Privacy Policy

Paper Armour handles sensitive paperwork.

That may include disability, health, education, care, benefits, family, school, council, NHS, DWP and legal-adjacent information.

Paper Armour only asks for information needed to understand your request, review whether support is realistic, provide agreed paperwork support, manage payment/admin, and keep necessary records.

Last updated: 25 May 2026

Quick summary

Please do not send more than is needed. If you are not sure what to upload, use the upload guidance or explain this in the form.

Paper Armour keeps what is needed, for as long as it is needed, then deletes or minimises it.

Controller

Who controls the information

Paper Armour is operated by Millie Ella Carter, a sole trader trading as Paper Armour.

Paper Armour is part of Moor & More Studio. Payments or bank statements may show Moor & More Studio.

Contact:
hello@paperarmour.co.uk

Correspondence address:
Clegyrnant, Llanbrynmair, SY19 7EA

Information

What information Paper Armour collects

People and contact details

  • contact details
  • client details
  • details about the person needing support
  • family or caring relationship information
  • deadline details
  • website/contact form information
  • Ask Paper Armour question category, question text, optional email, consent choices, newsletter status and timestamp

Paperwork and records

  • school, council, DWP, NHS, tribunal or professional information
  • medical, disability, education and care information
  • forms, letters, reports, emails, plans, decisions and evidence files
  • payment and invoice information
  • admin notes and correspondence
  • consent and audit records

Ask Paper Armour questions are for general, non-identifying questions. They may be used in anonymised or generalised form only where that consent is given.

If you opt into the Still Fighting newsletter from the Ask Paper Armour form, Paper Armour stores your email address, opt-in choice, consent wording, timestamp and newsletter status so you can be added to the Beehiiv newsletter list. You can unsubscribe or ask to be removed.

Sensitive data

Sensitive information, children and other people

Some of the information Paper Armour receives may be special category data under UK data protection law. This may include health, disability, medical, care or support-needs information.

Paper Armour uses this information only where it is needed for the paperwork support request.

The usual lawful basis for using personal information to review or provide a paid service is contract or steps before entering a contract. For sensitive health, disability, medical, care or support-needs information, Paper Armour asks for explicit consent during intake.

You can withdraw consent, but Paper Armour may not be able to continue with your request if the information is needed to provide the service. Some information may still need to be kept for legal, tax, complaint, safeguarding, dispute or record-keeping reasons.

Many Paper Armour requests involve paperwork about a child, young person, disabled adult or family member.

If you upload information about someone else, you must have permission, parental responsibility, caring responsibility, authority, or another proper reason to share it. Where appropriate, you should tell the person that their information is being shared with Paper Armour for paperwork support.

Paper Armour may pause or refuse work if there are concerns about consent, authority, safeguarding or data handling.

Lawful basis

Why Paper Armour uses information

PurposeReview intake and decide whether support is realistic
Information usedContact details, request details, documents and deadline information
Lawful basisSteps before contract / contract
NotesPaper Armour may say it is not the right fit.
PurposeProvide paperwork support
Information usedRequest details, documents, sensitive information, notes and draft wording
Lawful basisContract, plus explicit consent for special category data
NotesSensitive information is used only where needed for the request.
PurposeManage payment and invoices
Information usedPayment status, amount, checkout reference, billing/admin information
Lawful basisContract / legal obligation
NotesStripe handles card payment details.
PurposeKeep service and consent records
Information usedMinimal client, admin and consent records
Lawful basisLegitimate interests / legal obligation where applicable
NotesUsed to show what was agreed and when.
PurposeDeal with complaints, disputes or chargebacks
Information usedRelevant service, payment and correspondence records
Lawful basisLegitimate interests / legal claims where applicable
NotesOnly the relevant records are used.
PurposeSafeguarding or legal obligations
Information usedRelevant information connected to the concern or duty
Lawful basisLegal obligation / vital interests where applicable
NotesPaper Armour is not an emergency service.

Optional updates or marketing would use contact details only with consent. The code inspected does not show a marketing email flow.

AI-assisted tools

Digital and AI-assisted tools

Paper Armour does not hand your work over to AI. The work is done by Paper Armour.

AI-assisted tools may be used as a checking layer: to help check Paper Armour's own draft wording, test whether something could be explained more clearly, support research into relevant legislation, guidance or policy, improve clarity, and reduce the risk of missing or muddling something important.

Paper Armour does not upload client documents, forms, reports or evidence files to AI tools.

Where AI-assisted tools are used, Paper Armour uses its own notes, anonymised summaries, initials or draft wording wherever possible.

These tools support human review. They do not replace Paper Armour's judgement, do not make final decisions about client requests, and do not provide legal advice.

Paper Armour uses account settings intended to prevent submitted content being used for model training, but Paper Armour's main protection is not uploading client documents or full paperwork bundles to AI tools.

Providers

Who information may be shared with

Known service providers from the codebase

  • Stripe for payments
  • Google Firebase/Firestore for intake records, submission metadata, admin notes, consent/audit records, payment status metadata and upload metadata
  • Firebase Storage for uploaded document files
  • Beehiiv for Still Fighting newsletter signup and email delivery
  • ChatGPT/OpenAI and Gemini/Google only for Paper Armour's own notes, anonymised summaries, initials or draft wording, not client document uploads
  • Postmark or Resend, depending on configuration, for sending service emails

Other possible categories

  • website hosting provider for delivering the site, depending on deployment configuration
  • admin/business systems
  • accountant or bookkeeper if used
  • professional advisers if needed
  • authorities, regulators or courts where required by law or safeguarding

Some service providers may process information outside the UK. Where that happens, Paper Armour aims to use providers with appropriate safeguards.

Storage

Payments, file storage and deletion

Stripe handles payments. Paper Armour does not store full card details on the website. Payment records may include transaction ID, amount, status, invoice or checkout reference and billing information. Bank or payment records may show Moor & More Studio.

Paper Armour does not aim to keep your whole paperwork bundle forever.

Uploaded documents are kept only for as long as they are needed to review the request, complete the agreed work, deal with immediate follow-up, or handle a genuine legal, complaint, safeguarding, chargeback or dispute issue.

Once work is complete, Paper Armour deletes uploaded sensitive documents as soon as practical, normally within 7 days.

Clients are responsible for keeping their own copies of forms, letters, evidence and final documents. If Paper Armour needs to look at something again later, you may need to send a fresh copy.

Retention

How long information is kept

RecordUnsubmitted intake progress saved in browser
How long it is normally keptUntil the client clears browser storage, overwrites it or submits it
RecordGeneral contact enquiry that does not become paid work
How long it is normally keptDeleted within 30 days of last contact
RecordAsk Paper Armour question that does not become paid work
How long it is normally keptKept only while reviewing, replying or preparing consented anonymised/generalised answers
RecordSubmitted intake where no work goes ahead
How long it is normally keptDeleted within 30 days of decision or no response
RecordUploaded sensitive documents for completed work
How long it is normally keptDeleted as soon as practical after work is complete, normally within 7 days
RecordWorking notes and draft files
How long it is normally keptDeleted as soon as practical after work is complete, normally within 30 days
RecordFinal copy sent to client
How long it is normally keptClient is responsible for keeping it; Paper Armour does not promise to keep a copy
RecordMinimal client admin and consent record
How long it is normally keptKept only as long as needed for accounts, disputes, consent records, legal/admin reasons or safeguarding
RecordPayment, invoice and tax records
How long it is normally keptKept for the required tax/accounting period
RecordComplaint, safeguarding, chargeback, dispute or legal issue records
How long it is normally keptKept as long as reasonably needed

Browser

Local browser storage, cookies and analytics

Unsubmitted intake progress is saved locally in the browser so you can leave and come back. Someone using the same device and browser might see unfinished progress.

The intake form includes a Clear saved draft button. This clears the information saved in that browser. It will not delete anything already submitted.

The public site does not load general analytics scripts. The newsletter signup panel on the /newsletter page loads Beehiiv's official subscribe form, which may use cookies or attribution data to operate and measure that form. The public site also uses local browser storage for draft intake progress and short source labels such as which public page led to the Initial Support Review. Admin/payment services may use their own necessary cookies or storage for login and checkout.

Rights

Your rights and contact

You may have rights to access, correct, delete, restrict, object to, or move personal information where those rights apply. You can also withdraw consent where consent is used.

These rights depend on the circumstances. Paper Armour may need to confirm identity before responding, and some information may need to be kept for legal, tax, complaint, safeguarding, dispute or record-keeping reasons.

You can contact Paper Armour first if you have a privacy concern: hello@paperarmour.co.uk. You also have the right to complain to the Information Commissioner's Office.