Privacy Policy

Effective date: November 11, 2026

This policy explains what personal information LetterGuard collects, how we use it, who we share it with, how long we keep it, and the choices you have. "LetterGuard", "we" and "us" mean LetterGuard, the company that runs letterguard.com and the LetterGuard platform.

1. Who this policy covers

• Website visitors: anyone who visits letterguard.com or requests a demo.
• Offices and their staff: professional offices that exchange sensitive documents with their clients and subscribe to LetterGuard (our customers), such as law, mortgage, title and escrow, accounting and tax, financial advisory, real estate, insurance and property management offices, and the staff who use LetterGuard.
• Clients: people an office invites to LetterGuard to send or receive files, exchange messages or sign documents.

2. Our role: when we decide, and when your office decides

• Office content belongs to the office. Client rooms, messages, files, signed documents and the office's activity records are the office's content. We process it on the office's behalf and follow its instructions. For this content we act as a "service provider" or "processor".
• Our own information. We decide how to use account and billing details, information from our website, demo requests, and marketing data. For this information we act as a "business" or "controller".
• If you're a client of an office, send requests about your files, messages or signed documents to that office. It controls that information. If you contact us, we'll refer you to the office and help it respond.

3. Information we collect

On our website

• Demo requests: your name, work email and office type. If you choose, also your phone number and a message.
• Technical information: Cloudflare hosts our website. To deliver and protect the site, it processes your IP address, browser and device details, and the pages you request.
• Bot check: the demo form uses Cloudflare Turnstile to block bots. It runs invisibly, so you won't see a check or need to do anything. Turnstile processes signals such as your IP address, browser (user-agent) details and connection characteristics. It may use cookies or similar browser storage that are strictly necessary for this check. See the Cloudflare Turnstile Privacy Addendum.
• Cookies and similar tools: see section 6.

On the LetterGuard platform

• Account and contact details: names, email addresses, phone numbers (if given), office name, role, and account settings for office staff and invited clients.
• Sign-in information: clients sign in with a one-time code we email them. Office staff also use two-factor authentication. We store sign-in codes and passwords in hashed form, never in plain text.
• Client rooms, messages and files: each client room, the messages in it, and the files uploaded to it, including file names and sizes.
• Document signing: the document, each signer's name, email and role, how they signed in, their consent to sign electronically, their typed or drawn signature, the times they viewed and signed, their IP address, approximate location and device, and the signed copy with its completion certificate.
• Activity records: who viewed, downloaded, uploaded, sent or signed something, and when. Each record includes the IP address, device and browser, and an approximate location (city and country) worked out from the IP address. We don't use GPS or ask your browser for your location. Only an office's administrators can see location, IP and device details.
• Security events: sign-ins, failed sign-ins and account changes, used to detect misuse.
• Billing details: for offices, the billing contact, plan, invoices and payment status. Our payment processor handles card details. We don't store full card numbers.
• Support: what you tell us when you contact us.

4. How we use information

• To run the platform: deliver files and messages, run document signing, keep activity records, and send email notices and sign-in codes.
• To scan uploads for malware, where the office's plan includes scanning (see section 8).
• To keep LetterGuard working and to detect and stop abuse, fraud and security threats.
• To provide support you ask for.
• To bill offices and keep business and tax records.
• To answer demo requests. When you request a demo, we send one confirmation email to the address you provide, through Postmark. It uses only your first name. We don't send marketing email to people who request a demo.
• To understand how our website is used, and, only if you allow it, to measure and target our ads (section 6).
• To follow the law, and to establish or defend legal claims.

We never use office content (files, messages, signed documents, or client details) for advertising, analytics, profiling, or to train AI models.

5. Email notices

• When something happens in a room, such as a new file or message, we email the people involved.
• Notices contain a link, not the message text or the file.
• Sign-in codes are sent by email and expire after 10 minutes.

6. Cookies, analytics and advertising

What our website uses. Our website uses only:

• cookies and storage that are strictly necessary, including what Turnstile needs; and
• performance and analytics cookies, only if you click Accept all. These are Google Analytics cookies (_ga and _ga_ followed by an ID). They tell us about pages viewed, time on the page, how you got here, your general location (city or country), and your browser and device type. If you click Reject all, or don't choose, Google Analytics doesn't load. Google signals and ad personalization are off. Google Analytics keeps this data for 2 months.

Advertising tools. Any advertising cookies and pixels we use, such as Google Ads and the Meta Pixel, to measure our ads and to show our ads to people who visited our website ("retargeting"):

• run on our marketing website only, and only after you agree to them through the cookie banner;
• are off by default, in a separate "Advertising" choice;
• never run on platform pages (where offices and clients sign in), and never receive office content.

Your choices

• Use the cookie banner, or the "Cookie settings" link at the bottom of each page, to accept, reject or change your choices at any time.
• Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as a request to opt out of the sale or sharing of your information and of targeted advertising, for that browser.
• Do Not Track: browsers don't apply Do Not Track in a standard way, so we don't respond to it. We honor GPC instead.

7. Who we share information with

Service providers. These companies process information for us under contract:

• Malware scanning runs on our own Google Cloud servers. Your files aren't sent to an outside scanning company.
• Approximate location comes from a location database we run ourselves. Your IP address isn't sent to the database's maker.
• Cloudflare also uses some Turnstile data to improve its bot detection, under its Turnstile Privacy Addendum.
• Google processes Google Analytics data for us. See how Google uses information from sites that use its services.

Your office. If you're a client, the office that invited you can see your messages, files, signed documents and activity in its rooms. Its administrators can also see your IP address, device and approximate location.

Advertising partners, only if you allow it. If we turn on advertising tools and you accept them, Google and Meta may receive identifiers such as cookie IDs and your IP address, plus information about your visits to our website. Under some state laws, including California's, this may count as "selling" or "sharing" personal information, or as "targeted advertising". You can opt out at any time (section 6). We never sell or share office content or client details.

Legal reasons. We may disclose information if the law requires it, or to establish or defend a legal claim involving LetterGuard. Where the law allows, we'll tell the office first and share only what's needed.

Business changes. If LetterGuard is sold or merged, information may transfer to the new owner under this policy.

We don't sell personal information for money.

8. Security

• Files are encrypted at rest, and LetterGuard staff don't personally access or review your files (other than automated security scanning, support you request, and where required by law).
• Staff access to production systems is limited to the people who need it, and it's logged.
• Malware scanning: included in Professional, and available as an upgrade on Essentials. Each file is scanned when it arrives. Files with malware are rejected and deleted as soon as they're detected, and the uploader is told why. Files over 2 GB are too large to scan. On Essentials without scanning, uploads aren't scanned and are labeled "Not scanned".
• On every plan, uploaded files always download, and never open in the browser. Program files and macro files are blocked.
• No system is perfect, and we can't promise that information will never be accessed without permission. If a breach affects your information, we'll notify you or your office as the law requires.

9. How long we keep information

Closing an account

• When an office's subscription ends, it has 14 days to export its files, messages and records. After that, we delete them, and they can't be recovered.
• If a subscription ends for non-payment, we give 7 days' notice first.
• If we end a subscription for our own reasons, we give 30 days' notice.
• Deleted data can stay in backups for up to 180 days before it's overwritten. We don't restore it except to recover from a system failure.

Downgrades: if an office moves to a plan with a smaller file-size limit, larger files it already stored stay available to download, but can't be replaced.

Legal duties: we may keep specific records longer only where the law requires it.

10. Exporting your data

• Office administrators can export everything at any time with one click: files, messages, signed documents and activity records.
• The only exceptions are files that scanning rejected as malware, which were never stored, and anything the law doesn't allow us to return.

11. Your privacy rights

Depending on where you live, you may have the right to:

• know what personal information we have about you and how we use it, and get a copy;
• correct inaccurate information;
• delete your information;
• get your information in a portable format;
• opt out of the sale or sharing of your information, targeted advertising, and certain profiling;
• limit the use of sensitive information (we use it only to provide the service);
• not be treated differently for using these rights.

These rights come from laws such as California's (CCPA/CPRA), and the laws of Colorado, Connecticut, Oregon, Texas, Virginia and other states.

How to make a request

• Email privacy@letterguard.com. To opt out of advertising, you can also use the cookie banner, the "Cookie settings" link or GPC.
• We'll confirm your request and reply within 30 days.
• We'll check your identity before sharing or deleting information, usually by email. We only ask for what we need.
• Authorized agents: someone can make a request for you if they show your signed permission. We may still check your identity with you directly.
• Clients of an office: for files, messages and signed documents in an office's rooms, contact that office (section 2). We'll help it respond.

Appeals. If we turn down your request, you can appeal by replying to our answer or emailing privacy@letterguard.com with "Appeal" in the subject. We'll reply within 60 days. If you're still not satisfied, you can contact your state attorney general.

12. Children

LetterGuard is for businesses and their clients. It isn't directed to children under 13, and we don't knowingly collect their information. We don't knowingly sell or share the information of anyone under 16.

13. Where information is stored

LetterGuard is run from the United States. The platform and its files are hosted in the United States. Cloudflare's network may handle website traffic in data centers near you, including outside the US. If you use LetterGuard from outside the US, your information is processed in the US.

14. Changes to this policy

If we change this policy, we'll update the effective date above. If a change is significant, we'll note it at the top of this page. We'll also tell office administrators by email before it takes effect.

15. Contact

privacy@letterguard.com. We reply within 30 days.

Back to top