Privacy Policy

1. Who we are

PolicyPen ("we", "us") provides a policy and procedure management platform for businesses. This policy explains what information we collect, why we collect it, and how we handle it — both for visitors to this website and for users of customer workspaces.

2. Information we collect

• Account and contact details — name, work email address, and company name, provided when you request a demo or are invited to a workspace.
• Workspace content — policies, procedures, attachments, approval decisions, and acknowledgment records created by your organization. This content belongs to your organization; we process it only to provide the service.
• Usage and security data — sign-in events, IP addresses, and audit-log entries, kept to secure the service and to provide your organization's compliance trail.
• Billing data — payment is processed by Stripe; we never store your card number.

3. Cookies and analytics

Our public marketing pages (the PolicyPen homepage and demo request pages) use Google Analytics and Google Ads conversion tracking to understand how visitors find the site and to measure our advertising. These services set cookies and collect usage data such as pages visited, approximate location, and device and browser information, which is shared with Google and handled under Google's privacy policy. We do not use analytics or advertising tracking inside customer workspaces or any signed-in portal. You can opt out through your browser's cookie settings or with Google's Analytics opt-out add-on.

4. How we use information

We use the information above to operate and secure the service, respond to demo requests, send transactional email (invitations, password resets, acknowledgment reminders), bill per-seat subscriptions, and meet our legal obligations. We do not sell personal information and we do not use customer workspace content for advertising or to train AI models.

5. Where data lives

Customer data is hosted on Microsoft Azure. Each customer's workspace data is stored in its own isolated database and storage container. Encryption is applied in transit (TLS) and at rest.

6. Sharing

We share data only with the subprocessors needed to run the service (Microsoft Azure for hosting, Stripe for payments, our email delivery provider for transactional mail), with Google for the marketing-site analytics described above, and where required by law. Subprocessors are bound by data-processing agreements.

7. Retention and deletion

Workspace data is retained while your organization's subscription is active. When a workspace is deprovisioned, its database and stored files are permanently deleted. Audit and billing records may be retained longer where the law requires it.

8. Your rights

Depending on your location, you may have the right to access, correct, export, or delete your personal information. Workspace users should direct requests to their organization's administrator (the data controller for workspace content); for anything else, contact us directly.

9. Contact

Questions about this policy or our data practices: privacy@policypen.com.