Privacy Policy

What we collect

Account data: your email address and name (from Google sign-in or the email you provide). Document data: the answers you enter and the documents generated from them. Signing data: for e-signatures we record signer name, email, signature image or typed name, consent, timestamp, IP address, and device string — this audit trail is a legal feature of the executed document. Usage data: aggregate counters (documents created, exports) used to operate the service. We do not run third-party ad trackers.

How we use it

To provide the service: generating documents, sending sign-in links and signature invitations by email and exporting files. AI features send the relevant document text or uploaded images to our configured AI provider, currently OpenAI, to produce the review, reconstruction, or suggestion you requested. Provider terms and retention policies apply to that processing. We do not train our own models on your documents or sell personal information.

Optional template contributions

Your regular uploads are not automatically reused to build our template library. After an import, you may separately share a general suggestion or a short excerpt you have permission to share. You choose and review the exact title, state and text, remove personal and confidential details, and explicitly consent. The contact-detail removal helper is incomplete and does not guarantee anonymity.

We store the submission, its import reference, your account reference, consent version and time, and review status in a private administrator queue. We do not copy your original file into that queue, send contributions to AI providers, train models on them, or publish the submitted wording. Administrators may research general ideas to improve our independently authored templates.

Submissions expire after 90 days, including those shortlisted for research. You can view and withdraw them in Account; withdrawal removes the active submission and stops further use. General ideas already incorporated into templates may remain. Account exports include active contributions, and account closure removes them. Database recovery backups may retain earlier copies for up to 35 days; administrative action metadata follows the audit retention below. Physical expiration is asynchronous, but expired resources are hidden immediately.

Where it lives

Account records and document text are stored in Amazon DynamoDB; original imports, signature images, attachments and preserved signed PDFs are stored privately in Amazon S3. These AWS resources are in the United States, with the application served through Vercel. Transactional email is sent through Plume, the OODAC mail service (mail.oodac.com), via Amazon SES. All traffic is encrypted in transit (TLS).

Sharing

Documents are private to your account except when you create a share link, send a signature request, or export a file. Anyone with a share or signing link may access the linked content; recipients can forward links or retain exported and emailed copies. Signing records include signer names, email addresses, timestamps and IP addresses; device details may also appear when the sender enables them. Service providers (AWS, Vercel, Stripe, our configured AI provider, and Cloudflare) process data under their respective agreements. We disclose data to authorities only when legally required.

Retention & deletion

Your documents stay until you delete them. Deletion disables access through Quill and queues associated files for cleanup. Database recovery backups can retain earlier copies for up to 35 days. Minimal payment, credit and security records may remain for accounting, dispute handling and abuse prevention. Request account deletion from the Account page or email quill@oodac.com. Other parties may retain copies that you shared or emailed; deleting from Quill cannot recall them.

Unused import sources are scheduled for deletion after seven days. Sources linked to a saved document remain with that document. Deleted document files enter cleanup after a 24-hour delay; the worker removes stored versions as well as the current file. Completed email operations and AI call metadata are scheduled to expire after 90 days. Support requests and incidents remain while open; resolved cases, written feedback and administrative audit records are scheduled to expire after one year. Per-account cost totals remain for up to 400 days. Pending operations remain until processed, and provider systems may have separate retention periods. Cleanup is asynchronous and may take longer during a service outage.

Your rights

You can access, correct, export, or delete your data at any time (in-product or by email). California and EU/EEA/UK residents have additional statutory rights — contact us to exercise them. We do not discriminate for exercising privacy rights.

Children

Quill is not directed at children under 13 and we do not knowingly collect their data.

Contact

Privacy questions: quill@oodac.com. We will update this page (with a new effective date) if our practices change.