Privacy Notice

1. Who controls your data

SMITHCONSULTINGGROUP LLC operates Independent Contract Express and is the data controller for personal data we process to provide the service. Paddle acts as Merchant of Record and processes transaction information under its own Privacy Policy.

2. Data we collect and why

• Account information: name, email address, authentication credentials and sign-in provider identifiers, to create and secure your profile and authenticate access. Basis: contract performance and legitimate interests in security.
• Contract and signature information: party names, companies, contact details you enter, dates, transaction amounts, clauses, signature images, signing timestamps and share-link identifiers, to prepare, store, share and sign documents. Basis: contract performance; legitimate interests in delivering documents to invited parties and maintaining signing records.
• AI review information: contract text you submit and the generated review, to identify missing details and potential inconsistencies. Submitted text is transmitted to the AI service through Lovable AI Gateway when you request a check. Basis: contract performance. Only submit information you have authority to share.
• Notary booking information: contact and booking details, requested times, notes and related document references, to coordinate a notary appointment. Basis: contract performance.
• Purchase and subscription records: order identifiers, purchased products, payment status, subscription status and billing period information received from Paddle, to manage access, billing support and records. Basis: contract performance and legal obligations. Card payment details are handled by Paddle, not collected in our contract forms.
• Technical and support information: device/browser information, IP addresses, diagnostic or usage logs and messages you send when requesting help, to operate the service, troubleshoot problems, improve reliability and prevent fraud. Basis: legitimate interests and, where required, consent for optional tracking.

3. Who receives data

We share only information needed for the relevant purpose with hosting, authentication, storage, diagnostic, AI and support service providers, including Lovable Cloud and Lovable AI Gateway. Google receives sign-in information if you choose Google sign-in. Paddle receives information for product sales, subscription management, payments, tax compliance and invoicing.

Contract information is disclosed to people who receive your share link. Treat the link as confidential. Notary booking details and relevant documents may be shared with the assigned notary and the meeting provider, such as Zoom, when an appointment is arranged. We may also disclose data to legal or accounting advisers and to authorities when required by law. We do not sell personal data.

4. Retention

Account data and saved contracts are retained while needed to provide your account and document library. Booking and support information is kept while needed to fulfill requests and resolve issues. Billing records are retained for applicable tax, accounting and other legal requirements. We may retain necessary records to establish or defend legal claims and prevent fraud. Data is deleted or anonymized when no longer needed; backups may remain for a limited operational recovery period. You may request deletion, subject to legal requirements and the rights of other parties.

5. Security

We use appropriate technical and organizational measures, including encrypted connections, authentication and access controls, to protect personal data. No system is completely secure. Protect your account credentials and share links, and keep independent copies of important contracts.

6. Cookies and browser storage

The service uses essential browser storage and authentication-related technologies to maintain sign-in and operate checkout. Paddle and your chosen sign-in provider may use cookies under their own policies. You can clear or block cookies and site storage through your browser settings, although doing so may prevent sign-in or checkout from working.

We do not currently use optional analytics or marketing cookies in the app. If these are introduced, we will provide any required notice and consent controls before using them. Operational diagnostic logs are used for service reliability and security.

7. International transfers

Our service providers may process information in countries outside your country of residence, including outside the UK or EEA. Where applicable law requires transfer safeguards, transfers must use an appropriate legal mechanism, such as an adequacy decision or standard contractual clauses, with supplementary measures where needed.

8. Your privacy rights and requests

Depending on the law applicable to you, you may request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests and withdraw consent without affecting earlier lawful processing. UK and EEA users may complain to their supervisory authority; we respond to GDPR rights requests within one month, subject to lawful extensions. Other jurisdictions may provide additional rights, which we will honor where applicable.

Direct requests to SMITHCONSULTINGGROUP LLC using the seller contact details associated with your purchase. If you cannot locate those details, Paddle support can help identify the seller. Paddle handles requests concerning its own transaction data under its privacy policy. We may need to verify your identity before releasing or deleting data.

9. Changes

We may update this notice as the service or legal requirements change. The effective date appears above. Material changes will be communicated through the service or available account contact details.