DocuPacket Privacy Policy

Effective date: 2026-10-16

1 Who we are and what this policy covers

Tiffany Paden, doing business as DocuPacket (we, us, or our), operates www.docupacket.com and its document preparation, delivery, completion, and electronic-signature services. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information about website visitors, account holders, team members, senders, and document Recipients. Contact admin@docupacket.com or PO Box 265, Quinlan, Texas 75474.

We determine how information is used to administer our business, accounts, billing, security, and public website. For documents and Recipient information processed at a Customer's direction, we generally act as a service provider or processor for that Customer. A sender or organization may have its own privacy obligations and notices. This policy describes our practices, not a sender's independent use or retention of a downloaded document.

2 Information we collect and its sources

Account and contact information: We receive names, email addresses, organization and team details, account settings, and information you provide during registration, support, or other communications. We receive recipient names and email addresses from senders and information Recipients enter when completing documents.

Documents and signing information: We process uploaded PDF and Word files, packet contents, entered field values, typed or drawn signatures, electronic-consent records, completed documents, and related completion certificates and audit records. Senders, Recipients, and authorized account users supply this information.

Billing information: Stripe processes payments. We receive information needed to administer transactions, such as payment status, transaction references, subscription details, billing contact information, and payment-method summaries made available by Stripe. Payment details submitted directly to Stripe are also subject to Stripe's privacy practices. Do not send payment credentials in documents or support emails.

Login information: Our login system processes account authentication information. If you choose Google or Apple sign-in, we receive the account identifiers and profile information those providers disclose with your authorization, such as a name and email address. This may include an Apple relay email. Their services also operate under their own privacy policies.

Device and activity information: We collect technical information associated with use of the Service, including IP addresses, device/browser information, timestamps, and available events such as notification sending or delivery, link opening, document viewing, downloads, and submission. These records support security, operation, and packet audit history. Recorded events may be affected by email systems and automated scanners.

Public-website analytics: Google Analytics processes information about public-site visits, such as pages viewed, interactions, referring sources, browser/device details, cookie identifiers, and approximate location information derived from technical data. Analytics and advertising trackers are not placed on account or recipient document pages. Operational logging and packet activity tracking still occur there as described above.

3 How we use information

We use information to create and manage accounts and team access; prepare, transmit, display, sign, complete, and return documents; provide download links and completion records; process payments and credits; communicate about transactions and service changes; respond to support and privacy requests; maintain and troubleshoot the Service; detect misuse and protect security; understand public-site use; comply with law; and establish or defend legal claims.

We do not use customer document contents to train AI models, create datasets for outside use, sell document content, or supply deidentified document content for third-party use. The current Service does not provide AI document-processing features. We do not use personal information for solely automated decisions producing legal or similarly significant effects.

4 Who receives information

Senders and account users: A sender and authorized users in the Customer account can receive submitted documents, field values, signatures, completion certificates, and available Recipient activity information, including timestamps, IP addresses, and device/browser details. Account administrators control team access. Recipients should consider the sender's practices before submitting information.

Recipients and link holders: Intended Recipients receive access to the relevant packet, and Recipients receive a completed-document download link after all required Recipients finish. The completed document may contain other participants' information. Current signing links allow access and signing by anyone who possesses the link; we do not independently verify the original signer's identity. Protect links and do not forward them to unauthorized persons.

Service providers: We disclose information necessary for hosting and storage to Google Cloud; payment processing to Stripe; email delivery to Namecheap Private Email; optional sign-in to Google or Apple; and public-site analytics to Google Analytics. Providers process information needed for their functions under applicable arrangements. A provider's separate services and independently determined processing may be covered by its own privacy policy.

Legal and protective disclosures: We may disclose information when legally required or reasonably necessary to respond to valid legal process, protect rights or safety, investigate fraud or security incidents, or resolve disputes. We may disclose information to professional advisers bound by appropriate duties of confidentiality. If the business is transferred, information may be disclosed in connection with that transaction, subject to applicable law and continued privacy obligations.

We do not sell customer personal information or document information for money. Our current use of Google Analytics is for public-site measurement, not cross-context behavioral advertising. We do not provide document contents or signing activity to advertising networks. Service-provider disclosures and customer-directed document delivery still occur as described in this policy. Any future materially different advertising practice will require an updated notice and any legally required choices or consent before it begins.

5 Cookies and choices

Essential cookies or similar technologies support functions such as authentication, security, and preference storage. Google Analytics uses analytics technologies on the public website. Use the public website's cookie preferences to accept or reject optional analytics and change your choice later. Browser cookie controls may also be available; blocking essential technologies can affect functionality.

Google receives analytics data from our public website as described above. Learn about Google's processing at policies.google.com/technologies/partner-sites. We do not treat the older browser Do Not Track signal as an affirmative cookie preference; use our cookie controls. Where applicable law requires recognition of a valid opt-out preference signal, such as Global Privacy Control, we will give it the legally required effect. A preference signal does not disable the operational records necessary to deliver a packet or secure the Service.

6 Retention and deletion

Source documents and completed packets: We retain these until the Customer deletes them or closes the account, subject to lawful deletion requests and the exceptions below. We remove deleted files from active systems within 30 days of deletion or closure. Backup copies expire within 90 days of deletion or closure. Backups are retained for recovery and protection, not routine use; if restored, applicable deletions are reapplied.

Recipient and delivery history, completion certificates, and packet audit trails: We retain these while the account remains active and ordinarily remove them from active systems within 30 days after account closure. Requests to delete an individual record are assessed in light of the Customer's instructions, the integrity of completed transactions, and applicable rights and obligations. Backup expiration follows the 90-day schedule.

Security logs: We retain security logs for 12 months. Billing and tax records: We retain records needed for accounting, tax, and related compliance for seven years after the relevant transaction, unless a different period is legally required. Basic account and support information is kept as necessary to administer the relationship and resolve the relevant request, then deleted or deidentified unless a stated exception applies. Public-site analytics is retained only as reasonably needed for measurement and reporting, subject to configured provider retention controls and applicable deletion requests.

We may retain a limited amount of information longer when necessary to comply with law, preserve evidence under a legal hold, investigate an incident, resolve a dispute, prevent fraud, or document a privacy request. These exceptions are limited to the relevant information and purpose; they do not justify retaining all document contents indefinitely. When the need ends, ordinary deletion applies.

Canceling a subscription stops renewal and ends paid access at the end of the paid term; it is not by itself an account-deletion request. Request account closure or deletion at admin@docupacket.com. Export needed records before paid access ends. Copies previously downloaded or independently retained by senders, Recipients, or other authorized parties are outside our control.

7 Link expiration and completed copies

A signing link expires upon that Recipient's completion or at the sender's expiration deadline, whichever is earlier. The separate completed-document download link expires seven days after its completion email is sent. Recipients may request a replacement link at admin@docupacket.com after verification of access to the recipient email, while the document remains available and disclosure is authorized. This process does not retroactively verify the original signer. Link expiration and document deletion are different events.

8 Security and access to documents

Documents are encrypted on the server. Within DocuPacket, Tiffany Paden is the only administrator authorized to decrypt or view document contents, and access is limited to requested support, troubleshooting, security investigations, or legal obligations. This does not prevent the automated processing and provider involvement needed to operate the Service. We do not describe the Service as end-to-end encrypted or as preventing all administrator access.

No system can guarantee absolute security. Protect account credentials and document links and promptly report suspected misuse to admin@docupacket.com. We will provide legally required notices of a qualifying security incident. We do not currently claim HIPAA compliance or offer the Service for HIPAA-regulated PHI.

9 Privacy requests and state rights

You may contact us to request access to, correction of, or deletion of your personal information. Depending on your residence, the applicable law, and our role, you may also have rights to confirm processing, receive a portable copy, learn about disclosures, opt out of sale, targeted advertising, or certain profiling, or limit or consent to specified sensitive-information uses. These rights are subject to applicable scope rules and exceptions; this policy does not claim every state statute applies to every user or to DocuPacket at its current size.

Submit a request to admin@docupacket.com with the subject Privacy Request, or write to our mailing address. Describe your request and the account, recipient email, or transaction involved. Do not include passwords, full payment credentials, or unnecessary sensitive documents. We may ask for information reasonably needed to verify your authority and locate records. You do not need to create a new account. Authorized agents may act where permitted by law, subject to reasonable verification of authority.

Where Texas consumer rights apply, we will respond within 45 days, with one additional 45-day extension when permitted and explained within the initial period. Other applicable laws may require different deadlines, which we will follow. We generally respond without charge and will charge or decline repetitive or excessive requests only where permitted by law. We will not unlawfully discriminate or retaliate for exercising privacy rights.

If we deny a request, we will explain the reason and any available appeal process. To appeal, email admin@docupacket.com with the subject Privacy Appeal and explain the decision you dispute. Where Texas appeal rights apply, we will provide a written decision within 60 days. If denied, you may complain to the Texas Attorney General through www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint, or to another appropriate state regulator. Nothing in our Terms prevents a regulatory complaint.

For information contained in a Customer's packet, we may refer your request to the Customer or assist it in responding, unless we have an independent legal obligation to act. Deletion may be limited by another person's legal rights, transaction-record obligations, or legal holds. Contact the sender about its independent copies and practices.

10 Restricted information and children

The Service is for adults age 18 or older and organizations acting through adults. Do not submit personal information about children. We do not knowingly invite children to create accounts or submit information. If you believe a child has provided information, contact us so we can investigate and take appropriate action, including deletion where required.

Do not upload or enter medical or health information, PHI, Social Security numbers, government identification images or numbers, financial-account credentials, or children's personal information. Legal and employment documents must exclude these restricted categories. Report accidental submission promptly without repeating sensitive contents in an email. Future plans to support regulated information do not change these current restrictions.

11 United States operations and policy changes

The Service is offered for U.S. use. Information is processed in the United States and in locations used by our service providers as necessary to provide their services; this policy does not promise exclusive U.S. data residency. Provider arrangements and applicable law govern those activities.

We may update this policy prospectively. We will post the revised policy with its effective date and communicate material changes by email and/or prominent website notice. We will obtain additional consent where required before materially changing how previously collected information is used.

12 Contact

Privacy, support, and legal contact: admin@docupacket.com. Postal address: Tiffany Paden, doing business as DocuPacket, PO Box 265, Quinlan, Texas 75474. Website: www.docupacket.com.