Privacy notice

Your account

Your name, email address and country, and a record of when you signed in and from which network address.

Your company

Its name, state and type, its members and their ownership, addresses, the file number and EIN once issued, and the facts on the EIN application, such as what the business does and a contact number.

Identity documents

We don't ask for one. Forming your company doesn't need a passport, so we don't collect one, and where a bank or an agency needs to see who you are, you give it to them directly. Any passport we collected before 19 September 2026 is deleted automatically 30 days after the company was filed.

Mail

Where you have a US mailing address with us, scans of the envelopes and contents of mail addressed to your company.

Payments

What you bought and when. You enter card details on Stripe’s pages, so they never reach our servers. We keep a reference to your Stripe customer record, not the card.

Bookkeeping

If you connect Mercury, Stripe or Wise, or upload a bank statement, the company's transactions and the categories they're given. The read-only keys you create for the feeds are stored encrypted.

Contractors

If you use the contractor register, your US contractors' names, addresses and tax identification numbers from the W-9 forms they fill in. Tax identification numbers are stored encrypted.

The assistant

The questions you ask the assistant in your dashboard, and its answers.

Messages

Support conversations and anything you email us.

Visits

Which pages are opened, the site that sent the visit, the country and city it came from, and the browser and kind of device. Vercel counts these for us without cookies and without tying them to your account. Before a visit is counted, we remove anything in the address that belongs to you, such as an invitation link or a referral code.

Where your visit came from

The link that brought your first visit: the campaign tags on it, the click identifier an advertising network added to it, the site that sent it and the page it landed on. Your browser keeps this in its own storage for 90 days, sends it nowhere, and it is written to your order if you place one, so we know which advertisement or link led to it.

We use your data to form and run your company. That means preparing and filing documents with the state, applying for your EIN with the IRS, checking who you are before we sign anything in your name, acting as your registered agent, receiving and scanning your mail, keeping your compliance calendar, and answering you when you write. We also use it to run the service itself: to sign you in, prevent abuse, take payment, fix errors, see which pages people read, and keep the records the law requires a filing agent to keep. We send you occasional product news only if you've switched it on.

Where data protection law asks for a legal basis, ours is the contract between us for the services, our legal obligations as a filing agent, and our legitimate interest in running a secure service. We send product news only with your consent.

Government agencies see what a filing needs: the Secretary of State of the state you chose, and the IRS for your EIN. The people on our team who work on your company see it, and so does anyone you invite to your company in the app, at the level of access you give them. So do the providers that run parts of the service for us, each under contract and only for that purpose:

• Stripe, for payments.
• Resend, for sending email.
• Vercel, which runs the site and counts page visits, and Neon, which hosts our database.
• Cloudflare, whose private storage holds your documents.
• Sentry, which records errors so we can fix them. It isn't sent your cookies or sign-in details.
• Meta, which is told when an order is started and when one is paid for, in the scrambled form described below the list, so we can tell which advertisement led to it.
• Google, if you sign in with Google or ask the assistant in your dashboard a question. The assistant sends your question and a short summary of your company, such as names, dates and deadlines, to Google's Gemini model. It never sends the contents of your documents or your bank transactions.
• Openprovider, which registers your domain in your company's name, if you have one with us.
• Twilio, if you have a US business phone number with us.
• A USPS-registered commercial mail receiving agency, for the US mailing address, where you have one.
• Banks we introduce you to, only when you ask us to make the introduction.

We don't sell personal data. When you start an order and when you pay for one, we tell Meta, so that we can see which of our advertisements led to it: a scrambled form of your email address and country that Meta can only match against its own records, and the network address and browser type the order was started from. It is not sent your name, your company or your card, and nothing is set in your browser for it. We'll disclose personal data if the law requires us to, and we'll tell you when we're allowed to.

The service runs on servers in the United States. Your data is encrypted while it travels and while it's stored. Documents sit in private storage with no public access. They leave it only through links issued to a signed-in member of your company, and those links expire within minutes. Bank feed keys and contractors' tax identification numbers are encrypted again on top of that. Every change to a company record goes into an audit log showing who made it and when, and you can ask us for that record.

We keep your data for as long as your company is with us. After that, we keep what the law requires a filing agent to keep about what it filed, which in most cases means several years. Any passport we collected in the past is deleted automatically 30 days after the company was filed, or 30 days after it was uploaded if that's later. Mail scans stay until you delete them or close the address. If you close your account, we remove everything we're not required to keep.

You can see and download what we hold about your company from your account at any time. You can ask us to correct anything that's wrong, give you a copy of your personal data, delete it where we're not required to keep it, or stop sending you product news, which you can also turn off in your settings. If you're in the United Kingdom or the European Economic Area, you have these rights under the GDPR, including the right to complain to your data protection authority. If you're in California, you have them under the CCPA. Email [email protected] and we'll answer within thirty days.

The only cookies we set are the ones that keep you signed in. They're set when you sign in, they aren't used to track you across other sites, and you're signed out after thirty days without a visit. We count page visits without cookies and use no advertising cookies, so there's no banner asking you to accept any.

If we change this notice in a way that affects you, we'll email you before it takes effect. The date at the top is always the date of the current version.