Privacy Policy

1. Introduction

Welcome to FreeDemandLetter ("we," "us," or "our"). We value your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you use our website and services (collectively, the "Service").

By accessing or using the Service, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of our Service.

2. Information We Collect

Personal Information You Provide

• Contact Information: When you choose to communicate with us, you may provide your name, email address, or phone number.
• Letter Details: You may provide specific information about your dispute or claim, such as parties involved, dates, owed amounts, and other details necessary to generate a demand letter. This information is treated as highly confidential and is subject to strict security measures.

Uploaded Documents

• Supporting Documents: You may upload PDF documents (such as contracts, agreements, or correspondence) to provide context for your demand letter. We extract text from these documents to improve the accuracy of your generated letter.
• No File Storage: Uploaded files are processed in memory only and are NOT stored on our servers. Once your letter is generated, the uploaded file is immediately discarded.
• Text Extraction: Only the extracted text content (up to 10,000 characters) is used during letter generation. This extracted text is not retained after your session ends.

Automatically Collected Information

• Usage Data: We may collect information such as your IP address, browser type, operating system, referring URLs, pages visited, time spent on pages, clicks, and other interactions with the Service. We collect this information to analyze trends, administer the site, track users' movements around the site, and gather demographic information.
• Cookies & Tracking: We use cookies, web beacons, and similar technologies to enhance your experience. We use session cookies (which expire when you close your browser) and persistent cookies (which remain on your computer for a longer period). We use cookies to remember your preferences and to track usage of the Service. You can disable cookies through your browser settings, but certain features of the Service may not function properly if you do so.

Third-Party Analytics

We use Google Analytics to help us understand how users engage with our Service. Google Analytics collects data such as how often users visit and which pages they view. We have enabled IP anonymization in Google Analytics. We retain data in Google Analytics for 26 months. You can opt-out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on, available here: Google Analytics Opt-out Browser Add-on. We have a Data Processing Agreement in place with Google.

Third-Party Service Providers

We use the following third-party services to operate and improve the Service. Each provider may receive certain data as described below:

• Third-Party AI Providers: When you generate a demand letter, the details you provide (including names, amounts, dispute information, and any uploaded document text) are transmitted to third-party AI service providers for processing. These providers use your data solely to generate your letter content and operate under their own privacy policies.
• Cloudflare (CDN & Turnstile): We use Cloudflare for content delivery, security, and bot protection (Turnstile). Cloudflare may collect your IP address, browser type, and device information to provide these services. See Cloudflare's Privacy Policy.
• Google Analytics: Collects anonymized IP addresses, pages visited, and user interactions for usage analytics. See the Third-Party Analytics section above for opt-out options.
• Google AdSense: Displays advertisements on our Service. Google may collect browsing data and use cookies to serve personalized ads. You can manage ad personalization at Google Ads Settings.
• Stripe: Processes voluntary donations only. Stripe collects payment and billing information directly. FreeDemandLetter does not have access to your credit card number. See Stripe's Privacy Policy.

Cookies and Similar Technologies

The following cookies and similar technologies are used on our Service:

• Session Cookies (express-session): Essential cookies that maintain your session state while using the Service. These expire when you close your browser.
• Google Analytics (_ga, _gid): Used to distinguish users and throttle request rates. _ga persists for 2 years; _gid expires after 24 hours.
• Cloudflare (__cf_bm, cf_clearance): Used for bot detection and security. These are necessary for the proper functioning of our bot protection systems.
• Cloudflare Turnstile: Used to verify that interactions come from real users, not bots. Sets temporary cookies during the verification process.
• Google AdSense: Sets various cookies to serve and personalize advertisements. You can manage these through Google Ads Settings.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service.

Do Not Track

Some browsers transmit "Do Not Track" (DNT) signals. We do not currently respond to DNT signals because there is no industry-standard technology for recognizing and implementing DNT signals. We will continue to monitor developments in DNT technology and update our practices if a standard is established.

3. How We Use Your Information

Provide and Improve the Service

• To generate your demand letter template based on the information you provide.
• To troubleshoot technical issues.
• To improve the accuracy and effectiveness of our AI algorithms.
• To personalize and improve our Service's functionality and performance.

Communicate With You

• To respond to your inquiries, comments, and requests.
• To respond to your requests for support.
• To send administrative information (e.g., changes to terms, policies).

Analytics and Research

• To analyze usage trends in an aggregated and anonymized manner to improve our Service and develop new features.

Legal Compliance

• To comply with New York and other applicable laws, regulations, or legal processes.
• To protect the rights, property or safety of FreeDemandLetter, our users, or others.

We do not sell your personal information to third parties. We may share information with service providers who assist in operating our Service (e.g., hosting, analytics) under strict confidentiality agreements.

4. Data Security

We employ reasonable measures designed to protect your data from unauthorized access, alteration, disclosure, or destruction, including but not limited to:

• Encryption: Sensitive data, including the information you provide to generate your demand letter, is encrypted in transit using HTTPS/SSL (TLS 1.2 or higher). We encrypt data at rest using AES-256 encryption.
• Access Controls: We maintain strict access controls to personal data, limiting access to personnel who need it for legitimate operational purposes.
• Security Assessments: We conduct periodic reviews of our security systems to identify and mitigate vulnerabilities.
• File Processing: Uploaded documents are processed entirely in memory (RAM) and are never written to permanent storage. Files are automatically discarded after processing.
• Data Breach Notification: In the event of a data breach, we will take reasonable steps to notify affected users and relevant authorities, as required by applicable law.

No method of transmission or electronic storage is completely secure, but we strive to protect your personal information as thoroughly as possible.

5. Data Retention

We retain your information only for as long as necessary to fulfill the purposes described in this Privacy Policy, or to comply with legal obligations. Specifically, we retain the information you provide to generate your demand letter for 30 days after the letter is generated, after which it is securely deleted. We retain aggregated and anonymized usage data indefinitely. We retain this information to allow you to access and modify your generated letter within a reasonable timeframe while ensuring your data is not stored longer than necessary.

Uploaded Documents: Uploaded documents (PDFs) are NOT retained. They are processed in memory only and discarded immediately after text extraction. No copies of your uploaded files are stored on our servers.

6. Your Rights

All data requests must be submitted via [email protected]

Depending on your jurisdiction, you may have certain rights regarding your personal data, such as:

• Access: You have the right to request a copy of the personal information we hold about you.
• Correction: You have the right to request that we correct inaccurate or incomplete data.
• Deletion: You have the right to request that we delete your personal information, subject to legal exemptions (e.g., we may need to retain some information for legal compliance).
• Opt-Out: You can unsubscribe from any marketing communications (we don't currently send marketing communications, but include this for future-proofing).
• Data Portability: In some jurisdictions, you have the right to request a copy of your data in a structured, commonly used format.
• Object to Processing: You may have the right to object to the processing of your personal data, under certain circumstances.
• Restrict Processing: You may have the right to request that we restrict the processing of your personal data, under certain circumstances.
• Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority.

To exercise these rights, contact us at [email protected]. We will respond within a reasonable timeframe (and in accordance with any applicable legal requirements, such as within 30 days under GDPR). We may need to verify your identity before fulfilling your request.

7. Children's Privacy

Our Service is not intended for individuals under 13 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately so we can remove it.

8. GDPR (European Users)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following additional provisions apply to you under the General Data Protection Regulation (GDPR).

Data Controller

FreeDemandLetter is the data controller for the personal data collected through the Service. You can contact us at [email protected] for any data protection inquiries.

Lawful Basis for Processing

We process your personal data on the following legal bases:

• Consent: When you voluntarily provide information to generate a demand letter or upload documents, you consent to the processing of that data for the stated purpose.
• Legitimate Interest: We process certain data (such as usage analytics and security logs) based on our legitimate interest in maintaining, improving, and securing the Service, provided these interests are not overridden by your rights.
• Legal Obligation: We may process data when required to comply with applicable laws and regulations.

Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data, subject to legal retention obligations.
• Right to Restriction: Request that we limit how we process your data in certain circumstances.
• Right to Data Portability: Receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: Object to processing based on legitimate interests, including for direct marketing purposes.
• Right to Withdraw Consent: Withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right to Lodge a Complaint: Lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days as required by GDPR.

International Data Transfers

Our Service is operated from the United States. If you access the Service from the EEA, UK, or Switzerland, your data will be transferred to the United States. We rely on appropriate safeguards for such transfers, including standard contractual clauses where applicable. By using the Service, you acknowledge this transfer.

9. CCPA (California Users)

If you are a California resident, the following additional provisions apply to you under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

Categories of Personal Information Collected

In the preceding 12 months, we may have collected the following categories of personal information:

• Identifiers: Name, email address, IP address.
• Internet or Network Activity: Browsing history on our Service, search history, interactions with our website.
• Professional or Employment-Related Information: Information you provide in your demand letter details (e.g., employer name for wage disputes).

Sources of Personal Information

We collect personal information directly from you when you use the Service, and automatically through cookies and analytics tools as described in Section 2.

Business Purpose for Collection

We collect personal information to provide the Service (generating demand letters), improve our Service, ensure security, and comply with legal obligations.

Your Rights Under CCPA

• Right to Know: You have the right to request the categories and specific pieces of personal information we have collected about you, the sources from which it was collected, the business purpose for collection, and the categories of third parties with whom it was shared.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell your personal information. If this changes, we will provide a conspicuous opt-out mechanism.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

How to Submit a Request

To submit a verifiable consumer request, contact us at [email protected]. We may need to verify your identity before processing your request. We will respond within 45 days as required by CCPA.

10. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. The "Last Updated" date at the top indicates the latest revision. Your continued use of the Service after any changes constitute your acceptance of the revised policy. We will notify you of any material changes to this Privacy Policy as required by law.

11. Contact Us

If you have any questions or concerns about this Privacy Policy, please reach out to us at: [email protected]