Privacy Policy

Account details (email, name), documents you upload (denial letters, contracts, warranties, protection plans, provider responses, photos and receipts), call recordings you upload and their transcripts (audio of calls you made and chose to record — we never record calls), claim metadata (provider, plan, state), vehicle, device, and property information contained in those documents (such as VINs, serial numbers, IMEIs, and property addresses), security data (MFA settings, active sessions with device and IP), newsletter consent records (timestamp, source, IP), and usage analytics including UTM parameters.

If you upload a recording of a call (for example, a call in which a claim was denied verbally), the audio is processed transiently — held in memory only long enough to transcribe it — and is never permanently stored. We keep only the transcript, which you can review and correct before it is used. Transcripts are private case documents: they are never added to the shared contract library, never included in aggregate provider statistics or newsletter topic analysis, and never used to train AI models. They are encrypted, covered by the retention schedule below, and deleted when you delete the case or your account. Always tell the provider you are recording; some states require every person on the call to consent.

To analyze your documents, generate your reports and letters, secure your account, send transactional emails (receipts, delivery notices, response reminders) and (with consent) our product newsletter, operate the anonymized document library, and improve the service.

Uploaded document text and files are encrypted at rest. We send document text to an AI provider solely to perform your analysis. Photos are auto-rotated and stripped of GPS/EXIF metadata before inclusion in any output.

Anonymous free previews: accessible via a signed link for 7 days, then the uploaded files and analysis are deleted automatically (a daily scheduled job). Purchased appeals and their documents: kept for 24 months after your account's last activity — any sign-in, purchase, or upload resets the clock. We email you 30 days and 7 days before deletion, each with a one-click "Keep my documents" button that extends retention for another 24 months. After deletion we keep only the minimal Stripe transaction record required for accounting. You can delete individual documents or an entire appeal at any time from their page, download everything (Settings → Download my data), or delete your whole account. Every retention deletion is logged for audit. Application and request logs are retained up to 30 days and never contain document contents, extracted personal data, or full addresses.

With your explicit consent, a contract you upload may be contributed to a shared library so other customers of the same provider can compare documents faster. Before storage, an automated PII-redaction pass (pattern matching plus AI review) removes names, addresses, phone numbers, emails, policy/contract/claim/account numbers, property addresses, and signatures, and we keep a redaction log. Library entries store only provider, plan, year, and sanitized text, with no link back to you or your account — so deleting your account never touches the library.

With your consent (an unchecked opt-in box at signup, the footer form, or Settings), we send product updates and new claim-type announcements — a few emails a month. Every newsletter email includes a one-click unsubscribe link and our physical mailing address, and we honor unsubscribes immediately. Transactional emails (receipts, delivery and response reminders, security alerts) are part of the service and can’t be turned off while your account is active.

We use Google Analytics 4 and the Meta Pixel, and we send server-side conversion events to Meta’s Conversions API (deduplicated by event ID). We capture UTM parameters on your first visit, store them on your account, and attach them to purchase events so we can measure which campaigns work.

Non-essential trackers (Google Analytics 4 and the Meta Pixel) load only after you give consent through our cookie banner, where you can accept all, reject non-essential, or manage categories individually. We honor Global Privacy Control (GPC) signals by automatically rejecting non-essential trackers. Server-side Conversions API events are sent only for users who consented to marketing cookies. You can change your choice anytime via the "Cookie settings" link in the footer. Essential storage (sign-in session, security) does not require consent.

If you enable multi-factor authentication, we store your TOTP secret encrypted and one-way hashes of your recovery codes. We keep a list of your active sessions (device, IP, timestamps) so you can review and revoke them, and we email you about new-device sign-ins and security changes.

When you use Mail-it-for-me we log, for each order: IP addresses and timestamps (at account creation, letter generation, final review, and submission), the letter contents both as generated and as finally submitted, recipient and return addresses, and payment metadata (card last four, billing country, fraud-risk score). Why: fraud prevention, abuse prevention, and legal compliance. Retention: mail transaction records are kept for 7 years and are retained after account deletion — this is a legal-obligation exception to our normal deletion policy described below. Disclosure: to our mail provider (PostGrid) to fulfill the order, and to law enforcement when required by law.

We do not sell your personal information. We share data only with the processors needed to operate the app: cloud hosting (our application platform), AI analysis (OpenAI), payments (Stripe), print-and-mail — only when you use Mail-it-for-me — (PostGrid, which receives your letter content and the sender/recipient addresses needed to print and deliver it), email delivery (Resend), and analytics (Google Analytics 4, Meta).

We do not sell your personal information and we do not share it for cross-context behavioral advertising. Advertising cookies (Google Analytics 4, Meta Pixel) load only with your consent, and server-side conversion events are sent only for consenting users. To opt out at any time — including under state laws that treat ad cookies as a "sale" or "sharing" — use the "Cookie settings" link in the footer or send a Global Privacy Control (GPC) signal, which we honor automatically.

You can delete your account yourself anytime in Settings → Delete my account, after confirming with your password or MFA code. Deletion permanently removes your profile, uploads, letters, documents, sessions, analytics identifiers, and newsletter list entries. Only payment transaction records we are legally required to retain are kept, anonymized, by our payment processor. Mail transaction records are the one exception to deletion: they are retained for 7 years as described in "Mail order records". You may also request access or correction of your data at support@decodemydenial.com.

Policy change log — every material change to our Terms, Privacy Policy, and Refund Policy, with dates.