Privacy Policy

1. What we collect

• Account information: firm name, staff names, email addresses, and login credentials.
• Client information you enter: business name, contact name, email, phone, and the documents, files, and answers submitted through client upload links.
• Billing information, handled directly by our payment processor - we don't store card details.
• Basic usage data (log-in times, feature usage) used to operate and improve the Service.

2. How we use it

We use this data to operate the Service: creating and sending monthly document requests, sending reminder emails, storing uploaded files securely, and showing your dashboard. We do not sell your data or your clients' data, and we do not use it for advertising.

3. Where it's stored

Account and client data is stored in a Postgres database with row-level security so each firm can only access its own records. Uploaded files are stored in a private object storage bucket and only ever served through short-lived signed URLs - never publicly listable.

4. Third-party processors

We rely on a small number of infrastructure providers to run the Service: a database and file storage provider, a transactional email provider (for request and reminder emails), and a payment processor for billing. Each only receives the data needed to perform its function.

5. Client (end-user) access links

Your clients access their monthly checklist through a unique, hard-to-guess link with no login required. Anyone with that link can view and submit that specific month's checklist - do not share it publicly. You can revoke or regenerate a link at any time from the request's dashboard page.

6. Data retention

We keep your data for as long as your account is active. If you close your account, we delete or anonymize your firm's data within a reasonable period, except where we're required to retain records for legal or billing purposes.

7. Your rights

You can access, correct, or delete your account's data at any time from Settings, or by contacting us. If your clients ask you to remove their information, you can delete their client record and uploaded files directly from your dashboard.

8. Cookies

We use essential cookies to keep you signed in and to protect against cross-site request forgery. We don't use third-party advertising or tracking cookies.

9. Changes to this policy

If we make material changes to this policy, we'll notify account owners by email before the changes take effect.

10. Contact

Questions about this policy or your data? Reach out via our contact page.