Privacy policy

On the Start page and enquiry forms: your name or shop name, phone or email, and whatever you choose to tell us about the site you need, such as your line of business, style and notes.

To stop mass submissions we keep a one-way hash of your IP address to limit submissions per day; we never keep the address itself.

We do not collect ID numbers, bank or card details. Payments do not go through this site.

This site counts visits with Vercel Analytics, which uses no cookies and does not identify individual visitors.

Answering your enquiry; creating and updating your progress and quote pages; building and maintaining your site and billing for it; and answering later enquiries.

We never use your data for direct marketing, and never sell or rent it to anyone.

Only Paperstem handles your data. It is stored with these providers: Vercel (hosting), Supabase (database) and Cloudflare (domain and email forwarding), which store and transmit it only on our instructions.

Vercel and Supabase are both certified to ISO 27001 and hold SOC 2 Type 2 reports. Data is encrypted in transit with TLS, and Supabase encrypts stored data with AES-256.

These providers' servers may be outside Hong Kong.

We give your data to no one else unless the law requires it.

Enquiries that do not become projects are kept for no more than twelve months.

For projects, billing records are kept for seven years as tax rules require; everything else is deleted within twelve months of the service ending. You can ask us to delete it sooner, except what the law requires us to keep.

You can ask to see or correct the personal data we hold about you, or ask us to delete it. Email info@paperstemstudio.com and we reply within forty days.

The Ordinance allows a reasonable fee for a data access request; normally we charge nothing.

Data collected by the sites we build for clients (a shop's enquiry form, for example) belongs to that shop. The owner is the data user; Paperstem only processes it on their behalf.

To see or delete what you left on one of those sites, contact the shop directly; we help the owner deal with it.

Only authorised accounts can sign in to an admin, and each client sees only their own site's data.

If we find a data breach, we tell the affected clients and people as soon as we can.

Privacy questions: info@paperstemstudio.com.

When this policy changes, the date on this page changes with it.