Effective Date: April 11, 2025
1. Introduction
Paperless Blueprint ("we," "us," "our") values your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you use our website, products (including our WhatsApp AI Employee / WA Hub service), and services (collectively, the "Services").
We handle personal data in line with the Trinidad and Tobago Data Protection Act (the "DPA," to the extent it is in force) and, where applicable, Meta's platform policies for the WhatsApp Business Platform, as well as other data-protection laws applicable to you or your customers.
This Policy is incorporated into our Terms of Service and should be read alongside our Cookie Policy.
2. Who This Policy Applies To
This Policy covers three groups:
- Visitors — people who browse our website.
- Clients — businesses and individuals who engage our Services.
- Client end-users — the customers of our Clients whose data we process when delivering Services (for example, the WhatsApp contacts a Client uses with WA Hub, or an advertising audience a Client asks us to manage).
3. Our Role: Controller and Processor
Our responsibilities depend on whose data is involved:
- Where we are the data controller: For data about Visitors and Clients (such as your contact and account details and how you use our website), we decide how and why the data is used, and this Policy governs that use.
- Where we are the data processor: When we handle Client end-user data on a Client's behalf (such as customer contacts in a WA Hub campaign or audience data in an ad campaign), the Client is the data controller and we process that data only on the Client's instructions, as set out in our Master Service Agreement. In that case, the Client's own privacy notice governs how that data may be used, and the Client is responsible for having a lawful basis (including consent) for providing it to us.
4. Information We Collect
Depending on how you interact with us, we may collect:
- Contact information: name, email address, phone number.
- Account and business information: profile details, business details, and (for WA Hub) WhatsApp Business Account information.
- Usage data: interactions with our website and Services, including pages visited, features used, and actions taken.
- Device information: device type, operating system, browser type, and IP address.
- Payment information: processed by third-party payment providers; we do not store full card details.
- Meta / WhatsApp data: information from the WhatsApp Business Platform and Meta, including analytics and data shared through the WhatsApp Business API.
- Messaging and AI interaction data: for WA Hub, the content of messages exchanged with the AI assistant, which is processed to generate responses (see Section 6).
- Client-provided data: data Clients provide to us about their own customers so we can deliver Services (processed by us as a processor — see Section 3).
- Referral and campaign information: the page you first arrived on, the site or search engine that referred you, and any advertising campaign identifiers contained in that link (for example a Google Ads click identifier or utm_ parameters). Where you submit a booking or enquiry we also record how many pages you viewed during that visit, the timing of your submission, and a one-way hashed session identifier. We store only a fixed list of known advertising parameters from the web address — never the full query string.
- Page-visit history for an enquiry (only with your consent): if you accept analytics cookies, we record which pages you viewed during the visit in which you booked or enquired, and how long you spent on each. It is attached to that enquiry so we can see which of our pages actually helped you decide. If you decline analytics cookies, or make no choice at all, this is not recorded — we keep only the referral, campaign and security information described above.
5. How We Use Your Information and Our Legal Basis
We use personal information to:
- provide, manage, and secure your access to the Services;
- improve and personalize your experience;
- fulfil requests, including sending messages or notifications that you or a Client initiate;
- analyze usage and engagement to enhance our Services;
- provide customer support and resolve issues;
- comply with legal obligations.
- detect and prevent fraudulent, automated, or abusive submissions to our booking and enquiry forms;
- understand which marketing channel or campaign led you to contact us, so we can measure whether our advertising is working;
Where required by applicable data-protection law, we rely on one or more of the following legal bases: your consent; performance of a contract with you; our legitimate interests in operating and improving our Services; and compliance with a legal obligation.
We rely on our legitimate interests for the referral, campaign and form-security information described in Section 4 — specifically, protecting our booking forms from abuse and understanding how people find us. We do not use this information to build a profile of you, we do not combine it with data from other websites, and we do not place an advertising cookie on your device to follow you between visits. Where we would need to store or read anything on your device beyond what is strictly necessary to operate the site, we ask for your consent first.
6. WhatsApp, Meta, and AI Processing
Because WA Hub operates on Meta's WhatsApp Business Platform and uses artificial intelligence, the following apply:
- AI processing of messages: Messages exchanged through WA Hub may be processed by AI and large language model providers (such as OpenAI) to generate responses. We use such providers only as necessary to deliver the service.
- Opt-in is the Client's responsibility: Where a Client uses WA Hub to message their customers, the Client is responsible for obtaining valid opt-in consent from each recipient and honouring opt-outs, in line with Meta's policies and applicable law.
- Meta's role: Meta processes messaging data under its own terms and policies, and Meta charges messaging fees directly to the relevant account. We do not control Meta's processing.
- Permitted use: We use data obtained via the WhatsApp Business API only for the purposes described in this Policy and as permitted by Meta, applying data-minimization practices.
7. How We Share Information
We may share personal information with:
- Third-party service providers (sub-processors): such as hosting providers, analytics tools, payment processors, AI providers, and support tools, who process data on our behalf under appropriate confidentiality and security obligations.
- Meta: as required by Meta's policies, including de-identified or aggregated data for analytics and insights.
- Legal and regulatory authorities: where required by law, including requests by government or regulatory bodies under Trinidad and Tobago law (such as national security or law-enforcement requests as specified in the DPA).
- Business transfers: in connection with a merger, acquisition, or sale of assets.
We do not sell your personal information.
8. International Data Transfers
Some of our service providers (including Meta, hosting providers, and AI providers) may store or process data outside Trinidad and Tobago. Where data is transferred internationally, we take reasonable steps to ensure it is handled securely and in accordance with this Policy and applicable law.
9. Data Retention
We retain personal information only as long as necessary for the purposes set out in this Policy, to provide the Services, or as required by law. When we act as a processor for a Client, we return or delete Client end-user data within a reasonable period after the engagement ends, except where retention is required by law.
Referral, campaign and form-security information described in Section 4 is kept for 24 months from the date of your enquiry, after which it is deleted or irreversibly anonymised. You can ask us to delete it sooner using the contact details in Section 17.
The page-visit history described in Section 4 is kept for 6 months from the date of your enquiry and is then deleted, while the enquiry itself and its referral information are kept for the 24 months stated above. We keep it for less time because it is the most detailed information we hold about how you used the site, and it stops being useful to us long before then.
10. Your Rights
Under the Trinidad and Tobago DPA (and equivalent laws where applicable), you have the right to:
- Access the personal data we hold about you;
- Correct inaccurate or incomplete data;
- Delete your data in certain circumstances;
- Restrict processing where applicable;
- Opt out of marketing communications.
To exercise these rights, contact us using the details in Section 17. If your request concerns data we process on behalf of a Client (as a processor), we will direct you to, or coordinate with, the relevant Client as the controller.
11. Data Deletion Requests
You may request deletion of your personal data, or (for Client end-users) data held about you through WA Hub, by emailing [email protected] with the subject line "Data Deletion Request." We will verify the request and action it within a reasonable period, subject to any legal retention requirements and to the instructions of the relevant Client where we act as a processor.
12. Data Security and Breach Notification
We implement appropriate technical and organizational measures to protect personal information against unauthorized access, disclosure, or misuse, aligned with the DPA and Meta's requirements for data collected via the WhatsApp Business API. No system is fully impenetrable, but in the event of a personal-data breach affecting your data, we will take appropriate steps and provide notification where required by law.
13. Cookies and Tracking Technologies
Our website may use cookies, web beacons, and similar technologies to operate the site and personalize your experience. You can manage cookie preferences in your browser or device settings. For details, see our Cookie Policy.
We use the Meta pixel and Google advertising tags to measure our advertising. When you book a call, we also send Meta a scrambled (hashed) copy of your email, phone and name with the booking, for the same purpose. You can opt out by choosing "Reject all cookies" in our cookie banner or by turning Marketing off under "Cookie preferences".
14. Children's Privacy
Our Services are intended for users who are at least 18 years old (or the age of majority in their jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.
15. Compliance with Meta Policies
As required by Meta, we commit to:
- using data collected via the WhatsApp Business Platform only for the permitted purposes described in this Policy;
- applying data-minimization practices and sharing only necessary information with third-party services or authorities;
- maintaining transparency about our data collection and sharing practices.
16. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Meta policy updates. We will indicate changes by updating the "Last Updated" date and, for material changes, by other appropriate means.
17. Contact Us
If you have questions about this Policy or wish to exercise your rights, contact us at:
- Email: [email protected]
- Phone: +1 (868) 304-2994
- Address: Luis Street, Woodbrook, Port-of-Spain, Trinidad and Tobago
