Privacy Policy

LegalFormsOS — Privacy Policy

Last updated: 2026-07-14. Version: 2026-07-14.

1. OUR APPROACH. Your privacy is central to how LegalFormsOS is built. We collect the minimum information needed to run the Service, we protect it, and we never sell it.

2. WHAT WE COLLECT. (a) Account information: your email address, password (stored only as a salted cryptographic hash — never in plain text), and two-factor codes. (b) Matter information: the answers and documents you enter to generate forms, which may include sensitive personal and financial details. Highly sensitive identifiers (such as Social Security numbers and bank/account numbers) are encrypted at rest and are never written to logs, analytics, search indexes, or exports. (c) Operational data: limited technical logs (such as a hashed IP for security and rate-limiting) used to keep the Service secure and reliable.

3. HOW WE USE IT. We use your information only to: provide and operate the Service; generate your documents; authenticate you and secure your account; process payments; and comply with law. We do NOT sell your personal information, and we do not use the contents of your matter data for advertising.

4. ENCRYPTION AND SECURITY. Sensitive fields are protected with field-level AES-256-GCM encryption. Passwords use a strong key-derivation function. Signature images are encrypted and never made public. Access is scoped per organization so one account cannot access another's data. The application runs behind HTTPS. No system is perfectly secure, but we design to reduce risk and to keep the most sensitive data render-only.

5. DATA RETENTION AND DELETION. You control your data. Per-client retention modes let you keep, auto-purge, or redact matter data. When you delete your account, it is placed in a recoverable state for THIRTY (30) DAYS so you can restore it. After 30 days, the account and its personal data are PERMANENTLY and irreversibly purged — encrypted fields, generated files, and sensitive records are scrubbed, and user records are anonymized. Only a minimal, non-personal record that a deletion occurred is retained for security and audit integrity.

6. SHARING. We share information only with service providers strictly necessary to run the Service (such as a payment processor and an email delivery provider), only to the extent needed, and under confidentiality obligations; or when required by law, subpoena, or valid legal process; or to protect our rights, users, or the public. We do not sell or rent your data.

7. YOUR CHOICES AND RIGHTS. You can access and update your account information, export or delete your matter data, and delete your account. Depending on where you live, you may have additional rights (such as access, correction, deletion, and portability); email support@legalformsos.com to exercise them, and we will respond as the law requires.

8. NOT A COURT OR GOVERNMENT SERVICE. LegalFormsOS is private document-automation software and is not affiliated with any court or government agency. Documents you file with a court become part of a public record governed by that court's rules — not by this policy.

9. CHILDREN. The Service is for adults (18+) and is not directed to children. We do not knowingly collect information from children.

10. DATA RESIDENCY / WHERE YOUR DATA IS STORED. LegalFormsOS is operated from the United States and your data is stored and processed on servers located in the United States (onshore). We do not store your matter data offshore. Our current infrastructure and sub-processors are listed in the Sub-Processors page (/p/subprocessors). If you require a specific data-residency commitment, contact us.

11. GDPR / UK GDPR (European users). Where the EU or UK GDPR applies to you, LegalFormsOS acts as a "data controller" for account/operational data and as a "data processor" for the matter data you enter about your own clients (for which you are the controller — see our Data Processing Agreement at /p/dpa). Our lawful bases for processing are: performance of our contract with you (to provide the Service), your consent (where required), our legitimate interests (securing and improving the Service), and compliance with legal obligations. You have the right to access, rectify, erase, restrict, and port your personal data, to object to processing, and to lodge a complaint with your supervisory authority. To exercise any right, email support@legalformsos.com; we verify your identity and respond within the statutory time limit (generally 30 days). International transfers, where they occur, rely on appropriate safeguards such as Standard Contractual Clauses.

12. CCPA / U.S. STATE PRIVACY RIGHTS. We do not sell or "share" (as those terms are defined by the CCPA/CPRA) your personal information, and we do not use it for cross-context behavioral advertising. Depending on your state, you may have rights to know, access, correct, delete, and to non-discrimination for exercising them. Email support@legalformsos.com to exercise them.

13. RETENTION SCHEDULE. We keep account and matter data while your account is active and you keep it. Deleted accounts enter a 30-day recovery window and are then permanently purged. A limited set of records is retained after purge only where the law requires it — financial/tax records (statutory retention), proof of your consent to the Terms, and a minimal, PII-reduced audit trail that a deletion occurred. Our full record-by-record deletion map is available to customers on request and underpins our Data Processing Agreement.

14. CHANGES. We may update this policy; we will change the version and last-updated date. Material changes may require re-acceptance.

15. CONTACT. Privacy questions, and data-subject / data-protection requests: support@legalformsos.com.