Privacy Framework
Effective 5 October 2026. Operated by Paperclone Pte Ltd, 61 Ubi Road 1, #03-16 Oxley Bizhub, Singapore 408727.
Why this page exists
Most privacy policies are written to protect the company from the reader. This one is written to be read. If we’ve contacted you and you want to know how we got your details and what we do with them, this page answers it plainly. If you’re a client’s legal or security team reviewing us, it tells you where we stand. Where the law is technical, we’ve said it in plain terms and we’re happy to go deeper on request.
Who’s who
When we run outreach for a client, there are two relationships to be clear about, because they carry different responsibilities.
Our client decides who they want to reach and what they’re offering — their market, their message intent, their brief. That part is theirs, and we act on it.
How that outreach is then sourced, built and sent — where prospect data comes from, how it’s handled, how someone opts out and how their data is deleted — is ours. We don’t pass that back to the client, and we don’t treat “we were only following the client’s brief” as cover. If we’re the ones who sourced your data and sent you the message, the standards on this page are ours to keep, regardless of who hired us.
If we’ve contacted you — here’s what you should know
- Who we are. Paperclone Pte Ltd, a Singapore company. Our contact is below.
- Why you’re hearing from us. We’re reaching out on behalf of a client whose product or service is relevant to your professional role. We only contact people in a business capacity, about business matters.
- What data we hold about you. Typically your name, job title, company, and business contact details — the kind of professional information used to reach someone at work.
- Where we got it. From a professional-data provider that operates under GDPR and CCPA frameworks, or from publicly available professional sources. We can tell you the specific source for your record if you ask.
- How to make it stop. Every message we send carries a way to opt out. One request and you’re removed, permanently. You can also email us directly, below.
How we contact you — and how we don’t
We reach people in a business capacity, through business channels: a message on LinkedIn, or an email to a work address. We work only from business contact data, about business matters.
We don’t cold-call you, and we don’t text you. The only time correspondence moves to a phone number is when you’ve offered one and asked us to use it — never before.
The basis we rely on
For business-to-business outreach to professionals, about matters relevant to their work, we rely on legitimate interest, with an unconditional opt-out on every message. We don’t claim you consented to hear from us — you didn’t, and pretending otherwise would be dishonest. We claim that professional outreach, done with restraint and an easy exit, is a reasonable thing to do, and that the moment you’d rather not receive it, it stops.
Under Singapore’s Personal Data Protection Act, business contact information used for business purposes carries lighter obligations than personal data. We stay inside that scope deliberately — business data, business channels, business matters — and we apply the same unconditional opt-out regardless of what the law strictly requires.
What we do with your data, and what we never do
We use your data to deliver the outreach described above, and for nothing else. We don’t sell it. We don’t rent it. We don’t reuse one client’s prospect data to benefit another. We don’t build a resale list or a data product on the back of who we’ve contacted. Your details exist in our systems to carry one conversation, and when that purpose ends, so does our need to hold them.
How long we keep it
Email-side prospect data is deleted as soon as the campaign it belongs to ends. For outreach conducted on LinkedIn — which runs on accounts we own and operate — the on-platform message history remains with us as the account operator, retained no longer than 3 months after a campaign’s last activity unless the account is actively carrying a continuing engagement. Any individual can request earlier deletion of their data at any time, and we complete it within 30 days and confirm when it’s done.
Your rights, in plain terms
Wherever you are, you can ask us what we hold about you, ask us to correct it, ask us to delete it, and tell us to stop contacting you. If you’re covered by GDPR, CCPA, Singapore’s PDPA, or a similar framework, you have those rights formally — and we’ll honour them without making you cite a statute. Opt-outs are permanent and we don’t “forget” them.
Where your data is handled
Running outreach involves a small set of specialist providers, some of which operate outside Singapore, including in the United States and the European Union. We only work with providers who publish their own data-protection commitments consistent with the transfer requirements under Singapore’s PDPA. The function and location of each is listed on our Data Processing page.
Changes to this framework
If we change how we handle data in a way that affects you, we’ll update this page and move the effective date above. Material changes that affect existing clients, we’ll raise with them directly.
Contact
Questions, requests, or opt-outs: privacy@papercl.one. A real person — or a system a real person watches — reads that inbox, and we answer.