Data processing terms

Last updated 18 October 2026

When you enter personal data about other people, such as your clients and their contacts, you decide why and how it is used, and we process it for you. These terms cover that data. They are part of our terms, and where the two differ about that data, these terms apply.

In privacy-law words: you are the controller (or “business”), and we are your processor (or “service provider”). Data about you as our customer is covered by our privacy notice instead.

What we process

Whose data: your clients and their contacts, and anyone else named in what you enter.
What data: names, email addresses, postal addresses, tax numbers, and the contents of your projects, quotes, statements of work, invoices and payment reminders.
Why: only to provide PaperworkPilot to you.
How long: while your account is open, then as set out under “When you leave”.

What we promise

We process the data only to provide the service, following your instructions. Using the app is your instruction. If we think an instruction breaks the law, we will tell you.
We don’t sell or share the data, don’t use it for our own purposes, and don’t combine it with other data, except as needed to provide the service.
Only people who need access to run the service have it, and they must keep it confidential.
We protect the data with the measures described in our privacy notice: encrypted connections, each workspace kept apart by access rules in the database, private file storage and server-only secret keys.

Subprocessors

You allow us to use the providers on our subprocessors page. We will tell you at least 14 days before adding one that processes this data, and you can object as that page explains. We remain responsible to you for what our subprocessors do.

Helping you

If someone asks you to see, correct or delete their data, you can do most of it in the app. For the rest, email us and we will help.
If someone contacts us directly about data you control, we will pass the request to you rather than answer it ourselves, unless the law requires otherwise.
If we become aware of a security breach affecting this data, we will tell you without undue delay, and where possible within 72 hours, with what we know and what we are doing about it.
We will give you the information you reasonably need to show that these terms are kept, and answer a written security questionnaire once a year.

Where the data goes

The data is stored in the United States and the service is run from Vietnam. If you are in the European Economic Area or the UK and need the European Commission’s Standard Contractual Clauses (and, for the UK, the UK Addendum) for this data, email us and we will put them in place with you.

When you leave

When you close your account, we delete your workspace and the data in it within 30 days, except records the law requires us to keep. Before you close it, you can download your documents. Backups held by our providers are overwritten on their usual schedule.

Contact

Questions about these terms: support@yourpaperworkpilot.com.