Privacy Policy

1. Overview

papercut technology ("papercut," "we," "us," or "our") builds and operates Nadi, a fleet and school bus operations platform, and Nestora, a property and community management platform (together, the "Apps"), along with our website at papercuttech.com (together with the Apps, the "Services"). This Privacy Policy explains what information we collect, how we use and share it, and the choices and rights you have.

This policy applies to anyone who uses our Services: drivers, dispatchers and fleet administrators using Nadi; residents, owners, security staff and community administrators using Nestora; and visitors to our website. By using the Services, you agree to the collection and use of information as described here.

2. Who we are

papercut technology is based in New Jersey, United States. We are the data controller responsible for the information described in this policy, except where an organization we work with (such as your school district, transport operator, property management company, or homeowners' association) is itself the controller and we act as their processor or service provider — in which case we say so below.

3. Information we collect

We collect information in three ways: what you or your organization provide to us, what is generated automatically as you use the Services, and what we receive from the organization that administers your account.

Account & profile information

• Name, email address, phone number, and role (for example, driver, dispatcher, resident, owner, guard, or admin)
• Employment or licensing details relevant to Nadi, such as driver's license information, submitted through driver registration links
• Unit, building, or community assignment for Nestora accounts
• Login credentials, which we store using industry-standard hashing — we never store your password in plain text

Operational content you create

• Vehicle inspection and maintenance reports, and maintenance ticket details (Nadi)
• Clock-in and clock-out records and associated timestamps (Nadi)
• Route sheets you upload and the digitized routes generated from them (Nadi)
• Payroll inputs derived from clocked hours (Nadi)
• Billing records, receipts, and collection notes tied to a unit (Nestora)
• Requests you submit — guest visits, maintenance issues, complaints — and any photos, notes or documents attached to them (Nestora)
• Guest and visitor information you submit for gate registration, and the guard's entry/exit log of that visit (Nestora)

Device & usage information

• Device type, operating system and version, and app version
• IP address and general network information
• Log data such as feature usage, crash reports, and timestamps of activity
• Push notification tokens, if you enable notifications

4. Location data

Nadi captures a driver's location at the moment they clock in and clock out, so a fleet administrator can confirm where and when a shift began and ended. This is foreground location data tied to an explicit clock-in or clock-out action — Nadi does not track a driver's location continuously in the background, and location is not collected outside of these clock events unless you are separately notified and asked to consent.

You will be asked for permission before the app accesses your device's location. You can decline or later revoke this permission in your device settings, though doing so may prevent you from clocking in or out, since a location value is required by the shift record.

5. How we use information

• To operate the core functions of Nadi and Nestora — shift records, inspections, payroll, billing, requests, and role-based dashboards
• To authenticate accounts and enforce role-based access, so each person only sees what's relevant to their role
• To route requests and tickets to the right vendor, guard, or administrator
• To send transactional notifications — a clock-in confirmation, a new request, a bill, a guest approval — and, where you've opted in, other product updates
• To provide customer and technical support
• To maintain the security, integrity and reliability of the Services, including detecting and preventing fraud, abuse and unauthorized access
• To improve the Services, including fixing bugs and understanding how features are used in aggregate
• To meet legal, tax, payroll and record-keeping obligations

We do not sell your personal information, and we do not use the operational data in Nadi or Nestora to serve you third-party advertising.

6. Our legal basis for processing

Where applicable law requires a legal basis, we rely on: performance of a contract (providing the Services you or your organization signed up for), legitimate interests (securing and improving the Services), legal obligation (payroll, tax and safety record-keeping), and consent (for example, location access or optional notifications), which you may withdraw at any time.

7. How we share information

We share information only as needed to run the Services:

• Within your organization. Nadi and Nestora are role-based systems built for organizations. Your fleet administrator, school district, property manager, HOA, or building security team can see the information their role in the system is designed to show them — for example, a dispatcher sees driver shift records, and a community admin sees billing and requests for their community.
• Service providers. We use trusted third parties to host our infrastructure, store data, process OCR on uploaded route documents, send email and push notifications, and monitor app stability. These providers are contractually bound to protect your data and use it only to provide services to us.
• Legal & safety reasons. We may disclose information if required by law, subpoena, or legal process, or where we believe in good faith it's necessary to protect the rights, property or safety of papercut, our users, or the public — this can matter in a fleet-safety or building-security context.
• Business transfers. If papercut is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy or a successor policy of at least equal protection.

We do not share your personal information with third parties for their own independent marketing purposes.

8. Data retention

We retain information for as long as your account is active and as needed to provide the Services. Certain records — including payroll, billing, and safety-related inspection logs — may need to be retained for longer to meet legal, tax, or contractual obligations even after an account is closed. When information is no longer needed, we delete or anonymize it, except where retention is required by law.

9. Security

We use technical and organizational safeguards to protect your information, including encryption in transit, access controls scoped by role, and hashed credential storage. No system is completely secure, and we encourage you to use a strong, unique password and to report any suspected unauthorized access to your account to us immediately.

10. Your rights & choices

Depending on your location, you may have the right to access, correct, export, or delete the personal information we hold about you, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. Residents of California, the EU/EEA, UK, and other jurisdictions with data protection laws may have additional statutory rights. To exercise any of these rights, contact us using the details in Section 17; if your account is managed by an organization (such as your employer or property manager), we may direct your request to them, or fulfill it directly where we control the relevant data.

11. Account & data deletion

You can request deletion of your account and associated personal data at any time. See our dedicated Data Deletion page for step-by-step instructions on how to do this from within the app or by contacting us directly, what gets deleted, and what we may be required to retain.

12. Children's privacy

Nadi and Nestora are built for adult professional and household use — drivers, dispatchers, fleet and property administrators, security staff, owners and residents. They are not directed at children, and we do not knowingly collect personal information from children under 13 (or the relevant minimum age in your jurisdiction). Nadi's records may reference a school bus route or stop associated with a school, but this does not involve collecting personal information about the students riding the bus. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

13. Cookies & the website

Our marketing website at papercuttech.com uses only essential and basic analytics cookies to understand overall site traffic — it does not use third-party advertising cookies. The Apps use secure session tokens to keep you signed in rather than tracking cookies. You can control cookies through your browser settings, though disabling essential cookies may affect site functionality.

14. International users

Our Services are hosted in the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. Where required, we put appropriate safeguards in place for such transfers.

15. App Store & Google Play disclosures

Nadi and Nestora are distributed through the Apple App Store and Google Play. In addition to this policy, each store requires its own summary of our data practices (Apple's "App Privacy" details and Google Play's "Data safety" section), which are kept consistent with this policy. If you notice any inconsistency between a store listing and this policy, this policy governs, and we'll correct the listing promptly.

Apple Inc. and Google LLC are not responsible for the privacy practices described here; they are third-party distribution platforms, and their own privacy policies govern their handling of information related to your use of their stores.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal, operational, or regulatory reasons. We'll update the effective date above, and where a change is material, we'll provide additional notice — such as an in-app notice or an email — before it takes effect.

17. Contact us

If you have questions about this Privacy Policy or how we handle your information, contact us at: