Privacy Policy

1. The short version

papertoad.com has no accounts, no forms, no cookies and no trackers. If you only read the site and never contact us, the only personal data we handle is what every web server necessarily receives to send you a page: your IP address and the details of the request.

If you email us, we hold that correspondence. If you apply for a role, we hold your application. That is the whole of it.

Our game, Call to Rule, is a different matter — it has accounts, purchases and gameplay data. It has its own, much longer, Privacy Policy at calltorule.com. This policy does not cover the game.

2. Who is responsible

The controller of the personal data described here is:

Papertoad FZE LLC Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates Trade licence 4431780, issued by the Sharjah Publishing City Free Zone Authority (SPC Free Zone)

Privacy contact: privacy@papertoad.com.

Representatives in the EEA and the UK

Because we offer services to people in the European Economic Area and the United Kingdom from outside those territories, Article 27 of the GDPR and the UK GDPR require us to designate a representative in each. We are in the process of appointing them, and will publish their names and contact details here as soon as they are in place.

In the meantime, write to us directly at privacy@papertoad.com — we answer within 30 days. You can also complain to your national supervisory authority at any time without going through us; see section 7.

3. What we handle, why, and on what basis

3.1 Visiting this website

Our web server records each request it receives: IP address, timestamp, the URL requested, the HTTP response code, the referring page, and the user agent string.

• Why: to serve the site, keep it available, and investigate abuse or attacks.
• Legal basis: legitimate interests — Art. 6(1)(f) GDPR — in operating and securing our own website.
• How long: a short operational window, then deleted. We do not build a profile from it and we do not link it to anything else.

There are no cookies, no analytics, no advertising or retargeting pixels, no tag manager, no social plugins, no session recording, and no A/B testing tools on this site. See the Cookies & Local Storage Notice for the complete inventory, including the one third-party resource this site does load.

3.2 Emailing us

If you write to any address on this site — business enquiries, press, partnerships, support — we receive your email address, your name if you give it, and whatever is in the message.

• Why: to answer you, and to keep a record of what was agreed.
• Legal basis: legitimate interests — Art. 6(1)(f) — in responding to people who contact us; and where the correspondence leads to an agreement, performance of a contract under Art. 6(1)(b).
• How long: 24 months after the conversation ends, unless it forms part of a contract or a legal record, in which case we keep it for as long as the law requires.

Please do not send us sensitive personal information by email. Email is not a secure channel.

3.3 Applying to work with us

If you send a job application or a portfolio, we handle your name, contact details, CV, portfolio, work history, and any notes we make while assessing it.

• Why: to consider you for the role.
• Legal basis: steps taken at your request before entering a contract — Art. 6(1)(b); and legitimate interests — Art. 6(1)(f) — in running a fair recruitment process.
• How long: 12 months after the process ends, so we can contact you about a role that suits you better. Ask us at privacy@papertoad.com and we will delete it sooner, immediately, and without any effect on a current application.

We do not use automated decision-making to screen applicants. A person reads what you send.

3.4 Business contacts

If you represent a partner, publisher, supplier or platform, we hold your name, business email, telephone number, employer and role, along with our correspondence.

• Why: to run the business relationship.
• Legal basis: contract — Art. 6(1)(b) — or legitimate interests — Art. 6(1)(f) — in managing commercial relationships.
• How long: for the relationship, plus the period required by UAE commercial and tax law, currently 5 years.

3.5 What we never do

We do not sell personal data. We do not share it for advertising. We do not buy contact lists, and we do not send unsolicited marketing. We do not run behavioural profiling on visitors to this site.

4. Who we share it with

• Ultahost, which hosts this website and our email infrastructure in United Arab Emirates, acting as our processor under a written contract meeting Article 28 GDPR.
• Professional advisers — lawyers, accountants, auditors — where necessary, and bound by confidentiality.
• Authorities, where we are legally required to disclose.
• An acquirer, if the business is sold, with notice to you before your data becomes subject to a different policy.

That is the complete list. There is no advertising network, no data broker, and no analytics vendor in it.

5. International transfers

We are in the United Arab Emirates and so is our infrastructure — this website and our mail are hosted in a UAE data centre, not offshore.

If you are in the EEA or the UK, reaching us still means your data travels to the UAE, which has no adequacy decision from the European Commission or the UK Government. For those transfers we rely on the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 and the UK International Data Transfer Addendum, supported by a transfer impact assessment and measures including encryption in transit and at rest and strict access control. Where data leaves the UAE, we comply with Articles 22 and 23 of Federal Decree-Law No. 45 of 2021.

Request a copy of the safeguards at privacy@papertoad.com and we will send them with commercial terms redacted.

6. Security

All traffic to this site is served over TLS 1.2 or 1.3. Access to our systems is restricted to named people, protected by strong authentication, and logged. Servers receive automatic security updates. Backups are encrypted.

If a personal data breach is likely to result in a risk to your rights, we notify the competent supervisory authority within 72 hours under Article 33 GDPR, notify the UAE Data Office under Article 9 of the UAE PDPL, and tell you directly without undue delay where the risk to you is high.

To report a vulnerability, write to security@papertoad.com. We do not pursue good-faith researchers who report responsibly and do not access other people's data.

7. Your rights

You have the right to access your data, to correct it, to erase it, to restrict or object to how we use it, to portability, and to withdraw consent where we relied on it. In the UAE the Personal Data Protection Law gives you materially the same set. In California and other US states with comprehensive privacy laws you have the rights to know, delete, correct and opt out — noting that we do not sell or share personal information as those laws define it.

To use any of them, email privacy@papertoad.com. It is free, and we answer within 30 days. We may need to confirm your identity first, which protects you.

If we get it wrong, tell us — and you may also complain to the UAE Data Office, to your national data protection authority in the EEA, or to the Information Commissioner's Office (ico.org.uk) in the UK.

8. Children

This website is aimed at adults — players, partners, press and candidates — and is not directed at children. We do not knowingly collect personal data from children through it.

Call to Rule has a minimum age of 13 and its own protections, described at calltorule.com/legal/children/.

9. Changes

We update this policy when our practices or the law change. The "Last updated" date at the top is always current. For a material change we post the update here before it takes effect.

10. Contact

Published in English and Arabic. If the versions differ, the English version governs.