Data Processing & Security
What this page isThis page explains what data we handle when we run outreach for you, where it goes, how it’s protected, and what you can ask us to do with it. It’s written to be read by your security or legal team, not just your marketer. If any section isn’t detailed enough for a review, ask — we’ll answer directly.
Paperclone is operated by Paperclone Pte Ltd, 61 Ubi Road 1, #03-16 Oxley Bizhub, Singapore 408727.
The data we handle
We process two kinds of data, and we keep them separate in our minds and in our systems.
The first is your data: your company details, your campaign targeting and messaging preferences, and the settings that run your account. You give us this directly, and we use it only to run your campaigns.
The second is prospect data: the names, job titles, companies, email addresses and LinkedIn profiles of the people we reach on your behalf. This is personal data belonging to third parties, and we treat it accordingly. It exists in our systems to deliver your outreach and nothing else. We don’t sell it, we don’t reuse it across clients, and we don’t build anything on top of it.
Why we’re allowed to process it
Business-to-business outreach to professionals, about matters relevant to their work, is carried out on the basis of legitimate interest, with a clear and honoured opt-out on every message. Our full position — lawful basis, your obligations as the client, where prospect data is sourced, and how opt-outs work — lives on our Privacy Framework page. This page stays on the handling and security side.
Where your data is processed
We don’t do everything in-house — no outreach operation does. Your data passes through a small, deliberate set of specialist providers, each handling a single function:
- An AI drafting providergenerates and drafts outreach and replies.United States
- A scheduling and sending providersequences and publishes outreach activity.United States
- An email delivery providerdelivers email outreach.European Union
- A hosting providerhosts this site and stored assets.Singapore
- A prospect-data sourcesupplies prospect contact data; operates under GDPR and CCPA frameworks.European Union
We publish the function and region of every provider that touches your data. We keep the named vendor list current and available to clients under NDA. If your security team needs the specific names for a vendor review, ask — we’ll provide the full list.
Cross-border handling
Some providers above operate outside Singapore, including in the United States and the European Union, which means your campaign and prospect data may be processed in those jurisdictions. We work only with providers who publish their own data-protection commitments — such as GDPR or CCPA compliance — consistent with the transfer requirements under Singapore’s PDPA.
How it’s protected
Data is encrypted in transit and at rest. Access is tightly held: access to live client systems sits with a single senior operator, on the principle that the fewer hands touch your data, the smaller the surface for anything to go wrong. Each client’s data and credentials are isolated — one client’s workspace never touches another’s. Credentials are held in an encrypted vault, never shared, and revoked and confirmed on offboarding. Activity is logged. The detail on account and credential handling is on our Account Safety page; this is the summary.
Your domains stay yours
Where a campaign needs dedicated sending domains, we purchase them for you and operate them during the engagement. When the engagement ends, those domains transfer to you — warmed, authenticated and ready — rather than being retired. You end up owning the infrastructure your pipeline was built on.
Continuity
Your data and campaign configuration are backed up and recoverable. Because campaigns run on autonomous systems, outreach can be paused cleanly at any point without data loss or stranded activity. In the event of prolonged operator unavailability, active campaigns are paused and your data remains recoverable and retrievable on request.
How long we keep it, and how to remove it
When an engagement ends, your campaign data and all email-side prospect data are deleted immediately.
LinkedIn outreach runs on accounts we own and operate, not on yours. Those accounts and their on-platform message history remain with us as the operator of the account. A prospect can opt out at any time, permanently, and you or any prospect can request deletion of specific data — which we complete within 30 days and confirm when done. We retain LinkedIn message history no longer than 3 months after a campaign’s last activity unless the account is actively reused for a continuing engagement.
Where we stand on SOC 2
Our controls are modelled on the SOC 2 Trust Service Criteria — security, availability and confidentiality — covering access control, encryption, data isolation, logging and vendor management. We are not SOC 2 certified, and we won’t imply otherwise: formal certification isn’t something a team our size pursues today. What we do instead is operate to the standard the framework describes, and show you exactly how — control by control — if your review calls for it.
Your rights, in plain terms
You can ask what data we hold, ask us to correct it, ask us to delete it, and ask us to stop. Anyone we’ve contacted on your behalf can opt out, and that opt-out is permanent. To make any of these requests, contact us at privacy@papercl.one.