Privacy Policy

Last updated: 1 August 2026 · A product of ACE Advisory

Who we are

Paperless (getpaperless.ai) is operated by ACE Advisory, a professional services firm in Dhaka that specialises in taxation and regulatory advisory in Bangladesh. Under Bangladesh’s Personal Data Protection Act 2026 (the PDPA), ACE Advisory is the “data fiduciary” for Paperless. That means we are the party responsible for deciding how and why your personal data is used, and for protecting it.

For anything about your privacy or your data, write to info@aceadvisory.biz.

What information we collect

• Account information.Your name, email address, phone number, and your professional role (for example accountant, lawyer, CFO). Your organisation’s name and professional registration details, if you choose to give them.
• Your questions and answers. The questions you ask Paperless and the answers it gives you.
• Documents you upload. For example invoices, tax notices or financial statements. These may contain personal or financial information about you or about other people, such as your clients.
• Technical logs. Your IP address, browser and device type, and when and how you use the service.
• Messages. Anything you send us, such as support requests or feedback.

Paperless is for adults. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has given us personal data, please tell us.

Why we use it

We use your information to:

• Run Paperless: answer your questions, process your documents, keep your account working.
• Keep the service safe: detect fraud, abuse and security problems.
• Improve reliability and accuracy.
• Contact you about your account or changes to the service.
• Meet our obligations under Bangladeshi law.

The PDPA requires a lawful basis for each of these. Ours are: your consent (given when you register and use the service), the need to deliver the service you asked for, our legitimate interest in keeping the platform secure and reliable, and our legal obligations. You can withdraw your consent at any time, though parts of Paperless may then stop working for you.

Financial and other sensitive data

The PDPA gives extra protection to “sensitive personal data”, which includes financial data. Documents uploaded to Paperless often contain financial data. We use such data only to do the specific thing you asked for, such as checking the tax treatment of an uploaded invoice. It is encrypted while travelling to us and while stored. We never use it for marketing or for training AI models.

Who we share it with

We share data only with the providers that help us run Paperless, under confidentiality obligations:

• Cloud hosting and infrastructure providers.
• AI providers: your questions and, where relevant, uploaded document content are sent through OpenRouter, which routes them to Anthropic’s Claude models to generate the answer.
• Monitoring and error-tracking tools, limited to what keeps the service reliable.

We may also disclose data where the law requires it, for example under a valid court order. We never sell or rent your personal data. We do not allow third-party AI providers to use your questions or documents to train their models.

Where your data is processed

When you ask a question or upload a document, that content may be processed on servers outside Bangladesh, because the AI models that generate answers run there. By using the question and upload features you agree to this. If you would rather not, do not use those features; without them the core service cannot work. There is a plain-language explanation on our How Paperless works page.

Your rights

Under the PDPA you have the right to:

• See the personal data we hold about you.
• Correct data that is wrong or incomplete.
• Ask us to delete your data, subject to what the law requires us to keep.
• Withdraw your consent at any time.
• Get a copy of your data in a usable format, where technically possible.
• Object to processing based on our legitimate interest.
• Complain to Bangladesh’s data protection authority, as well as to us directly.

To use any of these rights, email info@aceadvisory.biz. We will respond within the time the PDPA requires.

How long we keep data, and how we protect it

We keep personal data only as long as we need it. Account data stays while your account is open, and for a limited period afterwards to meet legal obligations. Technical logs are kept briefly for reliability and security, then deleted or anonymised.

Paperless is in beta, and we are still finalising the exact retention period for uploaded documents. Until that is set and published here, you can ask us to delete any uploaded document, or your whole account, at any time.

We protect data with encryption in transit and at rest, and with access controls so that only the people and systems that need your data can reach it. No system is perfectly secure, which is why we also make the commitment below.

If something goes wrong

If a data breach happens that puts your rights at risk, we will notify the data protection authority and the affected users without undue delay, within the timelines the PDPA sets. We will explain what happened, what it may mean for you, and what we are doing about it.

Cookies

Paperless uses a small number of cookies. They are explained in our Cookie Policy.

Changes to this policy

If we make an important change to this policy, we will tell you through the platform or by email before it takes effect.

Contact

Questions about this policy or about your data: info@aceadvisory.biz.