Privacy Policy

1. What we collect

• Account information: firm name, staff names, email addresses, and login credentials.
• Client information you enter: business name, contact name, email, phone, and the documents, files, and answers submitted through client upload links.
• Billing information, handled directly by our payment processor. We don't store card details.
• Basic usage data (log-in times, feature usage, and a history of actions on each request) used to operate the Service.
• When a firm signs up for a free trial: a one-way scrambled (hashed) version of the email address, a random browser identifier, and the network address used, so we can offer one free trial per person. We never store these in readable form.
• If you ask for our checklist on the website: your email address, and whether you chose to get monthly tips. You can unsubscribe from tips with the link in any tip email.

2. How we use it

We use this data to operate the Service: creating and sending monthly document requests, sending reminder emails, storing uploaded files securely, and showing your dashboard. We do not sell your data or your clients' data, and we do not use it for advertising.

3. Where it's stored and how it's protected

• Account and client data is stored in a Postgres database with row-level security, so each firm can only access its own records.
• Data is stored in Singapore, on Amazon Web Services, and encrypted in transit and at rest. Transfers of personal data from the EU, UK or Switzerland are covered by the Standard Contractual Clauses in our Data Processing Agreement.
• Uploaded files are stored in a private storage bucket and only ever served through short-lived signed links. They are never publicly listable.
• Clients can upload documents and photos only (PDF, images, Word, Excel, CSV and text files). Each file is checked when it arrives, and anything that looks like a program or script is removed before anyone can open it.

4. Third-party processors

We rely on a small number of providers to run the Service. Each only receives the data needed for its job:

• Supabase: database, file storage, and sign-in.
• Netlify: hosting the website and app.
• Resend: sending request, reminder, and account emails.
• Anthropic: reading uploaded PDFs and photos to check they match what the firm asked for, when the firm has the AI check turned on. Anthropic doesn't use this data to train its models.
• Paddle: payments. Paddle is the merchant of record and keeps its own billing records.
• Google: only if you choose to sign in with Google.

5. Client (end-user) access links

Your clients access their monthly checklist through a unique, hard-to-guess link with no login required. Anyone with that link can view and submit that month's checklist, so it shouldn't be shared publicly. Links stop working as soon as a firm asks for its account to be deleted. If a link has been shared by mistake, contact us and we'll replace it.

6. How long we keep data

• Client documents: each firm chooses to keep uploaded files for 30, 60, or 90 days after upload (90 at most). After that, the file is deleted automatically and the request shows that it was removed. Firms should download anything they need to keep for longer.
• Files a client removes: the file is deleted straight away. A record of its name, size, and upload and removal times stays with the request so the firm can see what changed.
• Accounts without an active plan: if a free trial ends without a plan being chosen, or a paid plan is cancelled, the account's data is kept for 30 days so the firm can come back. Owners are emailed 7 days and 1 day before it's deleted. After that, all clients, checklists, requests, documents, and team logins are erased.
• Deleting your account: an owner can delete the account from Settings. Client links and emails stop immediately, any paid plan is cancelled, and everything is erased 7 days later. Until then, an owner can sign in and cancel.
• Free-trial records: the hashed values described in section 1 are kept for 12 months, including after an account is deleted, and then removed.
• Backups and billing: deleted data may remain in our providers' encrypted backups for a short period until they're overwritten. Paddle keeps payment records as required by law.

7. Your rights

You can see and correct your firm's data from the dashboard and Settings at any time, and delete your whole account from Settings. Your clients can remove files they uploaded until you accept them. To have a single client's records and files erased sooner than your retention setting, or for any other request about your data, contact us and we'll handle it.

8. Cookies

We use essential cookies to keep you signed in and to protect against cross-site request forgery. On the sign-up and log-in pages we also set a cookie holding a random browser identifier, used only to offer one free trial per person. We don't use third-party advertising or tracking cookies.

9. Changes to this policy

If we make material changes to this policy, we'll notify account owners by email before the changes take effect.

10. Contact

HadesReality (Pvt) Ltd is responsible for the information described in this policy. Questions about this policy or your data? Reach out via ourcontact page.