Not ready to publish — placeholders remain

This document still contains unfilled values (shown in square brackets) in src/lib/legal-config.ts. Fill in the operator name, contact address, governing law and contact email addresses, then have the text reviewed by a qualified lawyer before relying on it.

Privacy Policy

Pacts records who accepted which terms, when, and from where. That means we handle personal data about two different groups of people, under two different roles. This page explains exactly what we hold and why.

Version 1.0 · Last updated 28 July 2026

1.Who we are

Pacts is operated by [YOUR FULL LEGAL NAME], [e.g. a sole trader established in Spain](“we”, “us”). You can reach us about anything on this page at [privacy@pacts.io], or by post at [POSTAL ADDRESS FOR LEGAL CORRESPONDENCE].

2.Two roles, and why the difference matters

We handle personal data in two distinct capacities, and your rights differ depending on which applies to you.

As a controller, for the account data of our own customers — the people who sign up to send terms. We decide what to collect and why. This policy governs that data.
As a processor, for data about recipients — the people our customers ask to accept terms. We only hold that data because a customer put it there and instructed us to. That customer is the controller, and their own privacy notice governs it. Our obligations to them are set out in our Data Processing Addendum.

If you received a link asking you to accept terms and want your data corrected or removed, contact the organisation that sent it to you — they control that record. If you contact us directly, we will pass the request to them and support them in answering it, but we cannot act on their data on our own initiative.

3.What we collect

We collect the least we can while still producing a record that stands up as evidence. We do not buy data, we do not enrich profiles, and we run no advertising or analytics trackers of any kind.

Data	Who it concerns	Why we hold it
Email address and password	Customers	Authenticating your account. Passwords are handled by Firebase Authentication and are never visible to us.
Your name and workspace name	Customers	Identifying you in the app and on the terms your recipients see.
Logo URL and accent colour	Customers	Optional branding on your public acceptance pages.
Contact name and email address	Recipients	Addressing terms to a specific named person and sending them their personal link. Entered by our customer, not by us.
IP address and browser user-agent	Recipients	Captured at the moment of acceptance. This is the evidentiary core of the product: it is what allows an acceptance to be attributed to a particular session rather than merely asserted.
Acceptance timestamp, terms version, and content hash	Recipients	Proving which exact version of a document was accepted, and that its content has not been altered since.
One-time verification codes	Recipients	Optional email verification before acceptance. Codes are stored only as a cryptographic hash, are single-use, and expire after 10 minutes.
IP address, briefly	Everyone	Rate limiting, to stop automated abuse of the public acceptance and sign-in endpoints. These counters expire automatically.

4.Legal bases

Where the UK GDPR or EU GDPR applies, we rely on the following bases for the data we control:

Performance of a contract — operating your account and providing the service you signed up for.
Legitimate interests — keeping the service secure, preventing abuse, and maintaining the integrity of acceptance records. We consider these interests to be balanced against your rights because the data involved is minimal and directly necessary to the purpose.
Legal obligation — where we must retain information to comply with the law.

For recipient data, the legal basis is determined by our customer as controller, not by us.

5.How long we keep things

Account data is kept for as long as your account is open, and deleted within 90 days of closure unless we are required to keep it longer.

Acceptance records are permanent and cannot be edited. There is no code path anywhere in Pacts that modifies or deletes one — this is a deliberate design property, not an oversight, and it is the entire reason the records are worth anything as evidence. A record that could be quietly changed afterwards would prove nothing.

This limits the right to erasure in a specific way. Where a record is needed for the establishment, exercise or defence of legal claims, erasure does not apply (UK/EU GDPR Article 17(3)(e)). An acceptance record exists precisely to evidence that a legal act took place, so we will normally decline to delete one — including at the request of the customer who created it. We can, however, delete the surrounding contact record, which stops any further contact and removes that person from the customer’s workspace.

One-time verification codes expire after 10 minutes and are deleted automatically. Rate-limiting counters expire shortly after their window closes.

6.Who else processes this data

We use a small number of sub-processors. We do not sell personal data, and we do not share it with anyone for their own purposes.

Provider	What they do	Where
Google Cloud / Firebase	Application hosting, authentication, and the Firestore database where all records are stored.	United States (us-central1)
Resend	Delivery of transactional email: acceptance links, reminders, one-time verification codes, and notifications.	United States

Our infrastructure runs in the United States. If you are in the UK, EEA or Switzerland, that means your data is transferred outside your home jurisdiction. These transfers rely on the Standard Contractual Clauses adopted by the European Commission, together with the providers’ own transfer frameworks.

7.Cookies

Pacts sets two cookies, both strictly necessary and both used only to keep you signed in:

accord_session — the session for a customer signed in to the app.
pacts_contact — the session for a recipient using an optional partner account.

Both are HTTP-only, sent only over HTTPS in production, and expire after 14 days. We set no advertising, analytics or tracking cookies, which is why you are not asked to consent to any. Fonts are served from our own domain, so viewing a page does not call out to a third party.

8.Security

No client application can read or write our database directly; every access goes through our servers. Acceptance metadata is captured server-side specifically so that a recipient cannot influence it. Verification codes are stored hashed and never in plain text. Pages carrying a personal link are excluded from search engines, cannot be embedded in a frame, and do not leak their address to sites they link to.

No system is perfectly secure. If you believe you have found a vulnerability, please write to [support@pacts.io] and we will respond.

9.Your rights

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to object to it. To exercise any of these, write to [privacy@pacts.io]. We will respond within one month.

If you are unhappy with our response you may complain to your local data protection authority. If you are in California, we do not sell or share personal information as those terms are defined by the CCPA, and we do not discriminate against anyone for exercising their rights.

10.Children

Pacts is a business tool and is not directed at anyone under 16. We do not knowingly collect their data; if we learn that we have, we will delete it.

11.Changes

If we make a material change we will update the version and date at the top of this page and notify account holders by email before it takes effect.

Pacts is not a law firm and does not provide legal advice. These documents describe how the service operates; they are not advice about your own obligations.