Privacy Policy

Information you give us. Your email address and password when you create an account; your name and contact details; the answers you enter into risk reports, lead forms, and contract generators (which can include business details, party names, addresses, dates, and dollar amounts); messages you send us; and testimonials or community posts you choose to submit.

Other parties to your agreements. When you send an agreement for signature, you give us the name and email address of the counterparty. Counterparties are people who are not our users and do not have an account with us. We use their name and email address to send the signing request and, when everyone has signed, an email with a link to the signed copy, which stays valid for 30 days. We also store the signed copy, the signing provider’s audit log and the signing events (viewed, signed, declined) against your agreement. You are responsible for having the right to give us their details.

Payment information. Card details are entered directly with Stripe and are never received or stored on our servers. We keep a record of the transaction: amount, product, date, status, and the last four digits and brand of the card.

Information collected automatically. IP address, browser and device type, referring page, pages viewed, and timestamps, plus essential cookies used to keep you signed in. See our Cookie Policy.

We do not intentionally collect government identifiers, health information, or other special categories of data. Please do not enter information into a contract generator that you do not want processed by the providers listed below.

• To create and secure your account and give you access to what you purchased.
• To generate, deliver, and store the documents you create.
• To send agreements for electronic signature and store the signed copy and audit log.
• To answer the free text you enter into Legal Triage and the Risk Report using an AI provider.
• To take payment, issue receipts, and handle refunds and disputes.
• To send transactional email — receipts, password resets, access details, and program logistics.
• To send marketing email about our products and training, where you have opted in or where permitted by law. Every marketing email includes an unsubscribe link.
• To provide support, answer questions, and improve our products and site.
• To detect and prevent fraud, abuse, and security incidents, and to comply with legal obligations and enforce our Terms.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Where the GDPR or UK GDPR applies, we process personal data to perform our contract with you (account, purchases, document delivery), on the basis of our legitimate interests (site security, product improvement, direct marketing to existing customers), with your consent (marketing sign-up, which you may withdraw at any time), and to comply with legal obligations (tax and accounting records).

We share personal information only with providers who need it to run the business, each bound to use it solely on our instructions:

• Supabase

  Accounts, authentication, and application database

  Email address, hashed credentials, session tokens, purchase records, and the answers you enter into contract generators.

• Stripe

  Payment processing

  Name, email, billing address, and card details entered directly with Stripe. We receive only a transaction record and the last four digits of the card — never the full card number.

• Resend

  Transactional and marketing email delivery

  Email address, name, and delivery/engagement events such as sent, delivered, opened, and bounced.

• PDFMonkey

  Document rendering

  The contract field values you submit, passed through to generate your finished PDF.

• DocuSeal

  Electronic signature

  When you send an agreement for signature: the contract PDF, your name and email address, the other party’s name and email address, and signing metadata the service records during signing (timestamps and IP addresses). It returns the signed copy and an audit log, which we store so you can download them.

• Anthropic (AI provider)

  Automated analysis of text you type

  The free text and answers you enter into Legal Triage, the Risk Report, the Defense Plan and the Starter intake, sent to Anthropic’s API to generate the response you see (for the Starter intake, a profile that our operator reads). In the Risk Report and the Defense Plan that includes your first name and your business description; in the Starter intake it includes every answer you type, your name and the personal details the questionnaire asks for among them. For the signed-in tools we send a pseudonymous account identifier; for the anonymous Legal Triage we send a one-way hash of your IP address. We do not send your email address, your surname (in the Risk Report and the Defense Plan) or your IP address itself, but anything you type into a free-text answer is sent as you typed it. The Risk Report, the Defense Plan and the Legal Triage answers are generated automatically and are not reviewed by an attorney.

• Testimonial.to

  Embedded testimonials wall (the Testimonials page)

  When the Testimonials page loads, the embedded widget is fetched from Testimonial.to, which receives your IP address and browser details and may set its own cookies. Nothing is sent to it from any other page.

• Cloudflare

  Hosting, content delivery, and security

  IP address, request metadata, and security signals used to serve and protect the site.

We may also disclose information to our professional advisors, to comply with law or valid legal process, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets (with notice to you where required).

We are based in the United States and our providers process data in the United States and other countries. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Account and purchase records are kept for as long as your account is active and afterwards as needed for tax, accounting, and legal purposes — generally seven years for transaction records. We do not promise a particular retention period for generated documents, the answers behind them, or signed copies and signing audit logs: keep your own copy of anything important (the Terms say the same). Marketing contacts are kept until you unsubscribe or ask to be removed. Server and security logs are typically retained for a short rolling period.

We use encryption in transit, hashed credentials, access controls, and reputable infrastructure providers to protect your information. No system is perfectly secure, so we cannot guarantee absolute security. Keep your password confidential and tell us promptly if you suspect unauthorized access to your account.

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a portable copy, object to or restrict certain processing, withdraw consent, and opt out of marketing. California residents may request disclosure of the categories of information collected and may exercise deletion and correction rights; we will not discriminate against you for exercising them.

To exercise any right, email karam@legallybulletproof.com. We will verify your request through your account email and respond within the time required by applicable law. You may also unsubscribe from marketing at any time using the link in any marketing email. Note that deleting your account also removes access to documents stored in it — download anything you need first.

Our site and products are intended for business owners aged 18 and over. We do not knowingly collect personal information from children under 13 (or under 16 where that is the applicable threshold). If you believe a child has provided us information, contact us and we will delete it.

Information you submit through this site is not protected by attorney-client privilege. Using this site or our products does not create an attorney-client relationship. See our Disclaimer for the full statement.

We may update this Policy as our business or the law changes. The “Last updated” date above reflects the current version, and material changes will be posted here. Contact: karam@legallybulletproof.com.