Privacy Policy

User Representations. By using the Services you represent, warrant, and agree that:

• You are physically located in the United States when accessing or using the Services;
• You are not using VPNs, proxies, or other means to circumvent this geographic restriction;
• You understand we do not comply with the GDPR, UK GDPR, ePrivacy laws, or any similar non-U.S. data protection regulations;
• You will not use the Services if doing so would subject us to foreign regulatory obligations; and
• Access from outside the U.S. is at your sole risk, and we make no warranties of compliance with local laws.

Identifiers

• Examples: Full name, email address, phone number, IP address, device identifiers (where available), account username/reference.
• Sources: Directly from you (forms, purchase checkout, support requests); automatically from your device/browser; from our systems (logs, account creation).
• Purposes: Account creation and management; identity verification; Service delivery (template generation tied to purchaser); transactional communications; fraud prevention and security; geographic restriction enforcement; customer support; marketing (with consent); legal/IP enforcement and TOS compliance.
• Recipients / Third Parties: Stripe (limited for payment verification); AWS (hosting and logging); analytics providers (aggregated); internal personnel on need-to-know basis; law enforcement or legal process when required.

Commercial Information

• Examples: Purchase history, transaction amounts and dates, order/reference numbers, promotional codes used, download history and timestamps, preview activity counts and types.
• Sources: Directly from you during checkout; automatically generated by our systems upon purchase/download/preview.
• Purposes: Fulfill purchases and deliver templates; maintain accurate transaction records; customer support and re-download assistance; analytics and business improvement; tax/accounting compliance; enforcement of licensing terms and detection of unauthorized sharing (we keep all customer transaction data for these purposes).
• Recipients: Stripe (payment confirmation); AWS (storage of records); internal teams; legal counsel or authorities for enforcement actions.

Internet or Other Electronic Network Activity Information

• Examples: Pages visited, time spent, click patterns, navigation paths, scroll depth, session replay and screen interaction recordings (mouse movement, clicks, scrolling, and page navigation, excluding payment card fields), preview behavior (which templates viewed, time in preview mode, number of previews), UTM parameters, referral sources, email interaction data (opens/clicks where technically available).
• Sources: Automatically collected via server logs, pixels, and analytics tools when you use the Website.
• Purposes: Website functionality and performance optimization; fraud and abuse detection (e.g., excessive previewing without purchase per TOS §9.1); security monitoring; analytics and Service improvement; marketing attribution and campaign measurement.
• Recipients: Third-party analytics providers (under contract); AWS; internal teams.

Geolocation Data (Approximate)

• Examples: U.S. state you select for template generation; approximate location derived from IP address (city-level or coarser).
• Sources: You (state selection); automatically from IP address.
• Purposes: Generate jurisdiction-appropriate employment contract templates; enforce U.S.-only geographic access and TOS restrictions; fraud prevention; analytics (aggregated).
• Recipients: Internal systems only (state is used for template logic); IP-derived location used internally for enforcement and analytics.

Professional or Employment-Related Information (Limited)

• Examples: Job title you provide for template generation; any business name or intended use details you voluntarily supply.
• Sources: Directly from you during template generation or purchase.
• Purposes: Customize and deliver the correct employment contract template; improve template library based on popular roles (aggregated, de-identified).
• Recipients: Internal processing only. Note: We do not collect personal information about your employees or the end-users of the templates you generate.

Payment Information (Processed by Third Party Only)

• Examples: We receive only confirmation of successful payment, payment method type (e.g., card brand), and last four digits of card for record-keeping and fraud prevention.
• Important: We do not store, process, transmit, or have access to full credit card numbers, CVV, expiration dates, or other sensitive payment card data. All such data is collected, processed, and stored exclusively by our third-party payment processor, Stripe, Inc., which is certified to PCI-DSS Level 1 standards. Stripe handles this under its own privacy policy and our data processing agreement with them.
• Sources: Stripe (limited confirmation data only).
• Purposes: Confirm successful transactions; maintain accurate financial records; prevent fraud.
• Recipients: Stripe (full handling); we receive only minimal confirmation data.

Inferences Drawn from Other Personal Information

• Examples: Usage patterns, preview frequency, purchase propensity, aggregated analytics insights (primarily de-identified or aggregated).
• Sources: Derived from your usage data and transaction history.
• Purposes: Improve Services, detect anomalies/fraud, personalize limited aspects of the user experience (e.g., relevant template suggestions), business analytics.
• Recipients: Internal use primarily; aggregated insights may be shared with analytics providers under contract.

Sources of Personal Information.

• Directly from you (forms, inputs, checkout, support tickets, voluntary disclosures).
• Automatically from your device and browser (logs, cookies/technical identifiers, IP address).
• From our own systems and records (transaction logs, generated documents associated with your account).
• From third parties: Stripe (limited payment confirmation), analytics providers, security tools, and (rarely) public or business records for TOS violation investigations (e.g., competitor status verification per TOS §10.4 and §15).

Core Service Delivery

• Generate, customize, and deliver employment contract templates using the job title and state you provide.
• Process and fulfill purchases, issue receipts and download links, and grant access to purchased templates.
• Create, authenticate, and manage user accounts and sessions.

Transactional & Service Communications

• All emails and system notifications are triggered by your actions (purchase → immediate receipt + download email; support request → response; password reset you initiate, etc.). We send no unsolicited marketing without consent.

Marketing Communications (Consent-Based)

• Occasional emails about our Services, new templates, discounts, promotions, and related employment contract offerings.
• Consent mechanisms: You join our marketing list only by (a) selecting the marketing opt-in checkbox during checkout, or (b) providing your email address to save the progress of a previewed contract or to request a promotional discount code, each of which is accompanied by a notice that doing so opts you in to promotional emails. You can opt out at any time (see Section 6).
• Frequency is reasonable and not excessive; content is relevant to our Services.

Analytics, Improvement & Personalization (Limited)

• Analyze usage patterns, preview behavior, and purchase trends (often aggregated) to improve the Website, template quality, user experience, and business operations.
• Measure marketing campaign effectiveness via UTM and referral data.

Security, Fraud Prevention, Abuse Detection & Platform Protection

• Detect, investigate, and prevent fraudulent transactions, scraping, excessive previewing without purchase, hacking, DDoS, and other abuse.
• Enforce geographic restrictions and competitor exclusion policies (TOS §§10, 12, 15).
• Monitor for malicious behavior or TOS violations.

Intellectual Property Protection, Licensing Enforcement & Legal Compliance (Why We Keep All Customer Data)

• Retain purchaser information, transaction records, download logs, preview activity, and copies of generated templates for as long as necessary — and often indefinitely — to:
  • Enforce our licensing terms and pursue remedies (including liquidated damages) against unauthorized redistribution or sharing (TOS §§10.3, 13.13, 23.3);
  • Detect and investigate competitor access or misuse of our templates (TOS §§10, 15);
  • Utilize the unique license number embedded in each generated document, which is used solely to identify the licensed purchaser in cases of unauthorized redistribution and contains no personal information beyond the license reference (TOS §§13.9, 13.13, 23.4);
  • Defend against legal claims, respond to disputes, and protect our intellectual property rights in the proprietary System and templates (TOS §7, §16, §23);
  • Comply with tax, accounting, record-keeping, and other legal obligations;
  • Maintain audit trails for completed transactions and customer service history.
• We keep all customer data because digital products like ours are easily copied and redistributed. Retention is a reasonable and necessary business practice to protect the substantial investment we make in creating high-quality, jurisdiction-specific employment contract templates. This is expressly authorized and required by our TOS.

Other Legitimate Purposes

• Respond to valid legal process, court orders, subpoenas, or government requests.
• Establish, exercise, or defend legal claims (including in arbitration per TOS §24).
• Any other purpose disclosed to you at collection or for which you provide consent.

Limited Sharing with Service Providers Only. We share personal information only with trusted third-party service providers and subprocessors that perform functions on our behalf under written contracts requiring them to:

• Use data solely for our authorized purposes;
• Maintain strong confidentiality and security protections;
• Not use or disclose data for their own purposes or further share it except as necessary to perform their services;
• Delete or return data upon termination of the relationship (subject to legal retention needs).

Current categories include:

• Stripe, Inc. — Exclusive handler of all payment card data (PCI-DSS Level 1). We receive only minimal confirmation data. This is an internal integration required to enable payments on our Website.
• Amazon Web Services (AWS) — Cloud hosting, storage (including generated documents), databases, logging, and email delivery (SES). Data is stored primarily in U.S. regions.
• Analytics & Performance Providers — Third-party tools for usage analytics, performance monitoring, and marketing attribution (may use cookies/pixels under our contractual control; data primarily aggregated).
• Security & Operational Tools — Fraud detection, abuse monitoring, DDoS protection, and customer support platforms (as needed).

Legal, Safety & Enforcement Disclosures. We may disclose personal information (including retained generated templates and tracking data) when we have a good-faith belief it is necessary to:

• Comply with law, regulation, court order, subpoena, or valid legal process;
• Protect our rights, property, safety, or legitimate interests (or those of our users or the public);
• Investigate, prevent, or respond to fraud, security incidents, TOS violations (including competitor access and template redistribution), or threats to the platform;
• Enforce our TOS, licensing agreements, and intellectual property rights (we may share evidence with authorities, in arbitration, or court proceedings);
• Complete a business transfer (merger, acquisition, etc.) with appropriate protections.

Why We (and Our Providers) May Use These Technologies

• Essential / Strictly Necessary: To enable core functionality such as maintaining login sessions, preserving preview state during your visit, processing purchases, load balancing, basic security (e.g., CSRF protection), and remembering basic preferences. These are required for the Website to work properly.
• Analytics & Performance: To understand how users interact with the site (pages viewed, time spent, navigation, preview behavior), identify performance issues, and improve the Services. Data is often aggregated.
• Session Replay & Screen Interaction Recording: To record how visitors interact with our pages (such as mouse movement, clicks, scrolling, and page navigation) so we can diagnose usability problems, detect abuse, and improve the Website. These recordings exclude payment card fields, which are handled exclusively inside Stripe's checkout.
• Marketing Attribution & Campaign Measurement: To track the effectiveness of our promotional efforts using UTM parameters and referral data (no cross-site retargeting or personalized advertising).
• Security & Fraud Prevention: To detect suspicious activity, enforce geographic restrictions, and protect the platform.

What We Do NOT Do with Tracking Technologies

• We do not sell or share data collected via these technologies for third-party targeted advertising.

Specific Retention Practices

• Account and Contact Information (name, email, phone): Retained while the account is active and for a reasonable period thereafter to support customer service, potential re-activation, or enforcement needs.
• Transaction, Purchase, Preview, and Download Records: Retained indefinitely or for the maximum period permitted or required by law. These records are essential for accurate financial reporting, tax compliance, audit trails, customer service history, and — most importantly — enforcement of our licensing terms and detection of unauthorized template redistribution.
• Generated Employment Contract Templates and Associated Data: Retained solely for licensing enforcement, intellectual property protection, and legal defense purposes as authorized in TOS Section 16. Retention may continue indefinitely while there remains a need to monitor for or respond to unauthorized use, competitor access, or IP violations. These retained files contain a unique license number used solely to identify the licensed purchaser in cases of unauthorized redistribution; the license number contains no personal information beyond the license reference.
• Analytics, Usage Logs, and Technical Data: Retained for as long as useful for security, fraud prevention, performance improvement, and business analytics (typically 1–3+ years for raw logs; longer for aggregated insights or security purposes).
• Marketing Consent and Opt-Out Records: Retained as long as necessary to demonstrate CAN-SPAM compliance and to honor suppression requests.
• Legal Hold or Dispute-Related Data: Retained for the full duration of any investigation, claim, arbitration, litigation, regulatory proceeding, or appeal, plus any additional period required.

What Happens If You Request Deletion or Close Your Account? You may request deletion of your personal information (see Section 11). However, we may retain certain information even after such a request where:

• Retention is necessary to complete a transaction or provide Services you requested;
• It is required or permitted by law, regulation, or legal process;
• It is needed to protect against fraud, abuse, or security threats;
• It is necessary to enforce our TOS, licensing terms, or intellectual property rights (including retained generated templates and tracking data);
• It is needed for tax, accounting, or other legitimate business record-keeping.

De-identified or aggregated data may be retained indefinitely. You acknowledge and agree that our retention practices — including keeping customer data and generated templates for enforcement purposes — are reasonable and necessary given the nature of digital products and the risks of unauthorized copying described in the TOS.

Our Security Measures. We implement and maintain reasonable and appropriate administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, or destruction. These include:

• Encryption of data in transit (TLS/SSL) and at rest where feasible and appropriate;
• No storage of full credit card data by us — all payment card processing is handled exclusively by Stripe under PCI-DSS Level 1 certification;
• Role-based access controls, least-privilege principles, multi-factor authentication where appropriate, and strict internal access policies;
• Secure cloud infrastructure via AWS with appropriate network segmentation, monitoring, and logging;
• Regular vulnerability assessments, penetration testing, security monitoring, and incident response procedures;
• Employee and contractor confidentiality agreements, background checks where appropriate, and ongoing training on data protection and security;
• Secure development practices and change management.

Data Breach Notification. In the event of a confirmed or reasonably suspected breach involving personal information, we will:

• Investigate promptly and take reasonable containment and mitigation steps;
• Notify affected individuals and relevant U.S. authorities as required by applicable state and federal breach notification laws (generally without unreasonable delay, with timing and content varying by state);
• Provide details on the nature of the incident, categories of information involved (e.g., contact info, transaction records, or — in rare cases — limited retained template data), steps we are taking, and recommended protective actions for you (e.g., monitor accounts, change passwords, consider credit monitoring);
• Comply with any additional requirements (e.g., notification to credit bureaus or offers of identity protection services when appropriate).

We maintain an incident response plan and will act in good faith to protect affected individuals.

Your Rights (U.S. State Privacy Laws). Depending on your state of residence and applicable law (including CCPA/CPRA for California residents and substantially similar laws in Virginia, Colorado, Connecticut, Utah, and other states), you may have some or all of the following rights:

• Right to know what personal information we collect, use, disclose, and the purposes;
• Right to access / obtain a copy of the specific pieces of personal information we hold about you;
• Right to delete personal information (subject to important exceptions noted in Section 9);
• Right to correct inaccurate or incomplete personal information;
• Right to opt out of any "sale" or "sharing" of personal information or targeted advertising (we engage in none);
• Right to limit use of sensitive personal information (we collect none for such purposes);
• Right to data portability (where technically feasible);
• Right to non-discrimination for exercising your rights;
• Right to opt out of marketing emails (easy unsubscribe as described in Section 6).

How to Submit a Request. Email a verifiable request to [email protected]. Include:

• Your full name and the email/phone associated with your account or purchases;
• A clear description of the request (e.g., "Access request — California resident" or "Deletion request");
• Any details that help us locate your information (approximate purchase date, reference number, etc.).