Privacy
Privacy Policy
This policy explains what personal data we collect when you use this website, the demo, the documentation, your account and the BroadPaper software, why we collect it, and what rights you have. We are the controller of that data; who we are and how to reach us is in the margin. We are subject to the UK GDPR and the Data Protection Act 2018.
The short version: this website collects almost nothing, and the software collects nothing at all.
1. The software
The BroadPaper packages run inside your own application and infrastructure. They make no network calls to us, do not contain analytics or telemetry, and verify licence keys locally. We never receive your templates, your data, your themes or the documents you produce. If you use the render service, it is a server you run; we do not operate it for you.
2. This website, the demo and the documentation
What we collect
- Server logs. The hosting platform records the IP address, user agent, requested address, referrer and time of each request, as web servers do. We use these to keep the site running and secure and to see how much it is used. Logs are kept for no more than ninety days.
- Your consent choice. One cookie,
bp_consent, records whether you accepted optional cookies. See the cookie policy. - Analytics, only if you opt in. We use Microsoft Clarity, and it loads only after you turn on the Analytics category in the cookie banner — until then the script is never requested. It records the pages you view, clicks, scrolling and a replay of your session, with text and form fields masked, together with your approximate location, browser and device from your IP address. Microsoft process this for us and may combine it with their own identifiers; the cookies involved are listed in the cookie policy. Withdraw consent at any time through Cookie settings and the recording stops.
- The demo’s drafts. The demo keeps the report you are editing in your browser’s local storage so you can come back to it. That data stays in your browser and is never sent to us.
What we do not collect
No advertising cookies, no social media pixels, and nothing at all in this section unless you opted in. Fonts are served from this site, not from a third party, so opening a page here tells nobody else you did.
If you do turn analytics on, be aware of what that honestly means: Clarity is Microsoft’s, and the identifiers it sets are ones Microsoft also use across their own properties. We set advertising storage to denied so that identifier is not used to target you, and we neither receive nor ask for anything that would let us do so — but “no cross-site tracking whatsoever” would be an overstatement, and we would rather say so than claim otherwise.
3. Your account
If you create an account we receive, from the identity provider you choose (GitHub or Microsoft), your name, email address and a provider user id. We store these to identify you, attach licences to you, send you licence keys, invoices and renewal notices, and answer support requests. We do not receive your password.
Because a licence key has to be issued to somebody, and an invoice has to name a customer, this processing is necessary to perform our contract with you. Sending renewal notices and security notices is in our legitimate interest in running the service; we will not send marketing email unless you ask for it, and every marketing email will have an unsubscribe link.
Account data is kept while you have an account and for six years afterwards, because tax law requires us to keep invoicing records for that long. You can close your account by writing to us.
4. Purchases
Payments will be processed by a payment provider. When purchasing opens, this section will name the provider and link to their policy. We will not see or store your full card number. We receive confirmation of payment, the last four digits of the card, and the billing name and address you enter, which we keep with the invoice.
5. Support email
If you write to us we keep the correspondence for as long as needed to deal with it and for three years afterwards, so that we can see what was said if the question comes back.
6. Who we share data with
- Our hosting provider (Microsoft Azure, Static Web Apps, in a UK or EU region) processes server logs and hosts the account sign-in flow on our behalf.
- Microsoft Clarity processes website analytics on our behalf, but only for visitors who turned the Analytics category on.
- Identity providers (GitHub, Microsoft) process your sign-in under their own policies. We only receive what section 3 describes.
- Payment and invoicing providers, once purchasing opens, as section 4 describes.
- Professional advisers and authorities, where the law requires it.
We do not sell personal data and do not share it for advertising.
7. International transfers
Our hosting is in the UK or the European Economic Area. Microsoft Clarity, identity providers and payment providers may process data in the United States; where they do, transfers are covered by the UK’s adequacy decisions or by the International Data Transfer Agreement or standard contractual clauses.
8. Your rights
You can ask us to tell you what personal data we hold about you, to correct it, to delete it, to restrict or object to how we use it, and to give you a copy in a portable form. Where we rely on consent (the analytics cookie), you can withdraw it at any time through Cookie settings in the footer. Write to the privacy address below; we will reply within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first.
9. Children
The website and the software are for businesses and developers and are not directed at children under sixteen. We do not knowingly collect data from them.
10. Changes
We will update this policy when what we collect changes, and the date at the top will move. Material changes to how we use account data will be notified by email.
11. Contact
Privacy questions go to the privacy address: privacy@broadpaper.com, or by post to the address in the margin.