note, Certificate of Destruction, or Hazardous Waste Consignment Note generators, we collect the information you enter into the form — which may include business names, addresses, contact names, email addresses, and details about the waste or materials involved.

We use this data to generate and email you the requested PDF document. We also retain a copy of the submission in our secure database for audit and service improvement purposes.

Purpose: To generate and deliver the document you requested, and to maintain a record for service quality purposes.
Legal basis: Legitimate interests (providing a free tool you have actively requested — Article 6(1)(f) UK GDPR).

If you choose the PaperRoute Lite email option when using a free tool, we also use your verified email address and the type of tool you used to send a short series of up to five emails with practical paperwork tips and information about PaperRoute Lite. The series ends after those emails and does not automatically restart when you use another free tool. You can receive your document without choosing marketing emails. We do not add client or other document-party email addresses to this series because someone else entered them.

Legal basis for the optional email series: Your consent (Article 6(1)(a) UK GDPR). We record the wording you agreed to, its version, when you selected it and when your email address was verified. You can withdraw consent using the unsubscribe link in any marketing email, by replying to it, or by contacting us. We stop the sequence if you unsubscribe or if we identify that you are already a customer. Delivery failures and spam complaints also help us prevent further unwanted marketing. Resend delivers the emails on our behalf.

We keep a minimal record of marketing opt-outs so that future submissions do not accidentally add you back. After deleting detailed campaign records, we also retain a hash of your email address and the campaign identifier to prevent the same series being sent again. Unsubscribing from marketing does not prevent us from sending a document or other service message you specifically request.

2.3 PaperRoute software subscribers

If you subscribe to the PaperRoute platform, we process personal data as set out in your subscription agreement and data processing addendum. As a software provider, we act as a data processor on your behalf for data entered into the platform by you or your staff, and as a data controller for account management data (name, email, billing information).

2.4 Website analytics and advertising measurement

We use the following third-party tools to measure how visitors use our website and to measure whether paid advertising drives successful demo bookings and enquiries:

• Google Analytics 4 — aggregate traffic patterns (pages visited, referrer, country-level location, device type). Retention: 14 months. Cookies set: _ga, _ga_*.
• Google Ads conversion tracking — measures whether a successfully booked demo came from a paid Google ad. With your advertising consent, the conversion event is sent only after the booking succeeds. Clicking a demo button or selecting a time does not record a conversion. A hashed version of your email and phone number may be sent to Google so it can match the conversion to the ad click. Cookies set: _gcl_au, _gcl_aw.
• Meta (Facebook) Pixel — measures page views and (historically) lead events for Facebook/Instagram advertising. The ad account is currently paused and lead events are not fired; we retain the page-view pixel so audience data is available should we resume advertising. Cookies set: _fbp.

Your choice: Google Analytics, Google Ads and Meta tracking run only after you allow the relevant optional cookies. You can change or withdraw your choice using Cookie settings on any page.

Analytics and advertising are off by default. Advertising consent also controls whether hashed contact details are sent to Google for conversion matching. Rejecting optional cookies does not prevent you from making an enquiry or booking a demo.

2.5 Business visitor identification

We use Leadinfo to understand which organisations visit our public business website. Leadinfo processes the visitor's public IP address and attempts to match it against its business network database. Where a reliable match is available, we may see the probable organisation's name and public business information, together with the PaperRoute pages requested and referral source.

This process identifies a probable organisation, not the individual employee using the website. Any decision-maker or employee details shown separately by Leadinfo are business contact data and are not evidence that those people visited our website.

Purpose: To understand interest from organisations that may benefit from PaperRoute and to prioritise proportionate, human-reviewed business follow-up.
Legal basis: Legitimate interests — developing our business and responding to demonstrated interest from relevant corporate prospects (Article 6(1)(f) UK GDPR).

We may also perform a first-party server-side company check after higher-intent activity, such as visiting a pricing, trial or demo page, researching several product pages, or opening a company-specific campaign link. We first check public internet registry data. Where enabled, unmatched high-intent visits may be checked through People Data Labs' IP Enrichment API; UK company matches may then be supplemented with public Companies House information.

The first-party check processes the public IP transiently but does not retain it or include it in an alert. Internal alerts may include the probable company, public company information, the qualifying PaperRoute page and broad reasons for the intent score. A company campaign link identifies its intended organisation but may be shared, so it does not identify the individual who opened it. Duplicate alerts are suppressed for up to 24 hours.

3. How we store and protect your data

Personal data is stored in Supabase (a cloud database platform with servers located within the EU/EEA) and is transmitted via Resend (an email delivery service). Both providers are bound by data processing agreements and maintain appropriate technical and organisational security measures.

We do not sell, rent, or trade your personal data to third parties.

4. How long we keep your data

5. Your rights under UK GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your data where there is no compelling reason for us to continue processing it.
• Restriction — ask us to restrict how we process your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Stop direct marketing — object at any time to the use of your personal data for direct marketing; this right is absolute.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@paperroute.co.uk. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

6. Cookies and opting out

We use three categories of cookies:

• Strictly necessary — session cookies used for form submissions, CSRF protection, and maintaining your login on the PaperRoute application. These are required for the site to function and cannot be disabled.
• Analytics — Google Analytics 4 (_ga, _ga_*).
• Advertising — Google Ads (_gcl_au, _gcl_aw) and Meta Pixel (_fbp).

Your controls: use Cookie settings on any page to accept, reject or choose analytics and advertising separately. Optional tags do not load before consent. Withdrawing consent stops subsequent measurement and reloads the page to stop loaded tags. You can also:

• Install Google's Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.
• Adjust Google ads personalisation at adssettings.google.com.
• Adjust Facebook/Meta ads personalisation in Settings → Ads within your Meta account.
• Block third-party cookies in your browser settings — this disables analytics and advertising cookies across most sites including ours.

If you need help with your cookie choices, email us at hello@paperroute.co.uk and we'll help you update your choices.

Leadinfo is configured in Cookieless Tracking mode for our domain. In this mode it does not place Leadinfo cookies; company recognition uses the public IP address that is transmitted when the browser requests its tracker. You can object to this processing by contacting us at the address above.

Our first-party company-visit check does not set cookies or write identifiers to local or session storage. Page count and engagement time are held only in the open page's memory and discarded when that page lifecycle ends.

7. Third-party services

Our website and platform integrate with the following third-party services:

• Supabase — database and authentication infrastructure (data stored in EU/EEA).
• Resend — transactional and marketing email delivery.
• Vercel — website hosting and CDN (data centres in EU/EEA and globally).
• Stripe — payment processing for paid subscriptions. Stripe is a PCI-DSS Level 1 certified payment processor; card details are entered directly into Stripe-hosted fields and never touch our servers.
• Google — Google Analytics 4 and Google Ads conversion tracking (see section 2.4).
• Meta (Facebook) — Meta Pixel page-view tracking (see section 2.4).
• Leadinfo — cookieless company-level website visitor identification (see section 2.5).
• People Data Labs — optional IP-to-company enrichment for qualifying high-intent business visits (see section 2.5).
• Companies House — public UK company registration information used to supplement a high-confidence company match.
• Intuit (QuickBooks Online) — accounting integration for subscribers who connect a QuickBooks account. See section 7.1 below.

Each provider maintains its own privacy and security controls. We have data processing agreements in place where required.

7.1 QuickBooks Online integration

Subscribers may optionally connect their QuickBooks Online account to PaperRoute via OAuth 2.0. When a connection is established:

• We request access to your QuickBooks company data under the com.intuit.quickbooks.accounting scope, which allows us to read and write invoices, customers, vendor bills, and payments on your behalf.
• We store OAuth access and refresh tokens in your tenant database, encrypted at rest by Supabase. These tokens are used solely to perform accounting actions you initiate within PaperRoute (such as raising an invoice or recording a payment).
• We do not sell, share, or use QuickBooks data for any purpose other than providing the PaperRoute service to your organisation.
• You can revoke access at any time by clicking Disconnect in PaperRoute Settings → Integrations → QuickBooks, or by revoking access directly in your Intuit account at accounts.intuit.com. On disconnection, stored tokens are immediately invalidated.

QuickBooks® is a registered trademark of Intuit Inc. PaperRoute is not affiliated with, endorsed by, or sponsored by Intuit Inc.

Intuit's own privacy practices are described at intuit.com/privacy/statement.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated to active subscribers by email. The "last updated" date at the top of this page always reflects the most recent version.

9. Contact

If you have any questions about this policy or how we handle your data, please contact us: