Privacy Policy

What we collect

• Account information: your name, email address, password (stored hashed, never in plain text), and two-factor authentication data.
• Business formation data: information you enter about your business, such as its name, formation state, registered agent details, state filing confirmation numbers, and tax election.
• Uploaded documents: files you upload to the document vault, such as EIN letters, operating agreements, and identification documents.
• Payment information: subscription and billing details. Our payment processor (Stripe) handles and stores your card details directly — this application never stores your card number.
• Usage data: basic technical data such as sign-in timestamps, needed to operate and secure the account.

How documents are protected

Documents you upload to the document vault are encrypted with AES-256 encryption before being stored, and are never stored in plain text. Accessing stored documents requires you to be signed in with two-factor authentication (MFA) active on your account. Encrypted document files are stored with our cloud storage provider; only the application can decrypt them, using a key that is never exposed to that storage provider.

Third parties we share data with

We share the minimum data necessary with the following categories of service providers so the product can function. None of these providers is permitted to use your data for their own marketing purposes.

• Our payment processor (Stripe) — to process subscription payments. They receive your payment details and billing contact information directly.
• Our email provider (SendGrid) — to send account, verification, and compliance reminder emails.
• Our SMS provider (Twilio) — to send optional text-message compliance reminders, if you enable them.
• Our cloud storage provider — to store encrypted document blobs from the document vault.

Your rights

You can access and review the information stored about your account and businesses at any time by signing in. You may request an export or deletion of your account data by contacting us.

TODO: a self-service account deletion / data export flow is not yet built. Until it is, deletion and export requests must be handled manually — this needs to become a real, supported flow before this policy is finalized.

Questions

See also our disclaimer and terms of service.