Privacy Policy

1. Who we are

PaperRoute is a product of Saunders Simmons Ltd, a company registered in England and Wales (company number available on request), with its registered office in Yeovil, Somerset.

For the purposes of UK data protection law, Saunders Simmons Ltd is the data controller for personal data collected through this website and the PaperRoute software platform.

Contact us: hello@paperroute.co.uk

2. What data we collect and why

2.1 Demo requests

When you submit a demo request via the form on our website, we collect your first name, last name, company name, phone number, email address, and any message you provide.

Purpose: To contact you about a demo of PaperRoute and to follow up on your enquiry.
Legal basis: Legitimate interests (responding to a direct enquiry from a prospective customer — Article 6(1)(f) UK GDPR).

2.2 Free compliance tools (WTN, CoD, HWCN generators)

When you use our free Waste Transfer Note, Certificate of Destruction, or Hazardous Waste Consignment Note generators, we collect the information you enter into the form — which may include business names, addresses, contact names, email addresses, and details about the waste or materials involved.

We use this data to generate and email you the requested PDF document. We also retain a copy of the submission in our secure database for audit and service improvement purposes.

Purpose: To generate and deliver the document you requested, and to maintain a record for service quality purposes.
Legal basis: Legitimate interests (providing a free tool you have actively requested — Article 6(1)(f) UK GDPR).

2.3 PaperRoute software subscribers

If you subscribe to the PaperRoute platform, we process personal data as set out in your subscription agreement and data processing addendum. As a software provider, we act as a data processor on your behalf for data entered into the platform by you or your staff, and as a data controller for account management data (name, email, billing information).

2.4 Website analytics

We may collect anonymised usage data (pages visited, browser type, geographic region) to understand how visitors use our website and to improve it. Where we use third-party analytics tools, we configure them to anonymise IP addresses.

3. How we store and protect your data

Personal data is stored in Supabase (a cloud database platform with servers located within the EU/EEA) and is transmitted via Resend (an email delivery service). Both providers are bound by data processing agreements and maintain appropriate technical and organisational security measures.

We do not sell, rent, or trade your personal data to third parties.

4. How long we keep your data

5. Your rights under UK GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your data where there is no compelling reason for us to continue processing it.
• Restriction — ask us to restrict how we process your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@paperroute.co.uk. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

6. Cookies

Our website may use strictly necessary cookies to maintain session state and security. We do not currently use tracking or advertising cookies. If this changes, we will update this policy and, where required under PECR, seek your consent before setting non-essential cookies.

7. Third-party services

Our website and platform integrate with the following third-party services:

• Supabase — database and authentication infrastructure (data stored in EU/EEA).
• Resend — transactional email delivery.
• Vercel — website hosting and CDN (data centres in EU/EEA and globally).
• Intuit (QuickBooks Online) — accounting integration for subscribers who connect a QuickBooks account. See section 7.1 below.

Each provider maintains its own privacy and security controls. We have data processing agreements in place where required.

7.1 QuickBooks Online integration

Subscribers may optionally connect their QuickBooks Online account to PaperRoute via OAuth 2.0. When a connection is established:

• We request access to your QuickBooks company data under the com.intuit.quickbooks.accounting scope, which allows us to read and write invoices, customers, vendor bills, and payments on your behalf.
• We store OAuth access and refresh tokens in your tenant database, encrypted at rest by Supabase. These tokens are used solely to perform accounting actions you initiate within PaperRoute (such as raising an invoice or recording a payment).
• We do not sell, share, or use QuickBooks data for any purpose other than providing the PaperRoute service to your organisation.
• You can revoke access at any time by clicking Disconnect in PaperRoute Settings → Integrations → QuickBooks, or by revoking access directly in your Intuit account at accounts.intuit.com. On disconnection, stored tokens are immediately invalidated.

QuickBooks® is a registered trademark of Intuit Inc. PaperRoute is not affiliated with, endorsed by, or sponsored by Intuit Inc.

Intuit's own privacy practices are described at intuit.com/privacy/statement.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated to active subscribers by email. The "last updated" date at the top of this page always reflects the most recent version.

9. Contact

If you have any questions about this policy or how we handle your data, please contact us: