Privacy Policy

At DocJacket, accessible from www.docjacket.com, one of our main priorities is the privacy of our visitors. This Privacy Policy document contains types of information that is collected and recorded by DocJacket and how we use it.

If you have additional questions or require more information about our Privacy Policy, do not hesitate to contact us at privacy@docjacket.com.

This Privacy Policy applies to DocJacket's website, web application, mobile applications (iOS and Android), APIs, integrations, and related services, collectively referred to as the “Services.” It governs the information we collect whether you access the Services through a web browser, a mobile app, or a connected integration.

Consent

By using our Services, you hereby consent to our Privacy Policy and agree to its terms.

Information we collect

The personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information.

If you contact us directly, we may receive additional information about you such as your name, email address, phone number, the contents of the message and/or attachments you may send us, and any other information you may choose to provide.

When you register for an Account, we may ask for your contact information, including items such as name, company name, address, email address, and telephone number.

Categories of information we collect

Depending on how you use the Services, we may collect the following categories of information:

• Account information: name, company or brokerage name, address, email address, phone number, role, and login credentials (including sign-in through connected OAuth providers).
• Transaction data and uploaded documents: real estate contracts, disclosures, and other documents you upload, along with the data extracted from them (property details, parties, dates, financial terms, signatures, and related transaction records).
• Camera, photo library, and file access: when you use the mobile apps to add documents, and only with your permission, we access your device camera, photo library, or files to let you capture or upload documents. We access only the specific photos or files you choose.
• Push-notification tokens: device push tokens used to deliver transaction reminders and alerts, when you enable notifications.
• Device identifiers, crash reports, and diagnostic data: device and app identifiers, operating system and app version, and crash logs and diagnostic data used to keep the apps stable and secure.
• Mobile app analytics: in-app usage and interaction data used to understand how features are used and to improve the apps.
• Connected email, calendar, or storage accounts:when you authorize an integration, the specific data and permissions you grant during the connection process (see “External Account Integrations” below).

How we use your information

We use the information we collect in various ways, including to:

• Provide, operate, and maintain our website
• Improve, personalize, and expand our website
• Understand and analyze how you use our website
• Develop new products, services, features, and functionality
• Communicate with you, either directly or through one of our partners, including for customer service, to provide you with updates and other information relating to the website, and for marketing and promotional purposes
• Send you emails
• Find and prevent fraud

Data Protection and Security

We protect your data using industry-standard security measures:

Encryption: All data is encrypted in transit using TLS/SSL and at rest using AES-256 encryption.

Access Controls: Access to your data is restricted to authorized personnel only, using role-based access controls.

Cloud Infrastructure: When you connect external accounts, we access only the specific data you authorize. This data is:

• Stored securely in enterprise-grade cloud data centers with geographic redundancy
• Never shared with third parties without your consent
• Deleted upon account termination or upon request

Data Retention: We retain your data only as long as necessary to provide our services. You can request deletion at any time.

Regular Audits: We conduct regular security audits and vulnerability assessments to maintain data protection standards.

Gramm-Leach-Bliley Act (GLBA) Disclosure

DocJacket may store and process nonpublic personal information (NPI) contained in real estate transaction documents on behalf of our customers, including transaction coordinators, brokers, title companies, and lenders. Because some of these customers are considered financial institutions under the Gramm-Leach-Bliley Act (GLBA), DocJacket maintains privacy and security practices consistent with the GLBA and its implementing regulations (16 C.F.R. Part 314).

Scope of Information

NPI may include names, addresses, contact information, property details, purchase and loan amounts, escrow or title information, and signatures contained in residential real estate contracts and closing documents.

Use and Disclosure

• DocJacket uses NPI solely to provide our transaction management and automation services.
• We do not sell, rent, or share NPI for marketing or unrelated purposes.
• Access to NPI is restricted to authorized personnel and trusted service providers who require it to perform their job duties and are bound by confidentiality and security agreements.

Safeguards Program

To comply with the GLBA Safeguards Rule, DocJacket maintains a written Information Security Program (WISP) designed to:

• Protect the security, confidentiality, and integrity of NPI
• Identify and assess risks to customer data
• Encrypt data in transit (TLS 1.3) and at rest (AES-256)
• Restrict access using authentication, authorization, and logging controls
• Regularly test and monitor our security measures
• Require equivalent safeguards from our vendors and cloud providers

Our program includes:

• Role-based access controls
• Continuous vulnerability scanning
• Vendor oversight to ensure equivalent data protection standards
• Incident response procedures and 24-hour breach notification to affected users

Customer Responsibility

DocJacket acts as a service provider under GLBA. Customers that qualify as financial institutions remain responsible for providing consumer privacy notices and ensuring their own GLBA compliance when using DocJacket.

Contact

If you have questions about our GLBA compliance or information security practices, contact us at: privacy@docjacket.com

Third-Party Services

DocJacket uses carefully vetted third-party service providers to help operate our platform, deliver features, and maintain enterprise-grade security. These providers may process limited personal information on our behalf, subject to strict contractual confidentiality and data-protection obligations.

We engage service providers for functions such as:

• Payment processing for subscriptions and one-time purchases
• Cloud hosting and storage for application data and document management
• Email and SMS delivery for notifications and real-estate transaction updates
• Analytics and performance monitoring to improve system reliability and user experience
• Identity and access management to enable secure account authentication and sign-in options

All service providers are required to:

• Maintain security and privacy standards consistent with applicable laws and industry frameworks, including the Gramm-Leach-Bliley Act (GLBA) and FTC Safeguards Rule (16 C.F.R. Part 314)
• Process data only for the purpose of providing their contracted services to DocJacket
• Implement encryption, access controls, and audit logging consistent with our security policies

DocJacket retains responsibility for ensuring that third-party providers handling customer data meet these obligations. We regularly review their security and compliance practices as part of our ongoing risk-management program.

Behavioral Analytics and Session Recording

DocJacket uses Microsoft Clarity, a behavioral analytics service, to understand how users interact with non-sensitive areas of the product application (such as the dashboard, template management, and onboarding screens). Clarity helps us identify usability issues and improve the product.

Clarity may record:

• Aggregated click, scroll, and engagement patterns (heatmaps)
• Automatically detected signals such as rage clicks and dead clicks
• Session recordings with visible text and form inputs masked by default (strict-masking mode)

Clarity is explicitly disabled on pages that display confidential customer information, including:

• Transaction detail pages (contracts, parties, dates, financials)
• Document viewers and uploads
• Client portals
• Extraction review screens (where extracted contract data is visible)
• Billing and subscription management

Clarity is operated by Microsoft Corporation as a data processor. Data is stored in Microsoft-operated cloud regions located in the United States and is retained by Microsoft for approximately thirty (30) days. Microsoft's privacy practices for Clarity are governed by the Microsoft Privacy Statement.

You may opt out of Clarity collection at any time by contacting privacy@docjacket.com. Organization administrators who wish to disable Clarity across their entire organization may request this in writing.

Log Files

DocJacket follows a standard procedure of using log files. These files log visitors when they visit websites. All hosting companies do this and a part of hosting services analytics. The information collected by log files include internet protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamp, referring/exit pages, and possibly the number of clicks. These are not linked to any information that is personally identifiable. The purpose of the information is for analyzing trends, administering the site, monitoring users movement on the website, and gathering demographic information.

Advertising Partners Privacy Policies

You may consult this list to find the Privacy Policy for each of the advertising partners of DocJacket.

Third-party ad servers or ad networks uses technologies like cookies, JavaScript, or Web Beacons that are used in their respective advertisements and links that appear on DocJacket, which are sent directly to users' browser. They automatically receive your IP address when this occurs. These technologies are used to measure the effectiveness of their advertising campaigns and/or to personalize the advertising content that you see on websites that you visit.

Note that DocJacket has no access to or control over these cookies that are used by third-party advertisers.

Third Party Privacy Policies

DocJacket's Privacy Policy does not apply to other advertisers or websites. Thus, we are advising you to consult the respective Privacy Policies of these third-party ad servers for more detailed information. It may include their practices and instructions about how to opt-out of certain options.

You can choose to disable cookies through your individual browser options. To know more detailed information about cookie management with specific web browsers, it can be found at the browsers' respective websites.

CCPA Privacy Rights (Do Not Sell My Personal Information)

Under the CCPA, among other rights, California consumers have the right to:

• Request that a business that collects a consumer's personal data disclose the categories and specific pieces of personal data that a business has collected about consumers.
• Request that a business delete any personal data about the consumer that a business has collected.
• Request that a business that sells a consumer's personal data, not sell the consumer's personal data.

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us at privacy@docjacket.com.

GDPR Data Protection Rights

We would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

• The right to access: You have the right to request copies of your personal data. We may charge you a small fee for this service.
• The right to rectification: You have the right to request that we correct any information you believe is inaccurate. You also have the right to request that we complete the information you believe is incomplete.
• The right to erasure: You have the right to request that we erase your personal data, under certain conditions.
• The right to restrict processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• The right to object to processing: You have the right to object to our processing of your personal data, under certain conditions.
• The right to data portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us at privacy@docjacket.com.

Children's Information

Another part of our priority is adding protection for children while using the internet. We encourage parents and guardians to observe, participate in, and/or monitor and guide their online activity.

DocJacket does not knowingly collect any Personal Identifiable Information from children under the age of 13. If you think that your child provided this kind of information on our website, we strongly encourage you to contact us immediately at privacy@docjacket.com and we will do our best efforts to promptly remove such information from our records.

External Account Integrations

DocJacket offers optional integrations with external accounts to enhance your workflow (such as email, calendar, and cloud storage providers). When you authorize these integrations:

• We access only the specific data and permissions you explicitly authorize during the connection process
• Data accessed through these integrations is used solely to provide our transaction coordination services
• We implement industry-standard OAuth 2.0 authentication to securely connect to external services
• You may revoke access to external accounts at any time through your account settings or the third-party provider's security controls
• We do not share data from external integrations with other third parties except as required to provide our services

All data accessed through external integrations is subject to the same encryption, access control, and retention policies described in this Privacy Policy. You remain responsible for understanding and complying with the terms of service and privacy policies of any external accounts you connect to DocJacket.

Mobile Applications

Our iOS and Android apps collect and process information as described in this Privacy Policy, plus certain data specific to mobile devices:

Device permissions: With your permission, the apps request access to your device features so you can complete transaction tasks. These permissions are optional, requested in context, and can be changed at any time in your device settings:

• Camera: to scan or photograph documents you choose to upload.
• Photo library and files: to select existing documents or images to upload. We access only the specific items you select.
• Notifications: to send transaction reminders and alerts. Enabling notifications generates a push-notification token tied to your device, which we use only to deliver these messages.

Device identifiers, crash reports, and diagnostics: To keep the apps reliable and secure, we collect device and app identifiers, operating system and app version, crash logs, and diagnostic data. This data is used for stability, security, and troubleshooting.

Mobile analytics: We collect in-app usage and interaction data to understand how features are used and to improve the apps. As described in the Behavioral Analytics section, analytics are disabled on screens that display confidential transaction information.

You can withdraw consent for optional device permissions at any time through your device settings, and you can request deletion of your account and data as described in the “Account Deletion” section below.

Security Measures

Encryption:

• TLS 1.3 for all data in transit
• AES-256 encryption for data at rest
• End-to-end encryption for sensitive documents

Access Controls:

• Role-based access control (RBAC)
• Audit logs for all data access
• Automatic session timeout after 30 minutes of inactivity

Security Monitoring:

• Continuous vulnerability scanning
• A documented security incident response plan

Incident Response:

• 24-hour breach notification to affected users
• Immediate revocation of compromised access

Data Retention:

• Your records are retained for as long as your account is open
• Archived transactions, including copies of their documents, are kept for 3 years by default, or for the period configured in your organization’s settings
• You can request deletion at any time, and deleting your account deletes your data
• We do not automatically delete records when the retention period elapses — retention governs how long archived material is guaranteed to be kept, not when it is destroyed

Data Sharing Practices

We do NOT:

• Sell your data to third parties
• Use your data for advertising purposes
• Train AI/ML models on your data without explicit consent
• Share data except as required for transaction processing or as permitted by law

We MAY share data with:

• Transaction participants (real estate brokers, escrow/title companies) with your explicit permission or as required for transaction completion
• Service providers who process data on our behalf under strict confidentiality obligations (see Third-Party Services section above)
• Legal authorities when required by law, court order, or valid subpoena

All data sharing is logged and auditable to maintain transparency and accountability.

Data Subject Rights

You have the right to:

• Access all data we have collected about you
• Request correction of inaccurate data
• Request deletion of your data (right to be forgotten)
• Export your data in a machine-readable format (JSON, plus your original document files)
• Opt-out of marketing communications
• Revoke Google API access at any time through your Google Account settings

To exercise these rights, contact us at privacy@docjacket.com. We will respond within 30 days.

Data Portability

Users can export their data at any time through:

• In the web app: Settings > Organization > Export my data (account owners)
• Requesting a full data export via email to privacy@docjacket.com

Exported data includes:

• All transaction documents
• Email communications
• Calendar events
• Contact information
• Task lists and completion history

You receive a single ZIP file: your documents in their original formats, foldered by property, and every record we hold as JSON. It includes a manifest listing each file with a checksum, so you can verify the export is complete.

Account Deletion

You can request deletion of your account and associated personal data at any time. We offer more than one way to do this:

• In the web app: go to Settings > Organization > Delete workspace (account owners).
• On the web, without signing in: visit our Account Deletion page.
• By email: contact privacy@docjacket.com.

When you request deletion, we schedule it and email the account owner a link to cancel. Your workspace is paused, and nothing is deleted for 7 days — use that link if you change your mind. After that your account and its data are permanently erased from our production systems; encrypted backup copies are purged on a rolling 14-day cycle. Certain closed-transaction records may be retained where required by law or real estate record-keeping regulations, after which they are permanently deleted. Full details are on our Account Deletion page.

Contact Information for Privacy Concerns

For privacy-related questions or concerns:

• Email: privacy@docjacket.com
• Phone: (407) 201-9147
• Mail: DocJacket LLC, 8331 Choctaw Trail, Kissimmee, FL 34747

For Google API data access concerns specifically, email privacy@docjacket.com with subject line "Google API Data Request".

We will respond to all privacy inquiries within 5 business days.

Last updated: July 20, 2026