Draft – to be reviewed before launch.

Privacy notice

Last updated: 4 October 2026

1. Who we are

SitePaper is a trading name of Toolhouse Labs Ltd, company number 17498150, registered in England and Wales.

Our registered office is 6 Edison Village, Nottingham Science & Technology Park, Nottingham, NG7 2RF.

For personal data that we use for our own purposes, Toolhouse Labs Ltd is the controller.

You can contact us about privacy at hello@sitepaper.co.uk or on 0333 772 4845.

2. When we are controller and when we are processor

We are the controller for personal data used to:

Where a business customer puts personal data about its workers, contractors, clients or other people into a document, that customer will normally be the controller and we will act as its processor.

If your information appears in a document created by one of our business customers, you should normally contact that customer first. We will assist the customer with your request as required by data protection law.

3. Information we collect

Account and contact information

This includes:

We do not use account passwords because SitePaper uses email magic links.

Project and document information

This includes:

Some project information may be personal data, particularly where a site name identifies a sole trader or a document names or describes a worker.

Payment information

Stripe collects and processes full payment-card details.

We receive and retain information such as:

We do not store your full card number or security code.

Support and correspondence

This includes emails, support requests, complaints, refund requests and records of how we responded.

Technical and security information

This may include:

Analytics information

When self-hosted Umami analytics is enabled, we collect limited information about use of the website, such as:

Umami sets no cookies, uses no advertising identifiers and does no cross-site tracking. It does not store your IP address. Before anything is sent we remove sign-in tokens and other personal details from page addresses and replace document numbers with a placeholder. We do not use analytics to identify users or make decisions about them. Further information and the analytics opt-out are in our Cookie Notice.

4. Where information comes from

We obtain personal data:

5. Why we use personal data

| Purpose | Information used | Lawful basis |

|---|---|---|

| Create accounts, authenticate users, generate and store documents, provide downloads and support | Account, contact, project and document information | Performance of our contract with you, or steps requested before entering a contract |

| Process and administer payments, subscriptions, cancellations and refunds | Account, order, payment and subscription information | Performance of our contract and compliance with legal obligations |

| Keep accounting, tax and company records | Order, payment, invoice and contact information | Legal obligation |

| Secure SitePaper, prevent fraud and misuse, investigate incidents and maintain audit logs | Account, technical, security, payment and event information | Our legitimate interests in protecting users, the service and our business |

| Diagnose faults and improve the service | Technical, support and limited analytics information | Our legitimate interests in maintaining and improving a reliable service |

| Handle complaints and establish, exercise or defend legal claims | Account, document, payment, support and technical information | Our legitimate interests in resolving disputes and protecting legal rights |

| Send service messages, receipts, magic links and important subscription notices | Email, account, order and subscription information | Performance of our contract and legal obligation |

| Send optional marketing | Email and marketing preference | Consent, or legitimate interests where the PECR soft opt-in or business-to-business rules lawfully apply |

Our legitimate interests are operating a secure and reliable service, understanding service performance, preventing misuse, supporting customers and protecting legal rights. We consider whether those interests are necessary and balanced against the rights of affected people.

6. Information required to provide the service

We need an email address to create an account, send a magic link, provide order information and give access to purchased documents.

We need sufficient project and work information to generate a document. We need payment information for a paid purchase or subscription.

You are not legally required to provide this information, but without it we may be unable to create an account, generate the requested document or complete the transaction.

Optional fields will be identified where reasonably practicable.

7. Artificial intelligence

SitePaper uses Anthropic’s commercial API for a limited wording step.

We send Anthropic the free-text work description so that it can return clearer draft wording. Structured fields such as the separate company-name and address fields are not included in that request.

Anything you type into the free-text work description will be transmitted. Do not put names, addresses, medical details, accident information or other unnecessary personal data into that field.

Anthropic processes the submitted text on our instructions to provide the API response. We use its commercial API and do not opt in to using SitePaper inputs or outputs for model training.

The AI output supports the document draft. It does not make a decision about a person and must be reviewed by the user.

8. Other people’s information and sensitive information

SitePaper is not designed to hold named medical records, personnel files, accident investigations or criminal-offence information.

Use role descriptions rather than names wherever possible. Do not enter unnecessary information about a person’s:

If a business customer instructs us to process such information in a document, the customer is responsible for identifying both an Article 6 lawful basis and any required Article 9 or Data Protection Act 2018 condition. We process it only on the customer’s documented instructions.

If we are controller for special-category data supplied directly by an individual, we will process it only where a valid Article 9 condition applies. Where no condition applies, we may remove the information and ask for a non-identifying description instead.

9. Who receives personal data

We use the following service providers:

Stripe also acts as an independent controller for some payment, regulatory and fraud-prevention activities. Its own privacy notice applies to those activities.

We do not sell personal data.

We may disclose data as part of a genuine business sale or reorganisation, subject to confidentiality and appropriate data protection safeguards.

10. International transfers

Our application, database and document archive are hosted in the UK (Hostinger, Manchester). Offsite backups are stored in the EU (Backblaze, Amsterdam), which the UK recognises as adequate.

Stripe, Anthropic and Resend are international providers and may process personal data in the United States or other countries outside the United Kingdom.

For a restricted transfer, we use the applicable safeguard, which may include:

Where required, we carry out the relevant data protection test and consider supplementary technical and organisational measures.

Email hello@sitepaper.co.uk if you would like more information or a copy of the relevant contractual safeguard. We may redact confidential commercial or security information.

11. How long we keep information

We use the following normal retention periods:

| Information | Normal retention |

|---|---|

| Unpaid previews and draft documents | Deleted automatically 30 days after they were created (Pro members' documents are kept while Pro is active) |

| Purchased PDF, Word and JSON document archives | Six years from the date each document is supplied |

| Account profile and active-session records | While the account is active; sign-in sessions expire after 30 days and are then deleted |

| Account profile after closure or prolonged inactivity | 24 months, except information linked to an order or retained document |

| Order, payment, subscription, refund and accounting records | Six years after the end of the financial year to which the record relates |

| Support messages and complaints | Two years after the matter is closed |

| Transactional email delivery records | 90 days, unless needed for a current complaint or security investigation |

| Security, access and audit logs | 12 months |

| Analytics records (page views and site events, no IP address, linked only by an anonymous identifier that changes every month) | Up to 24 months |

| Deleted information in rolling backups | Up to 30 days before automatic overwrite |

We may keep particular information longer where reasonably necessary for an active dispute, fraud investigation, legal hold or statutory requirement.

When information is no longer needed, we delete it or anonymise it so that it can no longer be linked to an individual.

12. Security

We use measures appropriate to the nature of the information, including access controls, encrypted network connections, restricted administrative access, signed or hashed authentication tokens, backups and security logging.

No online service can guarantee absolute security. Please contact hello@sitepaper.co.uk promptly if you believe your account or information has been compromised.

13. Marketing

Service emails, such as magic links, receipts, document links, security notices and subscription messages, are not marketing.

We send marketing to individuals, sole traders and similar individual subscribers only where we have consent or all requirements of the PECR soft opt-in are met. We give an opt-out when details are collected and in every marketing message.

We may send relevant business marketing to corporate subscribers where permitted by law, but we will identify ourselves and provide an unsubscribe method.

You have an unconditional right to object to direct marketing at any time.

Use the unsubscribe link in the message or email hello@sitepaper.co.uk. We keep a minimal suppression record so that we can respect the opt-out.

14. Automated decision-making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

AI-assisted wording is used to help produce a draft document. The user remains responsible for reviewing the draft and making workplace decisions.

15. Your rights

Depending on the circumstances and lawful basis, you may have the right to:

These rights are not absolute. For example, we may need to keep accounting records or information required for a legal claim.

Email hello@sitepaper.co.uk to exercise a right. Tell us what you are asking for and provide information that reasonably allows us to identify the relevant account or record.

We may ask for proportionate evidence of identity. We will respond without undue delay and normally within one month, subject to any lawful extension.

If we hold your data only as a processor for a business customer, we may refer the request to that customer and assist it with the response.

16. Complaints

Please contact us first at hello@sitepaper.co.uk so that we can investigate.

You also have the right to complain to the Information Commissioner’s Office:

17. Changes to this notice

We may update this notice when our service, suppliers or legal obligations change.

We will publish the updated notice with a new revision date. We will give additional notice where a change materially affects how we use personal data.