Privacy notice

Last updated Nov 13, 2026.

1. Who we are

Simple Pay Application is run by Staunch Digital, established in France under SIREN 898 721 865, so European data protection law applies to what we do with personal data. Contact: [email protected].

This notice covers two groups of people: those who hold an account, and the people whose details account holders put into their documents.

2. What we store, and why

Your account: your name, email address, a one-way hash of your password, your role (owner or user), when you confirmed your email address and accepted the terms, and when you last signed in. To run your account.
Your company: its name, address, phone, email address, license number, the signer’s name and title, and the logo you upload. They are printed on your documents.
Your projects: names, numbers and addresses, the owner, general contractor, architect and lender details you enter, the schedule of values, change orders, stored materials, retainage, pay applications and lien waivers, with their dates and amounts. To make your documents.
Your files: the PDF, JPG and PNG files you attach. An Excel or CSV file you upload to read a schedule of values is kept until you save or discard the lines, and 7 days at most.
Your signatures: for each signature, the signer’s name and title, the signed-in user, the date and time, the IP address, the method (typed or drawn), the drawn image if there is one, and a fingerprint of the document. To keep a record of what was signed and when.
Billing: your plan, its status and renewal date, your single pay app purchases, the Stripe customer and subscription identifiers, and for a single pay app paid by card, the card fingerprint (section 3). To know what your plan includes.
Where you came from: on your first visit, and again on your last visit before you sign up, the website that sent you (its name, not the full address), the campaign tags in the link (utm_source, utm_medium and utm_campaign), the page you arrived on and the date. They are saved with your company when you sign up, with your answer to “How did you hear about us?” if you give one, and the first visit is saved with each payment; Stripe receives that source and that page with the payment. To count sign-ups and sales by source. It holds no name or email address.
Security: sign-in attempts and rate limits, with IP addresses kept only as salted one-way hashes, removed after 2 days. To stop abuse.
Account email: a copy of each account email we send (payment received with the email confirmation link, email confirmation, password reset, notice of a changed password, invitations, the notices before an account is deleted), with the address it went to and whether the mail service accepted it, kept while the account is open. To show what we sent if a delivery is questioned.

We do not sell personal data and do not share it with advertisers.

3. Payment

Stripe processes payments. It receives your billing details and your card; we never see or store card numbers. Stripe’s form is shown inside our own checkout page, and it also offers Apple Pay and Google Pay, which pass the payment to Stripe in the same way. Stripe’s form may also offer Link, Stripe’s own service for saving payment details; if you choose to save them there, Link’s own terms and privacy notice apply. Stripe has its own privacy notice for the payment data it keeps.

Card fingerprint

When a single pay app is paid by card, we keep the card fingerprint Stripe gives with the payment: a code Stripe derives from the card number, the same each time the same card is used, from which the number cannot be read back. We keep it with that purchase to apply the purchase limits in the Terms, and for nothing else.

4. People named in your documents

The documents you make hold names and contact details of other people, such as a general contractor’s project manager, an owner or a lender. You are responsible for having the right to enter them. For this data we act on your behalf and on your instructions, and we use it to make your documents and for nothing else.

When you send a signing link to a person outside your company, we keep what that person gives when signing: the name and title, the date and time, the IP address, the method and the drawn image if there is one. That person needs no account.

5. Cookies

Signing in sets one essential cookie that keeps you signed in for up to 30 days. It is not used for tracking. There is no advertising tag on the site.

Stripe’s payment form, shown inside our checkout page, sets Stripe’s own cookies to prevent fraud and to take the payment. Stripe’s privacy notice covers them.

The sign-in form uses Cloudflare Turnstile to check for automated abuse. It runs a short check in your browser and sends the result to Cloudflare.

A first-party cookie called src keeps where you came from (section 2) for 90 days from your first visit; only our own server writes and reads it, and it holds no name or email address.

We use Google Analytics to track website performance. To opt out, turn on Global Privacy Control in your browser or install Google’s opt-out browser add-on (tools.google.com/dlpage/gaoptout).

Visitors in Europe (the EU, the EEA, the UK and Switzerland, judged from their internet address, or from the device’s time zone when the address gives no answer) are asked first: until they accept, Google Analytics does not load and the src cookie is not set. The choice is kept in your browser; change it with Cookie choices at the foot of the page.

6. Who else sees it

Stripe processes payments (section 3).
Infrastructure hosting runs the servers the service is delivered from, in the United States. Named on request.
Google runs Google Analytics for us (section 5), as our processor.
Cloudflare delivers the site, so it handles the requests your browser sends to it.
Cloudflare keeps a copy of the nightly backups in its R2 storage (section 7).
Cloudflare sends account email. It receives the address, the subject and the text of the message, never your documents.
Mail you send to our support address is forwarded by Cloudflare to our mailbox at Google (Gmail), where we read and answer it.
When you choose a password, we check it against Have I Been Pwned’s list of leaked passwords. Only the first five characters of a one-way hash of the password are sent, never the password.

Excel and CSV files you upload to read a schedule of values are read by our own code and are not sent anywhere.

We use no other provider.

7. How long we keep it

Account data is kept while the account is open. When a plan or a single pay app ends, the account becomes read-only and we keep everything, so you can read it, download it and come back. It is kept for 6 months after your plan or single pay app ends, then deleted; we email the account owner 30 days before deleting it, and again 7 days before, with a link to download everything. A plan or a single pay app bought before then keeps it. An account that has never paid is deleted 7 days after it was created, and no email is sent to it before a card has paid.

You can remove a user, archive a project or delete an unsigned waiver at any time. A signed document and its signature record are kept as they are.

Write to us and we delete your account and its data within 30 days, except billing records, including single pay app purchases and their card fingerprint: the date, the amount, Stripe’s payment reference and the fingerprint, with no name or company. We keep them to apply the purchase limits in the Terms and as the law requires. The note of where the account came from (section 2) also stays, with no link to the account or to anyone in it, so our counts by source stay right. The database is backed up every night and the last 14 copies are kept, so deleted data leaves the backups within 15 days after it is deleted. A copy of each backup is also kept outside the server, by Cloudflare in its R2 storage, and for no longer than that, so deleted data leaves that copy within the same 15 days.

Shorter periods: a sign-in session lasts up to 30 days, an email confirmation link 7 days, an invitation 14 days and a password reset link 30 minutes.

8. Where it is kept

The service is for businesses in the United States and runs there, so your data is stored in the United States in order to provide it to you. Our company is established in France.

9. Security

The site is served over HTTPS. Passwords are stored only as one-way hashes. Card details are held by Stripe and never reach us.

10. Your rights

Depending on where you are, you may ask what we hold about you, have it corrected, or have it deleted. Write to us and we answer within the time the law allows. If you think we have handled your personal data badly, tell us first; you can also complain to the CNIL (Commission Nationale de l’Informatique et des Libertés), which oversees us because the company is established in France.

11. Changes

We may update this notice. The date at the top says when it last changed, and we tell account holders directly about changes that matter.