How we handle your information

The form asks for one thing: your email address. You can also give your name, your business's name and its website. We save these with the date you joined and one word for the button that brought you, such as the plan you chose.

We use your address to confirm that you are on the list, and to write again when a place opens. We use it for nothing else. Only Papergale's operators can see the list.

We do not save your IP address or your browser's details with your entry. To stop the form being flooded, we count recent attempts for up to an hour, and those counters hold a scrambled (hashed) form of the addresses, not the addresses themselves.

There is no automatic deletion: we keep your entry until you ask us to remove it.

Joining sends you one confirmation, and when a place opens we send an invitation. These emails go through Resend, an email delivery service, which receives your address and the message. Your name, if you gave it, stays with us.

If you own a Papergale workspace, we email you when a day's posts are ready to review, and again when a post is revised after a change was asked for. These emails also go through Resend. They say how many posts are ready and link to your sign-in, and never contain the posts themselves. You can turn them off under Settings in Papergale.

We write these emails with no images and no tracking pixel of our own. If Resend reports that one was opened or a link in it clicked, we keep a record of that report (what happened, to which message, and when) and do nothing else with it.

If an email to you bounces, or you mark it as spam, we stop sending to that address and keep a note of it, so we do not start again.

We count visits with Umami, which we run ourselves at analytics.papergale.com rather than handing to an advertising company. It sets no cookies and stores no personal identifier for you. Like any web server, it sees your IP address when your browser contacts it.

It records which pages are opened, the page or campaign that led to them, and a few named actions, such as which plan was pressed, or that the waitlist form was started and sent. With each of these your browser also sends its screen size, its language, and its user agent (the line that names the browser and operating system). It never receives what you type into a form, and any part of a web address that works as a key, such as a private link, is removed before anything is sent.

On a business's sample page, it also records which business the page belongs to, so we can tell that its samples were opened and which tabs, slides and buttons were used. That names the business, not the person reading.

There is no analytics at all in the customer workspace or in our own console.

Our marketing pages, this page and the waitlist set no cookies.

If you use the light and dark switch, your browser remembers the choice in its own storage on your device. It is not sent to us.

Two other parts of the site do set a cookie. A private preview link sets one that lasts ten minutes, so the preview can open without its key showing in the address bar. Our operators get a sign-in cookie when they sign in to our console.

We look for businesses that might want our service and write to them by email. Before we write, we draft a few sample posts for the business, so the email can show real work rather than describe it.

We find businesses and their contact details in public and commercial sources:

• web searches, run through Serper, a Google search service;
• the business's own website;
• public licensing registers, such as the US register of healthcare providers and state licensing boards;
• Apollo, a database of business contacts.

From these we keep the business's name, website, trade and town, what its website says it does, and the email address and phone number it publishes. We also keep the names and job titles of the people its own website names, staff included, and the LinkedIn profiles of people who run it, such as owners, partners, directors and licence holders. For some businesses that publish no email address, we keep a work address that Apollo has checked.

Our emails are sent through Smartlead, an email sending service, from Google (Gmail) mailboxes on our own web addresses. Smartlead receives the recipient's email address and first name, the business's name and website, and the text of the email. We ask Smartlead not to track whether an email is opened or a link is clicked. It tells us when an email is sent, answered, bounced or unsubscribed from, and if it reports an open or a click anyway, we record that too, always against the business, not the person. Besides the unsubscribe link, the email links to the business's sample page, and what our analytics records there is described under "What we measure on this site".

Every email has an unsubscribe link that never expires. Using it, replying to ask us to stop, or unsubscribing through Smartlead puts your address on our do-not-contact list, and we never email it again. Any reply at all stops the rest of that sequence of emails.

Replies arrive in those mailboxes, and we read them in Smartlead. To sort a reply as positive, neutral, negative or asking us to stop, we use simple rules first and then, if needed, Anthropic's Claude, which receives the reply's text and nothing else. Our own records keep the category and a fingerprint (hash) of the reply, not the reply itself, with one exception: if the AI service fails, or answers in a form we cannot use, our record of that attempt can keep the reply's words.

The sample posts sit on a page of their own on papergale.com, showing the business's name, town and website, and the posts with pictures we found on the web. We keep a record of the site each picture came from. The page is hidden from search engines, and we can take it down at any time. Ask at lucas@papergale.com.

Each sample post is written by one AI model and its facts are checked against its sources by a model from the other company, both working from the business's own website and from research about its trade. By default Anthropic's Claude writes and an OpenAI model checks; some samples made on 23 September 2026 were written by an OpenAI model and checked by Claude.

OpenAI's models also read a business's website and search results to judge whether it fits and to pick out the contact details, staff names and job titles published there, and look over the pictures we find on the web before we use them. Anthropic's Claude sorts replies to our emails, as described above.

Nothing you type into the waitlist form is sent to either of them.

Our website, our database and our analytics run on Railway, a cloud hosting service. Lists of businesses we may contact are also kept in our code repository on GitHub, and our tools for finding businesses run on our own computers.

These companies handle information for us, each only for the job named here:

• Railway hosts the website, the database, our file storage and our analytics.
• Resend sends the emails about your place on the waitlist, and a workspace owner's emails about posts ready to review.
• Smartlead sends our emails to businesses, from mailboxes Google provides, where replies arrive.
• Anthropic and OpenAI provide the AI models described above.
• Apollo and Serper are sources we search, as described above.
• GitHub hosts our code and our working files.

We do not sell personal information, and we do not share it with advertisers.

• To see what we hold about you, or to have it corrected or deleted, write to lucas@papergale.com.
• To stop our emails to your business, use the unsubscribe link in any of them, or reply and ask us to stop.
• If you ask us to delete your details and never contact you again, we keep your email address on our do-not-contact list, because that list is how we keep the promise. Earlier copies of business lists in our code repository's history stay there.

When what we do changes, we change this page and the date at the top.