GetDocs Privacy Policy

1. Introduction

Iron Noodle Technologies, LLC, a Delaware limited liability company ("Iron Noodle," "we," "us," or "our"), operates the GetDocs platform (the "Service"), which helps law firms collect, organize, and process the documents and information their clients must produce in the course of bankruptcy, family law, real estate, and other consumer legal matters. This Privacy Policy describes how we collect, use, disclose, retain, and protect information in connection with the Service.

This Privacy Policy applies to two audiences. Part of this policy describes information about the law firms and other entities that subscribe to the Service ("Customers"), and the individuals who use the Service on a Customer's behalf ("Authorized Users"). Another part describes information about the individual clients of those law firms ("End Users") who receive Magic Links to upload documents, connect financial accounts, sign authorizations, and otherwise participate in the legal matter for which the Customer represents them.

Capitalized terms not defined in this Privacy Policy have the meanings given in the GetDocs Terms of Service.

2. Important Context for End Users

If you are an End User, the following points explain the relationships involved in your use of the Service:

• Your law firm is your data controller. Your law firm decided to use the Service to assist with your legal matter and invited you to participate. Your law firm is the "data controller" (or "business," as that term is used in some state laws) for the information you provide. Iron Noodle processes your information on your law firm's behalf as a service provider.
• Iron Noodle is not your attorney. Iron Noodle is a software company. Iron Noodle does not provide legal advice and does not have an attorney-client relationship with you. Your attorney-client relationship is with your law firm.
• Some information is collected through partner services. If you choose to connect a financial account, that connection is handled by Plaid. If you choose to retrieve a credit report, that retrieval is handled by Array.com. These partners have their own privacy practices, which are summarized in Sections 6 and 7 of this Privacy Policy and described in full in their own privacy policies, which are linked below.

3. Information We Collect

3.1 Information We Collect from Customers and Authorized Users

When a Customer subscribes to the Service, and when Authorized Users access the Service on the Customer's behalf, we collect:

• Identifying and contact information, including firm name, business address, primary attorney name, business email, and direct telephone number;
• Professional credentialing information, including state of bar admission and state bar license number;
• Account credentials, including the password hash used to authenticate Authorized Users;
• Billing information collected and processed by our payment processor, Stripe (we do not store payment card numbers or bank account numbers on our own infrastructure);
• Configuration information, including the Customer's practice areas, branding choices, document categories, and integration settings; and
• Communications, including support requests, training session recordings, and other correspondence with Iron Noodle.

3.2 Information We Collect from End Users Directly

When an End User accesses the Service through a Magic Link, we collect:

• Identifying and contact information, including the End User's name, email address, telephone number, mailing address, and date of birth;
• Government identifiers and sensitive information that the End User uploads or enters in connection with the legal matter, which may include Social Security numbers, taxpayer identification numbers, driver's license numbers, and similar identifiers;
• Documents that the End User uploads in connection with the legal matter, including pay stubs, tax returns, bank statements, retirement account statements, mortgage statements, deeds, vehicle titles, identification documents, court correspondence, debt and bill records, and other personal financial documents;
• Responses to questionnaires, intake forms, and conditional onboarding workflows configured by the law firm;
• Electronic signatures captured through BoldSign on consents, authorizations, retainers, and other documents executed within the Service;
• Identity verification information collected when the End User completes integrated identity verification within the Service or through Array's knowledge-based authentication process; and
• Communications, including messages exchanged with the law firm through the Service.

3.3 Information We Collect from End Users Through Plaid

If an End User chooses to connect a financial account through the Service, the Service uses Plaid to retrieve information from the End User's financial institution. The categories of information that may be retrieved through Plaid include:

• Financial account identifiers, including account name, account type, masked account number, and routing number;
• Account balances, including current and available balance amounts;
• Transaction history, including transaction date, description, amount, category, and counterparty;
• Income and payroll information, including employer name, pay frequency, gross and net pay, deductions, and direct deposit details;
• Asset and liability information, including investment accounts, loan balances, and credit account balances;
• Account holder identity information returned by the financial institution, including name, address, email, and phone number on file with the institution; and
• Statements made available by the financial institution in PDF or other format.

Iron Noodle does not collect or have access to the End User's online banking username, password, or other login credentials. The End User authenticates directly with the financial institution through Plaid's interface, and the financial institution returns data to Plaid, which then makes that data available to the Service. The categories of data actually retrieved depend on the End User's case configuration and the connection method supported by the financial institution.

3.4 Information We Collect from End Users Through Array.com

If the End User chooses to retrieve a consumer credit report through the Service, the Service uses Array.com to facilitate the retrieval. The information that may be collected and made available through this integration includes:

• The consumer credit report compiled by one or more of the three nationwide consumer reporting agencies (Equifax, Experian, and TransUnion), including credit account history, public records, inquiries, and credit score data;
• Identity verification information used by Array.com to authenticate the End User through a knowledge-based authentication process; and
• A record of the executed Limited Power of Attorney through which the End User authorizes Iron Noodle, the Service, and the End User's law firm to access the credit report for the limited purpose described in Section 7.

3.5 Information Collected Automatically

When any user accesses the Service, we and our service providers automatically collect certain technical information, including IP address, browser type and version, operating system, device identifiers, pages and features accessed, timestamps, and referring URLs. This information is used to operate, secure, and improve the Service, and to record acceptance events for the Terms of Service and authorizations. The Service uses cookies and similar technologies to maintain authenticated sessions and to remember user preferences.

4. How We Use Information

We use the categories of information described in Section 3 for the following purposes:

• To provide the Service. We use information to authenticate users, to make documents and data available to the law firm representing the End User, to validate documents using our document intelligence pipeline, to facilitate electronic signature, to retrieve financial data through Plaid and credit reports through Array.com when the End User authorizes those retrievals, to generate combined exports of case materials, and to perform the other functions for which the Service is designed.
• To support, maintain, and secure the Service. We use information to provide customer and end-user support, troubleshoot issues, monitor for security incidents and unauthorized access, prevent fraud and abuse, and maintain audit logs.
• To bill and collect fees. We use Customer information to charge subscription fees and per-case fees through Stripe.
• To improve the Service. We use de-identified, aggregated metrics derived from use of the Service to operate, improve, and develop new features. We do not use End User Data or Customer Content to train any general-purpose machine learning model offered to third parties.
• To comply with law and protect rights. We use information to comply with applicable law, to respond to lawful requests from courts and regulators, to enforce our Terms of Service and other agreements, and to protect the rights, property, and safety of Iron Noodle, our users, and others.
• To communicate. We use Customer and Authorized User contact information to send service announcements, training communications, billing notices, and policy updates. We use End User contact information to send case-related notifications configured by the law firm.

5. How We Disclose Information

We disclose information in the following circumstances and to the following categories of recipients.

5.1 Disclosure to the Customer Law Firm

End User information collected through the Service — including documents, intake responses, identity verification information, financial account information retrieved through Plaid, and credit report information retrieved through Array.com — is made available to the law firm that invited the End User to the Service, and to the Authorized Users of that law firm. This is the primary purpose of the Service: to deliver the End User's information to the End User's law firm so the firm can prepare the filings and disclosures required for the End User's legal matter.

5.2 Disclosure to Subprocessors

We share information with the third-party service providers we use to operate the Service. These Subprocessors include:

• Plaid Inc. — financial account connection and data retrieval;
• Array.com (Array US, Inc.) — consumer credit report retrieval and identity verification;
• BoldSign — electronic signature capture and storage;
• Stripe — subscription billing and payment processing;
• Cloud hosting and infrastructure providers — application hosting, database storage, and content delivery;
• Email and notification providers — transactional email and SMS delivery;
• Customer support and analytics providers — customer relationship management, support ticketing, in-app messaging, and product analytics; and
• Security, fraud prevention, and audit logging providers — monitoring, threat detection, and recordkeeping.

Each Subprocessor is bound by a written agreement that requires the Subprocessor to use information only as necessary to provide its services, to maintain the confidentiality and security of the information, and to comply with applicable law.

5.3 Disclosure for Legal and Compliance Purposes

We may disclose information when we reasonably believe disclosure is required to comply with applicable law, a subpoena, court order, or other lawful process; to enforce our Terms of Service; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of Iron Noodle, our users, or others.

5.4 Disclosure in Business Transactions

If Iron Noodle is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, information may be transferred to the successor entity, subject to the protections of this Privacy Policy or a successor policy that provides comparable protections.

5.5 No Sale of Personal Information

We do not sell personal information for monetary consideration, and we do not engage in the sharing of personal information for cross-context behavioral advertising. To the extent that any disclosure of personal information described in this Section 5 might be construed as a "sale" or "sharing" under any state consumer privacy law, that disclosure is made in our capacity as a service provider to the Customer, or by the Customer in its capacity as the data controller, and is limited to the purposes described in this Privacy Policy.

6. Plaid Disclosures

The Service uses Plaid to enable End Users to connect their financial accounts and to retrieve the categories of financial information described in Section 3.3. When an End User initiates a Plaid connection, the End User is presented with Plaid's standard interface, which describes Plaid's role and provides the End User the opportunity to review the categories of data that will be retrieved and to consent to the retrieval before any data is returned to the Service.

Plaid's collection and use of information is governed by Plaid's own End User Privacy Policy.

End Users may review the Plaid End User Privacy Policy at: https://plaid.com/legal/#end-user-privacy-policy.

End Users have the right to revoke their authorization for Plaid to share information with Iron Noodle by contacting their law firm or by managing connections through the Plaid Portal at https://my.plaid.com. Revocation does not require Plaid or Iron Noodle to delete data already retrieved before the revocation took effect, but it does prevent further data retrieval going forward.

Iron Noodle does not collect, store, or have access to End User online banking credentials. Iron Noodle uses Plaid solely as a service provider to retrieve the categories of data described in Section 3.3 for the purposes described in Section 4. Iron Noodle does not sell financial account information to Plaid or to any other party.

7. Credit Reporting Disclosures (Array.com and the Fair Credit Reporting Act)

If an End User chooses to retrieve a consumer credit report through the Service, the retrieval is facilitated by Array.com, which acts as a reseller of consumer report information from one or more of the three nationwide consumer reporting agencies (Equifax, Experian, and TransUnion).

7.1 How the Retrieval Works

Before any credit report is retrieved, the End User personally completes Array's knowledge-based authentication process to confirm the End User's identity. The End User then electronically signs a Limited Power of Attorney through BoldSign that authorizes Iron Noodle, the Service, and the End User's law firm to access the credit report for the limited purpose of preparing the End User's bankruptcy petition or other related legal filing. The credit report is then retrieved and made available within the Service to the law firm and to Iron Noodle personnel acting in a technical support, troubleshooting, or quality assurance role.

7.2 Permissible Purpose

The credit report is accessed for a permissible purpose under the federal Fair Credit Reporting Act, 15 U.S.C. § 1681b, in connection with the End User's representation by the End User's law firm. The credit report is not used for any decision about the End User's eligibility for credit, employment, insurance, or housing, and is not used for marketing, profiling, or any purpose unrelated to the End User's legal matter.

7.3 Consumer Rights Under the Fair Credit Reporting Act

End Users have important rights under the Fair Credit Reporting Act, including the right to obtain a copy of their credit report directly from the consumer reporting agencies, the right to dispute inaccurate or incomplete information, the right to know who has obtained the credit report, and the right to seek damages for violations.

End Users may review the Federal Trade Commission's "Summary of Your Rights Under the Fair Credit Reporting Act" at: https://www.consumerfinance.gov/learnmore/.

7.4 Inquiry Disclosure

Depending on the type of credit report retrieved, the retrieval may result in an inquiry appearing on the End User's credit report. The nature of the inquiry (hard or soft) depends on the product used and the policies of the relevant consumer reporting agency.

8. How We Protect Information

Iron Noodle maintains administrative, technical, and physical safeguards designed to protect information against unauthorized access, use, disclosure, alteration, and destruction. These safeguards include:

• Encryption of information in transit using Transport Layer Security 1.2 or higher;
• Encryption of information at rest using industry-standard encryption;
• Role-based access controls and least-privilege principles for personnel access;
• Comprehensive audit logging of access and actions on the Service;
• Secure password hashing for platform credentials and UUID-based Magic Links for End User authentication;
• Cross-site request forgery protection and other application security controls;
• A sensitive export mode that automatically redacts certain personally identifiable information (Social Security numbers, account numbers, and dates of birth) from generated documents; and
• Contractual security and confidentiality obligations with all Subprocessors.

No method of transmission over the internet or method of electronic storage is one hundred percent secure. While we use commercially reasonable means to protect information, we cannot guarantee absolute security.

9. Data Retention

We retain information for as long as necessary to provide the Service, to comply with our legal and contractual obligations, to resolve disputes, and to enforce our agreements. Specific retention periods reflect the following considerations:

• Customer Content and End User Data are retained for the duration of the Customer's subscription and for a reasonable period after termination to allow for export, in accordance with the Terms of Service.
• Audit logs and acceptance records are retained for a period appropriate to the legal, regulatory, and operational purposes for which they are kept, generally not less than seven (7) years.
• Billing records are retained as required by applicable tax and accounting laws.
• Backup copies are deleted in the ordinary course of our backup rotation schedule.

On termination of a Customer's account, Customer Content and End User Data are deleted or archived in accordance with the Terms of Service and our internal data retention policy.

10. Your Privacy Rights

Depending on the state in which you reside, you may have rights with respect to your personal information under applicable law. The rights described below are in addition to any rights you have under your law firm's privacy practices, which apply to information your law firm holds about you in its capacity as your legal representative.

10.1 Rights of End Users (Consumers)

If you are an End User, your law firm is generally the data controller (or business) for your information, and your law firm is the appropriate first point of contact for exercising your rights with respect to that information. Iron Noodle will assist your law firm in responding to your requests as required by applicable law.

Subject to applicable law and to the limitations described below, End Users may have the following rights:

• Right to know and access. The right to confirm whether we are processing personal information about you and to request a copy of that information.
• Right to correction. The right to correct inaccurate personal information.
• Right to delete. The right to request deletion of personal information, subject to exceptions for information we are required or permitted to retain.
• Right to data portability. The right to receive a copy of your personal information in a portable format.
• Right to opt out of sale or sharing. The right to opt out of the sale or sharing of personal information for cross-context behavioral advertising. We do not sell personal information or share it for cross-context behavioral advertising.
• Right to limit the use and disclosure of sensitive personal information. The right to direct that sensitive personal information be used and disclosed only for limited, specified purposes. We use sensitive personal information only for the limited purposes described in this Privacy Policy.
• Right to non-discrimination. The right not to receive discriminatory treatment for exercising these rights.
• Right to appeal. In some states, the right to appeal a decision regarding a privacy rights request.

10.2 Rights of Customers and Authorized Users

Customers and Authorized Users may exercise applicable privacy rights with respect to information about themselves (separate from End User Data) by contacting Iron Noodle as described in Section 14.

10.3 How to Exercise Rights

If you are an End User, please contact your law firm to exercise your rights. If you are unable to reach your law firm or believe your law firm has not adequately responded, or if you are a Customer or Authorized User, you may contact Iron Noodle directly using the contact information in Section 14. We will verify your identity before responding to a request, may require additional information to do so, and will respond within the timeframe required by applicable law.

10.4 Authorized Agents

You may designate an authorized agent to make a privacy rights request on your behalf, subject to verification of the agent's authority and your identity, as required by applicable law.

10.5 California Shine the Light

California Civil Code Section 1798.83 permits California residents to request information about disclosures of personal information to third parties for those parties' direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

11. Children's Privacy

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete that information promptly. If you believe a child under 13 has provided personal information through the Service, please contact us.

12. United States Service

The Service is intended for use by Customers and End Users located in the United States, and the information processed through the Service is processed and stored in the United States. If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with local law.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Service, to our practices, or to applicable law. When we make material changes, we will update the Effective Date at the top of this Privacy Policy and provide notice through the Service, by email to Customers and Authorized Users, or by other reasonable means. Continued use of the Service after a material change takes effect constitutes acceptance of the updated Privacy Policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, or if you wish to exercise any of the rights described in Section 10, please contact us:

Iron Noodle Technologies, LLC
Attn: Privacy
16192 Coastal Highway
Lewes, DE 19958
Email: noodles@ironnoodle.com