Privacy Policy

1. Who we are

PenClip is operated by Magic Unbound Pte Ltd, a company incorporated in Singapore with its registered office at 3 Shenton Way, #19-02, Shenton House, Singapore 068805, and represented in Sri Lanka by Magic Unbound Lanka Pvt Ltd at No. 109, Main Street, Battaramulla, Sri Lanka. For privacy matters you can reach us at hello@getpenclip.com.

2. Two roles: controller and processor

Account data. When you create an account, subscribe, or contact us, we act as the data controller for the personal data involved (such as your name, work email, workspace details, and billing records).

Client-book data. PenClip is a tool used by wealth management firms to manage information about their own clients (for example client names, contact details, dates of birth, portfolio and meeting records). For that data, the firm using PenClip is the data controller and PenClip acts as a data processor, handling the data only on the firm’s documented instructions. Individuals whose data a firm stores in PenClip should direct privacy requests to that firm; we will assist the firm in responding.

3. What we collect

• Identity and contact data — name, work email, and workspace/role information, managed through our authentication provider.
• Billing data — subscription and seat information; card details are handled directly by our payment processor and are not stored on our systems.
• Content you create — client records, notes, follow-ups, documents, and other information you enter into a workspace.
• Voice dictation — audio you record is transcribed and is not stored by PenClip; it is processed in memory and discarded after transcription. See the AI section below.
• Usage and device data — product analytics and reliability logs, including IP address and basic device information.

4. How we use personal data

• To provide, secure, and improve the PenClip platform.
• To authenticate users and enforce workspace access boundaries.
• To process subscriptions and manage billing.
• To send service, invitation, and support communications.
• To maintain audit logs of key account and client actions for security and accountability.
• To comply with legal obligations.

5. AI processing and voice dictation

PenClip uses Google’s Gemini API to power dictation, briefings, and insights. Audio recordings are transmitted to the AI provider for transcription and are not retained by PenClip. Text content you submit for AI features (such as notes or client context) is processed to generate the requested output. We use these providers under terms that prohibit using your content to train their public models.

6. Sharing and sub-processors

We do not sell personal data. We share it only with vetted service providers who process it on our behalf under contract, and where required by law. Our current sub-processors, and the country in which each operates, are listed on our Sub-processors page.

7. International transfers

PenClip operates from Singapore and Sri Lanka and relies on service providers located in other countries, including the United States and the European Union. Where personal data is transferred across borders, we require each provider to protect it to a standard comparable to the applicable data protection laws through data processing agreements and recognized safeguards.

8. Retention

We retain account and workspace data for as long as your account is active and as needed to provide the service. When a workspace is closed, we delete or anonymize its data within a reasonable period, except where we must retain limited records to meet legal, tax, or security obligations. Firms acting as controllers may request deletion of their workspace data on offboarding.

9. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, and you may withdraw consent to optional processing. To exercise these rights, contact hello@getpenclip.com. If your data is held by a firm using PenClip as part of its client book, please contact that firm; we will support them in fulfilling your request.

10. Security

We protect personal data with encryption in transit and at rest, workspace-level access controls, least-privilege service access, and audit logging. No system is perfectly secure, but we work to align our practices with recognized security standards.

11. Changes and contact

We may update this policy from time to time and will revise the “last updated” date above. Questions can be sent to hello@getpenclip.com or our general address hello@getpenclip.com.