Last updated: 10 June 2026
PaperPapa (“PaperPapa”, “we”, “us”, “our”) operates the website https://paperpapa.com (the “Site”), a membership service providing annotated, authentic HKDSE English Paper 2 writing scripts for study. This Privacy Policy explains what personal data we collect, how we use and protect it, and the choices and rights you have. We handle personal data in line with the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”). If you do not agree with this policy, please do not use the Site.
1. Who is responsible for your data
PaperPapa is the data user/controller for the personal data described here. You can reach us through the Contact form on the Site, or by email at info@paperpapa.com.
2. What we collect
- Account details — your name, email address, and a password (stored only in encrypted/hashed form; we never see your actual password). Email verification is required to access member content.
- Optional profile — your school and year of study, if you choose to provide them.
- Payment information — handled entirely by our payment processor, Stripe. We do not receive or store your full card number. We keep a record of your subscription (plan, status, renewal date) and a Stripe customer reference so we can manage your access and show your billing history.
- Technical & security data — your IP address and basic request information, used for security, rate-limiting, and to limit the number of devices signed in to your account at once.
- Scholarship submissions (only if you use the 5★★ Scholarship form) — the details and files you submit, plus a consent record. Uploaded files are encrypted at rest and accessible only to authorised PaperPapa staff.
- Communications — messages you send us via the contact form.
3. How we use your data
- To create and secure your account, verify your email, and sign you in.
- To provide the service you paid for — unlocking the scripts your subscription covers and showing your renewal date and billing history.
- To process subscriptions, renewals, cancellations and refunds (via Stripe).
- To respond to your enquiries and scholarship submissions.
- To protect the Site and our content from abuse, fraud, and unauthorised access.
- To meet legal, accounting and regulatory obligations.
4. Your consent and our basis for processing
We process your data to perform our contract with you (providing the membership), to comply with legal obligations, and for our legitimate interest in running and securing the Site. Providing your data is voluntary, but without the essentials (name, email, payment) we cannot provide the service.
5. Who we share it with
We do not sell your personal data. We share it only with service providers that help us operate, and only as needed: Stripe (payment processing and subscription management) and WordPress.com / Automattic (our website host). We may also disclose data where required by law or to protect our rights, users, or the public. These providers may process data on servers outside Hong Kong; where that happens we take reasonable steps to ensure appropriate protection.
6. Cookies
We use essential cookies only — to keep you signed in, remember your language choice, and operate the membership. We do not use advertising or cross-site tracking cookies. You can block cookies in your browser, but the Site may not work properly without the essential ones.
7. How we protect your data
Passwords are stored hashed, never in plain text. Script scan images and scholarship uploads are encrypted at rest and are served only after an access check — they cannot be downloaded by guessing a web address. Access to personal data is limited to authorised PaperPapa staff. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.
8. How long we keep it
We keep your account and related data for as long as your account is active and as needed to provide the service, then for a reasonable period afterwards to meet legal, tax, and dispute-resolution needs. You can ask us to delete your account (see your rights below).
9. Your rights
Under the PDPO you may access the personal data we hold about you, correct it if it is inaccurate, and request deletion of your account and associated data (subject to records we must keep by law). To make a request, contact us through the Contact form or at info@paperpapa.com. We may need to verify your identity first.
10. Users under 18
The Site is intended for HKDSE students and learners, some of whom may be under 18. If you are under 18, please use the Site and provide personal data only with the consent and supervision of a parent or guardian. If you believe a child has provided us data without appropriate consent, contact us and we will address it.
11. Changes to this policy
We may update this policy from time to time. The “last updated” date shows the latest version, and significant changes will be made clear on the Site.
12. Contact
Questions about this policy or your data? Reach us via the Contact form on the Site or at info@paperpapa.com.