Privacy Policy
Your agreements and your personal information deserve care. This policy explains what we collect and why, who we share it with, how long we keep it, and the rights you have. We do not sell your personal information, and we never will.
1. Who we are and whom this policy covers
Pactlo is a product of MRD Studio, Inc. (“Pactlo”, “we”, “us”), 67 Olmsted Rd Unit 102, Stanford, CA 94305, USA. This policy covers personal information about visitors to pactlo.com, people who create a Pactlo account (“Senders”), and people who receive an agreement through Pactlo (“Signers”).
Our two roles. We decide how and why we process information about our account holders, website visitors, billing, security, and the evidence records that make signatures trustworthy. For those purposes we are the business (or “controller”) responsible for that information. When a Sender uploads a document and enters information about the people they send it to, we process the content of that agreement on the Sender’s behalf and under their instructions, as their service provider (or “processor”). If you are a Signer and have questions about why a Sender has your information, please contact the Sender as well.
2. What we collect and why
We collect only what we need to run Pactlo.
Account information
Your name, email address, business name, and settings. Pactlo does not use passwords: you sign in with a one-time code sent to your email, a passkey on your device, or your Google, Microsoft or Apple account. We use this information to create and secure your account, provide the Services, and contact you about your account.
Sign-in with Google, Microsoft or Apple
If you choose to sign in with Google, Microsoft or Apple, we receive your name, email address and, if available, your profile picture from that provider. We use them only to sign you in, create your account and show your name and picture in Pactlo. We do not receive your password for that account, and we do not access your email, contacts, files or any other data in it. If you use Apple’s “Hide My Email”, we receive a private relay address and send account emails to it.
Pactlo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Agreements and documents
Documents you upload or create, the information you fill in, line items, attachments, and the agreements you send or receive. We use them to provide the Services: preparing, sending, signing, sealing and storing agreements.
Signer and signature information
For each Signer: name, email address, mobile phone number, the result of email or phone verification, the signature image or typed name, the time of each step, IP address, browser and device information, and which version of the document and summary was shown. We use this to deliver the agreement, verify the Signer, and create the audit trail and completion certificate that make the signature trustworthy for both parties.
Payment information
Card and bank details are entered directly into forms provided by our payment processor, Stripe, and do not reach our servers. We keep records of transactions (amount, date, status, the last four digits of a card) for receipts, support and accounting. If you collect payments as a Sender, Stripe collects information about you and your business to verify your identity and pay you.
When you provide personal data in connection with Pactlo, Stripe receives that personal data and processes it in accordance with the Stripe Privacy Policy.
Messages and correspondence
Records of the emails and text messages we send for you (recipient, template, time, delivery status), and emails you send to our support team.
Website and technical information
Server logs with IP address, browser type, pages requested and timestamps, used for security, fraud prevention and keeping the Services running. We use only cookies that are necessary to keep you signed in and to secure the Services. We do not use advertising cookies or third-party trackers on pactlo.com. If that changes, we will update this policy first.
Identity verification
Pactlo does not currently offer ID-document or selfie verification and does not collect biometric information. Before we add such a feature, we will update this policy.
3. AI processing
Pactlo uses AI models to detect fields in documents, write plain-language summaries, and explain agreements you upload. To do this, the relevant document text is sent to our AI providers (listed on our Subprocessors page). They process it in the United States to return a result to us and do not use it to train their models. They may keep it for a limited time (up to 30 days) for safety and abuse monitoring, and then delete it. We do not use your documents or agreements to train AI models.
4. When we share information
- With the other party to your agreement. Senders and Signers can see each other’s names, contact details used for the agreement, and the audit trail and completion certificate for that agreement.
- With our service providers. We use a small number of companies to host, store, send messages, process payments and run AI features. They process information only on our instructions. See the list on our Subprocessors page.
- When the law requires it. We disclose information if compelled by a valid legal process, such as a subpoena, court order or search warrant, or in an emergency involving risk of death or serious injury. Where permitted, we notify affected users first.
- To protect Pactlo and our users. We may use and disclose information to investigate fraud, abuse or violations of our Terms.
- If our company changes hands. If MRD Studio, Inc. is involved in a merger, acquisition or sale of assets, we will notify you before your information becomes subject to a different privacy policy.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
5. Text messages and mobile information
We use your mobile number only to send you messages about agreements you are part of: verification codes, signing links, reminders until an agreement is signed or paid, and receipts. See our SMS Terms.
- No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.
- Opt-in data and consent will not be shared with third parties.
- SMS collected information is not shared with third parties or associates.
- The sharing described elsewhere in this policy excludes text messaging originator opt-in data and consent; this information will not be shared with any third parties.
Our messaging provider delivers the messages for us and is not permitted to use your number for any other purpose. Reply STOP to any Pactlo text message to opt out.
6. How long we keep information
| Information | How long |
|---|---|
| Sealed agreements, audit trails and completion certificates | 7 years after the agreement is completed, so both parties can rely on them, unless the law requires longer |
| Account information and unsent content (drafts, templates, uploads) | While your account is open; deleted from active systems within 30 days and from backups within 60 days after you close your account |
| Billing and transaction records | 7 years, to meet tax and accounting obligations |
| Message delivery records | As long as the related agreement record, or 2 years for messages not tied to a completed agreement |
| Security and server logs | Up to 12 months |
| Support correspondence | Up to 3 years after the conversation ends |
7. How we protect information
We encrypt data in transit with TLS, use providers that encrypt data at rest, restrict access to the people who need it, require multi-factor authentication for administrative access, and keep tamper-evident audit records. No system is perfectly secure, but we work to protect your information and will notify affected users of a breach as required by law. More on our Security page.
8. Your rights and choices
We apply the same privacy rights to everyone, wherever you live. You can ask us to:
- know and access the personal information we hold about you and how we use and share it;
- correct inaccurate information;
- delete your information, subject to legal limits (for example, we keep sealed agreements for the period in section 6 because both parties rely on them);
- receive a copy of your information in a portable format; and
- opt out of the sale or sharing of personal information. We do not sell or share it, so there is nothing to opt out of, but we treat Global Privacy Control signals as a valid opt-out request.
To make a request, email privacy@pactlo.com. Account holders can also update and export much of their information in the product. We will verify your identity before acting, usually by confirming your email address or phone number. You may use an authorized agent with your written permission. If we deny your request, you can appeal by replying to our decision, and you may contact your state attorney general or data protection authority. We will not discriminate against you for exercising these rights.
Do Not Track. We do not track you across third-party websites, and we do not allow third parties to track you on pactlo.com. Because there is no common standard for Do Not Track browser signals, we do not respond to them differently.
California residents. In the past 12 months we have collected the categories of personal information described in section 2 (identifiers, commercial information, internet or network activity, and electronic records of agreements), from you, from Senders who send you agreements, and from our service providers, for the purposes in sections 2 and 3. We disclosed them only as described in section 4. We have not sold or shared personal information.
9. Where information is stored and accessed
Pactlo is a U.S. service. We store information in data centers in the United States. Some members of our team work remotely from Turkey and may access information from there to operate and support the Services, using access controls and multi-factor authentication. Pactlo is not directed at people in the European Union or the United Kingdom. If you use Pactlo from outside the United States, your information will be transferred to, stored and processed in the United States.
10. Children
Pactlo is intended for people aged 18 and over. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.
11. Changes and contact
We may update this policy. If we make a material change, we will update the date at the top of this page and notify account holders before it takes effect.
Questions or requests: privacy@pactlo.com, or MRD Studio, Inc., 67 Olmsted Rd Unit 102, Stanford, CA 94305, USA.
Parts of this policy are adapted from the 37signals policies, used under the Creative Commons Attribution 4.0 license. We changed and added to the original text.