Paper / Privacy
Privacy notice
Effective October 19, 2026
Paper is an internal operations application for D2 Production Services. This notice explains the information Paper handles and how to ask questions about it.
Who is responsible
D2 Production Services directs the use of its business information in Paper. Gridwell Studio provides technical development and support. For a privacy or support request, email contact@gridwell.studio; requests concerning D2’s records will be coordinated with D2’s authorized administrator.
Information Paper handles
- Account and access information, including a person’s name, email, membership, permissions and authentication identifiers.
- Information entered for D2’s work: customer and business-contact details, venues, event briefs, dated schedules, quotes, notes, approvals and change history.
- Connection information for providers an authorized administrator chooses to connect, including encrypted credentials and OAuth authorization tokens.
- Security and operational information such as request identifiers, access events, audit records, error information and network information processed by our hosting and identity providers.
Do not place passwords, employee PINs, payment-card details or unrelated sensitive personal information into event notes, uploads or Ask Paper.
Why this information is used
Paper uses information to provide D2’s operational workspace, apply permissions, maintain accepted records and approval history, support explicitly enabled connections, troubleshoot problems and protect access. Paper is not an advertising service. We do not sell personal information or use it for targeted advertising.
QuickBooks and other connected systems
A provider connection requires configuration and account authorization; a saved key alone does not connect an account. The current QuickBooks capability is an OAuth connection and a read-only company-access check. It does not import or synchronize invoices, estimates, payments or historical accounting records, and does not send invoices or take payments.
When an authorized administrator enables a Google connection, Paper requests Calendar event read access and/or Gmail read access for the selected source families. Google’s authorization is broader than Paper’s configured calendar and label allowlists. Current checks read selected calendar events and selected Gmail-label metadata; email intake and calendar synchronization are not yet implemented. No sending or calendar-writing workflow is enabled.
Paper’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is not sold, used for advertising or used to train generalized AI models. Human access is limited to authorized operational use, support with appropriate permission, security, or legal requirements.
Lasso, transcript processing, notifications and shared AI memory remain unconnected or pending implementation. Any later capability that changes how information is handled must be reflected in this notice before use.
AI features
The development application and shared preview use labeled mock responses. A separately configured managed deployment may enable read-only OpenAI answers using permitted Paper job context and the question submitted. That feature does not execute business tools, approve changes or grant itself access. Do not submit information that you are not authorized to share. This public site makes no AI requests.
Who receives information
Business information is available to authorized D2 members according to their permissions, and to authorized technical support when needed. Cloudflare provides application hosting, database and access infrastructure. Information is sent to a connected provider only for the authorized function. OpenAI receives permitted context only when its live feature is explicitly enabled. Service providers process information under their applicable terms; information may be processed outside the user’s location. Information may also be disclosed where required by law or to address security incidents.
Storage, protection and retention
Managed Paper access uses authenticated membership and server-side permissions. Saved provider credentials and authorization tokens are encrypted on the server, and HTTPS protects data in transit. These safeguards do not eliminate every risk.
D2 retains operational records as needed for its work, audit history and applicable obligations. Retention is not an automatic promise to delete a record after a fixed number of days. Deletion requests are reviewed by an authorized administrator; legitimate audit, legal and backup-retention requirements may affect what can be removed and when.
Cookies and this public site
The employee application and its access provider use necessary authentication and security cookies. This public information site has no advertising cookies, analytics scripts, forms or browser business-data storage. The hosting service still processes ordinary network and security information when a page is requested.
Your choices and requests
Contact D2’s administrator or contact@gridwell.studio to request access, correction or deletion of information associated with you, or to report a concern. Identity and authority may need to be verified before records are disclosed or changed.
An authorized Paper administrator can remove stored provider authorization through Settings → Connections. Removing a connection does not delete accepted Paper business records. Revoke the app in the provider’s own security settings to remove its provider-side grant as well.
Changes to this notice
The effective date above identifies this version. Material changes to enabled data uses will be communicated to authorized users before those new uses begin.