Privacy Policy

Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• 256-bit AES encryption for data at rest
• TLS 1.3 encryption for data in transit
• Regular security audits and penetration testing
• SOC 2 Type II compliance
• ISO 27001 certification (in progress)
• Secure data centers in the European Union
• Regular employee security training
• Multi-factor authentication support

Despite our efforts, no security system is impenetrable. We cannot guarantee the absolute security of your information but commit to notifying you promptly of any data breach that may affect you.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws.

When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses approved by the European Commission
• Data Processing Agreements with all third-party processors
• Privacy Shield certification (where applicable)
• Adequacy decisions for data transfers

Cookies and Tracking

We use cookies and similar tracking technologies to improve your experience:

You can control cookies through your browser settings. Disabling certain cookies may limit functionality of the service.

Third-Party Services

We use carefully selected third-party services to provide and improve our service:

• Stripe: Payment processing (PCI DSS compliant)
• AWS: Cloud infrastructure and storage
• OpenAI/Anthropic: AI analysis capabilities
• SendGrid: Email communications
• Google Analytics: Usage analytics (anonymized)

Each third-party service has its own privacy policy. We only share the minimum necessary information with these services.

Data Retention

We retain your information only as long as necessary to provide our services and fulfill the purposes outlined in this policy:

• Account data: Retained while your account is active
• Documents: Retained for 90 days after deletion
• Billing records: Retained for 7 years for tax purposes
• Analytics data: Anonymized after 24 months
• Support tickets: Retained for 2 years

Upon account deletion, we will delete or anonymize your information within 90 days, except where legal obligations require longer retention.

Children's Privacy

Our service is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

California Privacy Rights

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt out of the sale of personal information
• Right to non-discrimination for exercising privacy rights

We do not sell personal information to third parties.

Updates to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date
• Sending an email notification for material changes
• Obtaining consent where required by law

We encourage you to review this Privacy Policy periodically for any changes.

Contact Us

If you have questions or concerns about this Privacy Policy or our data practices:

You also have the right to lodge a complaint with your local data protection authority.