1. Who this policy covers
This policy explains how Requestpack (“we”, “us”) handles personal information when you:
- visit requestpack.com;
- use Requestpack as a member of a firm (“you”); or
- receive a request or use an upload page from a firm that uses Requestpack (“clients”).
2. Our two roles
For firms’ accounts, we decide how information is used. This covers the details of the people at each firm who sign up and sign in, and billing.
For the documents and details firms collect, the firm decides. When a firm sends a request, the client’s name, email address, files and messages belong to the firm. We handle them only on the firm’s behalf and under its instructions, as set out in our Data Processing Addendum.
If you are a client of a firm, the firm is responsible for your information. Please contact the firm with any questions or requests. If you contact us instead, we’ll pass your request to the firm.
3. What we collect
From people at firms
- Account details: name, email address, your firm’s name, logo, color, phone number, reply-to email address and time zone, and your role at the firm.
- Sign-in details: passkeys (we keep only the public part), an authenticator app’s secret if you set one up, a password if you choose one (stored only as a one-way hash), and a record of sign-ins.
- Billing: your plan and payment history, and the card type and last four digits. Stripe holds the full card details.
- Messages: what you send us when you write to us.
Through requests and upload pages (on the firm’s behalf)
- Clients’ names and email addresses, as entered by the firm.
- The files clients send, the names of those files, and any notes added to them.
- What happens to each request: when it was sent, opened and completed, and when each file arrived and was accepted.
Automatically
- Technical details: IP address, browser and device type, and the pages and actions requested. We use these to run the Service, keep it secure and fix errors.
- Website visits: Cloudflare serves our website and keeps standard request logs (such as IP address, browser and the address requested) to deliver pages and block attacks.
- How the website and app are used: we use PostHog to see which pages people visit and what they click, so we can make Requestpack clearer. On the website this includes recordings of visits, with anything typed into a form hidden. In the app it covers the pages staff open and the buttons they use, never the text on the page, and never the pages a firm’s clients see. We don’t use any advertising tools.
4. How we use it
- To provide the Service: create accounts, send requests and reminders on a firm’s behalf, store and deliver files, and show each firm its own information.
- To send the emails the Service needs, such as sign-in codes, invitations and receipts.
- To keep the Service safe: check for bots, block throwaway email addresses at sign-up, limit repeated attempts, scan files for viruses and look into misuse.
- To bill firms and keep financial records.
- To answer questions and help when asked.
- To meet our legal obligations.
We don’t sell personal information. We don’t share it for advertising, we don’t use it to build profiles of people, and we don’t use Client Data to train artificial intelligence.
We only send emails needed to run your account. If we ever send news about Requestpack, every such email will have a way to stop them.
5. Cookies
The website and the app set one PostHog cookie, ph_…_posthog, to tell visits from the same browser apart (1 year). It isn’t used for advertising.
Apart from that, the app uses only the cookies it needs to work:
| Cookie | What it does | How long |
|---|---|---|
| Session | Keeps you signed in while you use the app | 2 hours of inactivity, or until you sign out |
| XSRF-TOKEN | Protects your forms from being sent by another site | As long as the session |
| rp_trusted_browser | Remembers a browser you chose to keep signed in | 30 days |
Our bot check (Cloudflare Turnstile) runs on the sign-up page and on firms’ upload pages. It looks at details of the browser to tell people from bots, and isn’t used for tracking or advertising.
We use no advertising cookies, so there is no cookie banner. Blocking the PostHog cookie in your browser doesn’t affect the Service.
6. Who we share it with
- The firm: a client’s information and files go to the firm that asked for them.
- Service providers: companies that host and run parts of the Service for us, such as storage, email delivery and payments. They may use the information only to provide their service to us. The full list is on our sub-processors page.
- When the law requires it: if we must respond to a valid legal request. Where we’re allowed to, we’ll tell the firm first.
- If Requestpack changes hands: information would pass to the new owner, who must keep to this policy. We’d tell firms before that happens.
7. Where it is kept
We store information in the United States. If you use Requestpack from outside the United States, your information will be transferred to and handled in the United States.
8. How long we keep it
- Account and Client Data: for as long as the firm’s account is open.
- Deleted requests and files: kept for 30 days so they can be restored, then deleted.
- After a firm cancels: everything is deleted 30 days after the plan ends.
- Trials that end without a plan: everything is deleted 30 days after the trial ends.
- Firms that never confirm their email: deleted 7 days after sign-up.
- Error logs: 90 days.
- Downloads prepared in Settings: deleted 7 days after they are ready.
- Billing records: kept as long as tax and accounting law requires.
Copies in encrypted backups are deleted as those backups expire.
9. How we protect it
Files and information are encrypted on the way and while stored, every file is checked for viruses, and each firm’s information is kept separate from every other firm’s. Our Security page explains this in more detail.
10. Your choices and rights
People at firms can see and correct most of their details in Settings, download their firm’s information from Settings, Your data, and close their account at any time.
You can also ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct it;
- delete it; or
- stop using it for a particular purpose.
Email [email protected]. We may need to confirm who you are first. We’ll reply within 30 days, and we won’t treat you differently for asking. Depending on where you live, you may also have the right to appeal our answer or to complain to your local data protection or consumer authority.
If you are a client of a firm, please send these requests to the firm. If they come to us, we’ll pass them on.
11. Children
Requestpack is for businesses and isn’t meant for anyone under 18. We don’t knowingly collect information from children for our own purposes.
12. Changes to this policy
If we change this policy in a way that matters, we’ll update the date at the top and email firm owners before the change takes effect.
Contact
Requestpack
30 North Gould Street, Sheridan, Wyoming 82801, United States
[email protected]