Privacy Policy

1. Who we are

PaperRoute is a product of Saunders Simmons Ltd, a company registered in England and Wales (company number available on request), with its registered office in Yeovil, Somerset.

For the purposes of UK data protection law, Saunders Simmons Ltd is the data controller for personal data collected through this website and the PaperRoute software platform.

Contact us: hello@paperroute.co.uk

2. What data we collect and why

2.1 Demo requests

When you submit a demo request via the form on our website, we collect your first name, last name, company name, phone number, email address, and any message you provide.

Purpose: To contact you about a demo of PaperRoute and to follow up on your enquiry.
Legal basis: Legitimate interests (responding to a direct enquiry from a prospective customer — Article 6(1)(f) UK GDPR).

2.2 Free compliance tools (WTN, CoD, HWCN generators)

When you use our free Waste Transfer Note, Certificate of Destruction, or Hazardous Waste Consignment Note generators, we collect the information you enter into the form — which may include business names, addresses, contact names, email addresses, and details about the waste or materials involved.

We use this data to generate and email you the requested PDF document. We also retain a copy of the submission in our secure database for audit and service improvement purposes.

Purpose: To generate and deliver the document you requested, and to maintain a record for service quality purposes.
Legal basis: Legitimate interests (providing a free tool you have actively requested — Article 6(1)(f) UK GDPR).

2.3 PaperRoute software subscribers

If you subscribe to the PaperRoute platform, we process personal data as set out in your subscription agreement and data processing addendum. As a software provider, we act as a data processor on your behalf for data entered into the platform by you or your staff, and as a data controller for account management data (name, email, billing information).

2.4 Website analytics and advertising measurement

We use the following third-party tools to measure how visitors use our website and to measure whether paid advertising drives signups:

• Google Analytics 4 — aggregate traffic patterns (pages visited, referrer, country-level location, device type). Retention: 14 months. Cookies set: _ga, _ga_*.
• Google Ads conversion tracking — measures whether a signup came from a paid Google ad. When you complete a trial signup form, a hashed version of your email and phone number is sent to Google so they can match the conversion to the ad click. Cookies set: _gcl_au, _gcl_aw.
• Meta (Facebook) Pixel — measures page views and (historically) lead events for Facebook/Instagram advertising. The ad account is currently paused and lead events are not fired; we retain the page-view pixel so audience data is available should we resume advertising. Cookies set: _fbp.

Legal basis: Legitimate interests — measuring site usage and advertising effectiveness in a proportionate way (Article 6(1)(f) UK GDPR). You can opt out at any time using the mechanisms in section 6.

A granular cookie consent banner is planned and has not yet been deployed. Until it ships, these cookies are set on page load; section 6 describes how to opt out in the meantime.

3. How we store and protect your data

Personal data is stored in Supabase (a cloud database platform with servers located within the EU/EEA) and is transmitted via Resend (an email delivery service). Both providers are bound by data processing agreements and maintain appropriate technical and organisational security measures.

We do not sell, rent, or trade your personal data to third parties.

4. How long we keep your data

5. Your rights under UK GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your data where there is no compelling reason for us to continue processing it.
• Restriction — ask us to restrict how we process your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@paperroute.co.uk. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

6. Cookies and opting out

We use three categories of cookies:

• Strictly necessary — session cookies used for form submissions, CSRF protection, and maintaining your login on the PaperRoute application. These are required for the site to function and cannot be disabled.
• Analytics — Google Analytics 4 (_ga, _ga_*).
• Advertising — Google Ads (_gcl_au, _gcl_aw) and Meta Pixel (_fbp).

How to opt out today (while the cookie banner is still being built):

• Install Google's Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.
• Adjust Google ads personalisation at adssettings.google.com.
• Adjust Facebook/Meta ads personalisation in Settings → Ads within your Meta account.
• Block third-party cookies in your browser settings — this disables analytics and advertising cookies across most sites including ours.

If you would prefer all analytics and advertising cookies removed from your visit, email us at hello@paperroute.co.uk and we'll confirm the next steps with you manually while the banner is in development.

7. Third-party services

Our website and platform integrate with the following third-party services:

• Supabase — database and authentication infrastructure (data stored in EU/EEA).
• Resend — transactional and marketing email delivery.
• Vercel — website hosting and CDN (data centres in EU/EEA and globally).
• Stripe — payment processing for paid subscriptions. Stripe is a PCI-DSS Level 1 certified payment processor; card details are entered directly into Stripe-hosted fields and never touch our servers.
• Google — Google Analytics 4 and Google Ads conversion tracking (see section 2.4).
• Meta (Facebook) — Meta Pixel page-view tracking (see section 2.4).
• Intuit (QuickBooks Online) — accounting integration for subscribers who connect a QuickBooks account. See section 7.1 below.

Each provider maintains its own privacy and security controls. We have data processing agreements in place where required.

7.1 QuickBooks Online integration

Subscribers may optionally connect their QuickBooks Online account to PaperRoute via OAuth 2.0. When a connection is established:

• We request access to your QuickBooks company data under the com.intuit.quickbooks.accounting scope, which allows us to read and write invoices, customers, vendor bills, and payments on your behalf.
• We store OAuth access and refresh tokens in your tenant database, encrypted at rest by Supabase. These tokens are used solely to perform accounting actions you initiate within PaperRoute (such as raising an invoice or recording a payment).
• We do not sell, share, or use QuickBooks data for any purpose other than providing the PaperRoute service to your organisation.
• You can revoke access at any time by clicking Disconnect in PaperRoute Settings → Integrations → QuickBooks, or by revoking access directly in your Intuit account at accounts.intuit.com. On disconnection, stored tokens are immediately invalidated.

QuickBooks® is a registered trademark of Intuit Inc. PaperRoute is not affiliated with, endorsed by, or sponsored by Intuit Inc.

Intuit's own privacy practices are described at intuit.com/privacy/statement.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated to active subscribers by email. The "last updated" date at the top of this page always reflects the most recent version.

9. Contact

If you have any questions about this policy or how we handle your data, please contact us: