Effective date: 2026-10-11 · Version: privacy-2026-11
This policy explains how [Company legal name pending LLC formation] d/b/a Inkpacket ("Inkpacket," "we," "us") collects, uses, discloses, and keeps personal information when you visit inkpacket.com or use the Inkpacket service (the "Service").
1. Our role
- Account users and website visitors: we decide how your information is used (we are a "business" or "controller").
- Documents and signer data sent by a customer: we process it on the customer's behalf as a "service provider" or "processor" under our DPA. The sending business controls it. Signers should send requests about a document to that business first, and we'll help where we can.
2. Information we collect (with CCPA categories)
| Category | Examples | Source |
|---|---|---|
| Identifiers | name, email, phone (if a sender adds it), IP address, account ID | you; the sender; your device |
| Customer records | workspace name, role, invitations | you |
| Document content | PDFs, templates, field values, signatures and initials (typed or drawn) | senders and signers |
| Internet/network activity | pages viewed, browser/user agent, device info, error logs, audit events (created, sent, viewed, consented, signed, completed, declined, voided, expired, corrected) with time, IP, and browser | your device; the Service |
| Commercial information | plan, billing history (when paid plans open; card numbers are handled by our payment processor, not stored by us) | you; payment processor |
| Inferences | none. We don't build profiles. | — |
| Sensitive personal information | The account password is stored only as a hash. We don't ask for SSNs, government ID, financial account, precise location, or health data, and our Terms prohibit uploading protected health information. A sender's own documents could contain sensitive information; that's the sender's responsibility. We don't use sensitive information to infer characteristics. | — |
We may also receive information you type into the Ask Inkpacket assistant or our contact form.
3. How we use information
To provide and operate the Service (accounts, sending and delivering documents, reminders, the completed PDF, the Certificate of Completion, the audit trail, and /verify); to prove the signing process; for security, fraud and abuse prevention, and rate limiting; for support and service messages; to debug and improve the Service; for analytics (with consent where required); to comply with law and enforce our terms.
4. How we disclose information
- Within a signing flow: senders see signer actions and the audit trail. Signers see the documents sent to them. Workspace members see workspace documents according to their role.
- Service providers (subprocessors) under contracts that limit their use. See /subprocessors.
- Integrations a workspace enables (for example webhooks).
- Legal and safety: to comply with law or legal process, or to protect rights, safety, and security.
- Business transfers: in a merger, acquisition, financing, or sale of assets, subject to this policy.
We do not sell personal information. If we turn on advertising cookies or pixels, that may count as "sharing" for cross-context behavioral advertising under California law. We'll only do so after updating this policy and honoring the opt-outs in Section 8. In the past 12 months we have disclosed the categories in Section 2 to service providers for the business purposes above.
5. Ask Inkpacket (AI assistant)
Ask Inkpacket answers questions from our help, FAQ, and blog content. When an AI provider is enabled, the text of your question may be sent to that provider (currently OpenAI, when enabled) to generate an answer. The provider processes it under contract and is not permitted to use it to train its models where the provider's terms allow that restriction . Don't type personal, confidential, or health information into Ask. Ask does not read your documents.
6. Retention
- Completed documents, signer data, and Certificates of Completion: kept while the workspace is active and for 7 years after the workspace is closed, then deleted. You can ask us in writing at support@inkpacket.com to delete a document sooner. We delete that document's stored files and field values. The audit trail and document fingerprints stay for 7 years as a record that the signing happened. Many customers have their own record-keeping duties (for example, Washington requires referral agencies to keep referral records for 6 years under RCW 18.330.040). The 7-year period is meant to cover them, but customers stay responsible for keeping their own copies.
- Audit trail and document fingerprints: kept for 7 years after the workspace closes, including when a document's contents are deleted on written request. The application cannot edit or delete an audit entry or a document fingerprint before that period ends.
- Account information: while the account is open and for up to 7 years after, for legal, tax, and dispute purposes.
- Logs and rate-limit data: hosting and error-monitoring logs are kept for as long as those providers keep them, generally 30–90 days. Rate-limit counters are cleared after about 1 day.
- Backups: deleted data may remain in provider backups for up to 7 days before it is overwritten.
- Closing a workspace: an owner can close a workspace in Settings. Closing stops new sending but does not delete records today. The workspace can be reopened for 30 days, and records are deleted 7 years after closure. A written request can remove a document's contents sooner. The audit trail and fingerprints still stay for 7 years.
7. Security
We use administrative, technical, and organizational safeguards, including: HTTPS encryption in transit; passwords stored as hashes; workspace isolation; role-based permissions; optional signer access codes; rate limits on sign-in, signing, forms, and the API; an append-only audit log enforced at the database level; and SHA-256 fingerprints of completed documents, which anyone can check at /verify. No system is completely secure. If a breach affects your personal information, we'll notify you and regulators as the law requires.
Security incidents. We keep a written incident-response plan. If we learn of unauthorized access to personal information we hold, we will investigate, contain it, and notify affected individuals, business customers, and regulators within the timeframes required by applicable law. For business customers, we notify without undue delay and within 72 hours under our DPA. If a customer's documents are involved, we'll work with that customer, who may have its own notice duties to the people in its documents.
8. Your U.S. state privacy rights
Depending on where you live (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Nebraska, Rhode Island, and other states with similar laws), you may have the right to:
- know or access the personal information we have about you, and get a portable copy;
- correct inaccurate information;
- delete your information (subject to legal exceptions and the record-keeping duties described in Section 6);
- opt out of the sale or sharing of personal information, targeted advertising, and certain profiling (we don't sell, and we honor Global Privacy Control as an opt-out);
- limit the use of sensitive personal information (we don't use it beyond what's permitted);
- not be discriminated against for exercising your rights; and
- appeal our decision on your request by replying to our decision email with "Appeal." If we deny the appeal, you may contact your state attorney general.
To make a request, email support@inkpacket.com or write to the address below. We'll verify your identity by confirming control of your email address, and may ask for more information. An authorized agent may submit a request with proof of authorization. We respond within the time the law allows (generally 45 days). For document data controlled by a customer, we'll forward or refer your request to that customer. California "Shine the Light": we don't disclose personal information to third parties for their own direct marketing.
9. Cookies and analytics
See our Cookie Policy at /cookies. We use essential cookies to run the Service. Analytics cookies through Google Tag Manager (container GTM-MDN2T94K) load only after you consent through our cookie banner (or, where the law allows, until you opt out). Change your choice at any time with "Cookie settings" in the footer.
10. Children
The Service is a business tool and is not directed to children. We don't knowingly collect personal information from anyone under 13 (or under 16 where the law sets a higher age). Account users must be 18 or older. If you believe a child has given us information, contact support@inkpacket.com and we'll delete it.
11. International users
We operate from, and store data in, the United States. If you use the Service from elsewhere, your information will be transferred to the U.S.
12. Changes
We'll post updates here with a new effective date and notify account users of material changes by email or in the Service before they take effect.
13. Contact
[Company legal name pending LLC formation] d/b/a Inkpacket, Attn: Privacy, 272 Old Shackle Island Rd, Hendersonville, TN 37075 · support@inkpacket.com
---