Privacy Policy

1. Introduction

At Sanket Bodhare, d/b/a DocuWright (“DocuWright,” “we,” “us,” or “our”), we value your privacy and take seriously our responsibility to safeguard the data you and your clients entrust to us. This Privacy Policy (the “Policy”) describes how we collect, store, access, and otherwise process information relating to identifiable individuals in connection with the DocuWright service at docuwright.com (the “Service”). In this Policy, “Personal Data” means any information that, on its own or combined with other available information, can identify an individual.

DocuWright is a document-automation subscription for solo and small law firms. We are committed to protecting privacy in accordance with applicable US state privacy laws, including the following, where they apply to you:

• California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) and California Online Privacy Protection Act (CalOPPA)
• Colorado Privacy Act (CPA)
• Utah Consumer Privacy Act (UCPA)
• Connecticut Data Privacy Act (CTDPA)
• Virginia Consumer Data Protection Act (VCDPA)
• Texas Data Privacy and Security Act (TDPSA)
• Oregon Consumer Privacy Act (OCPA)
• Montana Consumer Data Privacy Act
• Delaware Personal Data Privacy Act
• Nebraska Data Privacy Law
• New Hampshire Data Privacy Act
• New Jersey Data Privacy Act
• Minnesota Consumer Data Privacy Act
• Maryland Online Consumer Protection Act
• Kentucky Consumer Data Protection Act (KCDPA)
• Tennessee Information Protection Act (TIPA)
• Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)
• Indiana Consumer Data Protection Act (INCDPA)
• Iowa Consumer Data Protection Act (ICDPA)

This Policy applies when you create a DocuWright firm account, use the Service, upload documents, subscribe to a paid plan, receive communications from us, or when your clients complete an intake form you have shared with them. It does not apply to third-party websites or services that you may reach through links we provide; those are governed by their own privacy practices.

2. Personal Data We Collect

We collect only what we need to run the Service. Depending on how you use DocuWright, this includes:

• Account Information: your name, firm name, and email address, plus authentication data such as a hashed password and session records. If you sign in with Google, we receive basic profile and email information from Google to create and link your account.
• Subscription and Billing Information: your plan and subscription status, and billing records. Card payments are handled by our payment processor, Dodo Payments, as merchant of record. We do not receive or store full payment card numbers (see Section 6).
• Firm Content: the past documents you upload, the templates built from them, the intake answers your clients submit, and the documents generated from those answers. Firm Content is covered in detail in Section 3.
• Support and Communications: information you provide when you contact us for support, report a problem, or otherwise communicate with us.
• Device and Usage Data: limited technical information collected automatically when you use the Service, such as your IP address, login and authentication records, and timestamps, used to operate and secure the Service.

We do not solicit sensitive personal data about you, and we do not collect payment card numbers ourselves. Where sensitive information appears inside Firm Content, it is handled as described in Section 3.

3. How We Handle Your Documents and Client Data

This section is the heart of how DocuWright treats the information that matters most to a law firm. Please read it carefully.

• Firm Content belongs to the law firm.The past documents an attorney uploads, the templates built from them, and the intake answers a firm's clients submit (together, “Firm Content”) belong to the law firm.
• We act as a processor, not the owner.With respect to Firm Content, DocuWright acts as a data processor on behalf of the law firm, which is the controller. We process Firm Content solely to provide the Service: building that firm's templates and generating that firm's documents.
• We delete your uploaded document once the template is built. An uploaded document is needed only while we build your template from it. As soon as the build finishes we delete that file from our storage, and we delete it immediately if the build fails. In the rare case a deletion does not complete, the file stays tracked in your account so that deleting the template or your account removes it.
• We never train AI models on Firm Content.We do not use Firm Content, uploaded documents, or client intake data to train, fine-tune, or improve any AI models, and we do not sell or share it. To build your template, the document is sent to our AI subprocessor, Anthropic, solely to build that firm's own template. Anthropic does not use it to train AI models, and retains it for at most 30 days for safety and security purposes before deleting it. It may be kept longer only where the law requires that, or where something in it has been flagged for a trust-and-safety review.
• We remove verbatim client details when you approve a template. While a template is in review, we hold some text taken directly from your uploaded document, such as example values and quoted excerpts, so that you can check our work. When you approve the template, we remove those verbatim details from our database. What we keep is the approved template itself: your document's structure and wording with client-specific values replaced by fill-in fields. That is not the original client document, but it is derived from it and it preserves your language, including any literal text you chose to leave un-templated rather than turn into a field.
• What we do keep, and for how long. After a build we retain the approved template described above, the intake answers your clients submit, and the documents generated from those answers. We keep them so the Service works for you, and we keep them until you delete them. We do not keep the uploaded source document.
• The AI restructures; it does not author.The AI restructures the attorney's existing language into fill-in fields, conditional sections, and repeating sections. It does not generate, suggest, or invent legal content. If it cannot confidently map a section, it flags that section for attorney review rather than writing anything.
• Sensitive data inside Firm Content. Firm Content may incidentally contain sensitive personal data, for example health or financial details inside an estate-planning document. We do not solicit sensitive data. Where it appears in Firm Content, the law firm is responsible for having obtained any consents required by law, and we process it only to provide the Service.
• The firm stays in control. You can delete any individual template at any time, which also removes its intake links, the client submissions made through them, and the documents generated from them. You can also delete your entire firm account, which removes all of it. See Section 8.

4. How and Why We Use Personal Data

We process Personal Data to provide, maintain, secure, and improve the Service. Our purposes include:

• Creating and administering your firm account and authenticating your identity;
• Providing the core Service: building your templates and generating your documents from Firm Content;
• Processing your subscription and managing billing through our payment processor;
• Providing customer and technical support and communicating with you about the Service;
• Maintaining a safe and secure environment, and investigating and preventing security incidents, fraud, and abuse;
• Complying with our legal, tax, and accounting obligations.

Where we process Personal Data to deliver the Service to you, we do so because it is necessary to perform our agreement with you. Other processing is grounded in our legitimate interest in operating and protecting the Service, or in your consent where required by law.

5. Cookies and Analytics

We use only strictly-necessary and functional cookies. We do not use advertising or third-party tracking cookies, and we do not need a cookie consent banner. Specifically, we set:

• Session authentication cookies that keep you signed in and mark whether a session should persist beyond the current browser session;
• A transient OAuth state cookie used only during the Google sign-in redirect to protect that flow, and cleared when the flow completes;
• A preference cookie that remembers a dashboard nudge you have dismissed.

For usage measurement we use privacy-friendly, cookieless analytics (Vercel Web Analytics). It sets no cookies, stores nothing in your browser, does not track or fingerprint individuals across sites, and collects no personal data. We do not use Google Analytics or any cookie-based or third-party advertising analytics.

6. Subprocessors and Sharing

We do not sell your data or your clients' data. We share Personal Data only with the service providers (subprocessors) that are required to run the Service, and only for that purpose:

• Vercel: application hosting;
• Neon: PostgreSQL database (account records, intake answers, and references to your files);
• Cloudflare: file storage for uploaded and generated documents, and DNS;
• Anthropic: AI template building, used only to restructure your own text, and never to train models (see Section 3 for how long Anthropic retains it);
• Resend: transactional email;
• Google: optional sign-in, if you choose to use it;
• Dodo Payments: payment processing as merchant of record.

Dodo Payments is the merchant of record for your subscription and handles all card data. DocuWright never receives or stores full payment card numbers.

We may also disclose Personal Data where we are legally required to do so, for example to comply with a valid legal request, to enforce our agreements, or to protect the rights, safety, and property of DocuWright, our users, or others. Where it is lawful and practical to do so, we will tell you before such a disclosure.

7. International Data Transfer and Storage

We host on US-region infrastructure. Because we and our subprocessors may operate across borders, your Personal Data may be transferred to and maintained on servers located outside your state, province, or country, where data-protection laws may differ from those in your jurisdiction. We take appropriate steps to ensure your Personal Data is treated securely and in accordance with this Policy and applicable law.

8. Retention and Deletion

We retain Personal Data only for as long as necessary for the purpose for which it was collected and to the extent required by applicable law. When we no longer need Personal Data, we remove it from our systems or take steps to anonymize it.

Uploaded source documents are deleted as soon as the template is built, as described in Section 3, so they are not part of your firm's ongoing retention. Templates, client intake submissions, and generated documents are retained until you delete them. You can delete an individual template at any time, which also removes its intake links, submissions, and generated documents, or delete your entire firm account, which removes everything above. To ask us to delete your account and its data instead, email support@docuwright.com.

Deletion takes effect immediately in the live Service. Encrypted database backups, which exist so we can recover from an outage or a mistake, may still contain a copy for a short period until they age out on their normal schedule.

Even after account deletion, we retain the minimal records necessary for fraud prevention, tax, accounting, and legal compliance, as permitted by law. For example, we may keep a record that a particular email address or payment method previously used a free trial, so we can enforce our trial and anti-abuse rules.

9. How We Keep Your Data Safe

We maintain organizational and technical safeguards designed to protect Personal Data from accidental loss and from unauthorized access, use, alteration, or disclosure. The connection between your browser and the Service uses encryption wherever Personal Data is involved. We require the subprocessors that process Personal Data on our behalf to have appropriate security measures in place. In the event of a data breach, we will notify you and any applicable regulator when we are legally required to do so.

10. Children's Privacy

The Service is intended for use by law firms and their authorized users. We do not knowingly collect Personal Data from children under the age of 18.

11. Your Privacy Rights

Depending on your state of residence and the law that applies to you, you may have some or all of the following rights regarding your Personal Data. Note that many of these rights, when they concern Firm Content, are directed by the law firm as the controller of that data.

• Right to Access (CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA): you have the right to learn whether we are processing your Personal Data and to request a copy of the Personal Data we process about you.
• Right to Rectification (CPRA, CPA, VCDPA, CTDPA): you have the right to have incomplete or inaccurate Personal Data we process about you corrected.
• Right to Deletion (CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA): you have the right to request that we delete Personal Data we process about you, unless we need to retain it to comply with a legal obligation or to establish, exercise, or defend legal claims.
• Right to Opt Out (CPRA, CPA, VCDPA, CTDPA, UCPA): you have the right to opt out of the processing of your Personal Data for targeted advertising, the sale of Personal Data, or profiling with legal or similarly significant effects. We do not sell Personal Data, do not use it for targeted advertising, and do not conduct such profiling.
• Nondiscrimination (CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA): you have the right not to be denied service or given an altered experience for exercising your rights.
• Right to Appeal (CPA, VCDPA, CTDPA): where applicable, you have the right to appeal our decision on a rights request. If you disagree with the outcome of an appeal, you may contact your state attorney general.

If you have consented to a particular use of your Personal Data, you may withdraw that consent at any time. To exercise any of these rights, email us at support@docuwright.com. For your privacy and security, we may need to verify your identity before acting on a request.

12. Merger or Acquisition

If we are involved in a merger, acquisition, or sale of assets, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different privacy policy.

13. Changes to This Policy

We may update this Policy from time to time. When we make changes, we will post the updated version on this page and revise the “Last updated” date above. Material changes may also be communicated to account holders.

14. Contact Us

To request a copy of your information, ask that your data be deleted, exercise any of your privacy rights, or ask a question about your privacy, email us at support@docuwright.com. We handle all privacy requests by email; there is no separate form to fill out.