This policy explains how Brancodelogic LLC handles personal data in and around BranFillable. It covers two very different situations, and the difference decides who you contact about your data.
Which one are you?
If you were sent a link to fill in a form or send a document, the organization that sent it decides what is asked of you and what happens to your answers. They are the controller; we run the software for them as a processor. Send access and deletion requests to that organization first — section 8 explains what we can do if you cannot reach them.
If you are a customer, an administrator or a visitor to our website, we are the controller of your account, billing and usage data and you can exercise your rights with us directly.
1. Who we are
Brancodelogic LLC, [STREET ADDRESS], [CITY], Florida [ZIP], United States. Privacy contact: privacy@branfillable.com.
We have not appointed a representative in the European Union or the United Kingdom under Article 27 GDPR. If you are in the EEA, the UK or Switzerland, write to the privacy address above and your request will be handled under the same deadlines.
2. Data we hold as controller
| Category | What it is | Why we have it | Legal basis |
|---|---|---|---|
| Account | Name, work email, hashed password, role, organization, invitation records, language preference | To run the account and control who can see what | Contract |
| Billing | Organization name, billing email, plan, subscription state, invoice history, card brand and last four digits | To charge for the service and keep records | Contract, legal obligation |
| Usage and audit | Sign-ins, actions taken in the admin screens, the user and time behind each one, IP address, user agent | Security, abuse prevention, and giving your administrator an account of who did what | Legitimate interest, legal obligation |
| AI usage | Which AI run happened, for which document, at what token cost | Enforcing plan allowances and spending limits | Contract, legitimate interest |
| Sales enquiries | Name, work email, organization, phone, preferred contact time, what you told us you need, and how you heard about us — plus the IP address and browser the form was sent from | To answer your enquiry, set up an account if you ask us to, and know which channels bring people to us | Steps at your request prior to a contract; legitimate interest |
| Support | What you write to us and what we reply | To answer you | Legitimate interest |
| Website | Requests to our public pages, including IP address and user agent, held in server logs | Serving the site, security and diagnosing faults | Legitimate interest |
We do not run advertising or analytics trackers on the marketing site, and we do not build profiles of visitors.
3. Data we handle for a customer, as processor
When an organization uses BranFillable, the answers their recipients give belong to that organization. We handle it only on their documented instructions, under the Data Processing Addendum. Depending on the document the customer built, that can include:
- Name, contact details and anything else the customer's own PDF asks for;
- Government identifiers such as a Social Security or licence number, where the customer's document asks for them — encrypted at rest at field level;
- Health information, where the customer's document asks for it — held in a separate table with its own access rules, because keeping medical information apart from a personnel record is an ADA requirement, not a preference;
- The signature image, and the timestamp, IP address and user agent captured with it as evidence that the signature was made;
- The completed PDF the service produces;
- Where file requests are used: what was asked for, its status, the identifier returned by the customer's storage provider, timestamps and who opened it — see section 6.
We do not decide what a customer asks for, we do not use this data for our own purposes, we never sell or share it, and we do not use it to train machine learning models.
4. What AI features send, and what they do not
Field mapping, form generation, exam detection and Spanish translation call a third-party AI provider, named on the sub-processors page. What leaves our infrastructure is the structure of a document, never a person's answers:
| Sent to the AI provider | Never sent |
|---|---|
| AcroForm field names from the uploaded PDF; the labels, help text and option text of a generated form; exam question and answer text printed in the PDF | Any answer a recipient submits; the signature image; any file a recipient uploads; Social Security or licence numbers; health information; billing data |
Filling a PDF and stamping a signature are done entirely on our own infrastructure with local tools — no AI provider is involved in producing a completed document. The provider does not use API inputs to train its models.
5. Cookies and local storage
We use the minimum a logged-in application needs, and nothing for advertising.
- Session cookie — keeps you signed in. Strictly necessary.
- CSRF token cookie — stops a third-party site from acting as you. Strictly necessary.
- “Remember me” cookie — only if you ask for it at sign-in.
- Browser local storage — remembers small preferences on your own device, such as the language a form is displayed in. It never leaves your browser and we cannot read it.
Because all of these are strictly necessary or set at your request, no consent banner is required. Some pages load fonts and libraries from third-party hosts, listed in section 9; those hosts see your IP address.
6. Connected Storage — files we deliberately do not hold
Where a customer connects their own storage account and requests files from a recipient, the uploaded file goes to the customer's storage account. We keep the record of the request, not the file: what was asked for, whether it arrived, the identifier the provider returned, the timestamps and who opened it. At most the last four digits of a Social Security number are ever stored by us, and those are encrypted.
That storage account belongs to the customer. Its encryption, backups, location and retention are the customer's arrangement with their provider, not a sub-processing relationship of ours — which is why those providers do not appear on our sub-processor list.
7. Who else sees the data
- Sub-processors. A short, named list with what each one touches: see the current list. Each is bound by a written agreement no weaker than ours.
- Your own organization. An account administrator can see the records their staff create, and — where a customer's plan includes it — our staff can open a read-only view of a customer workspace for support, which is recorded in the audit log at both ends and cannot write anything.
- Legal requests. We disclose only what we are legally required to, and where we are permitted, we tell the affected customer first.
- A business transfer. If the business is sold or merged, data moves with it, under this policy, and we will say so before it happens.
We have never sold personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in United States state privacy law.
8. How long we keep things
| What | How long |
|---|---|
| Account and customer content | While the account is open, then 30 days for export, then deleted or anonymized |
| Recipient responses and generated documents | For the period the customer sets. We delete on the customer's instruction and on account closure |
| Signature evidence (timestamp, IP, user agent, document reference) | Kept with the signed document as proof it was signed, for the life of that document |
| Portal links | Single use, and expire 24 hours after they are issued |
| Invoices and tax records | As long as tax and accounting law requires, typically 7 years |
| Audit logs | Retained as security and accountability evidence; not deleted on request where doing so would destroy the record of who did what |
| Sales enquiries | Kept while we are talking and for 24 months after the last contact, then deleted. If you become a customer it becomes part of your account record |
| Server logs | Short-lived, retained for diagnosis and security |
9. Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its use, receive a portable copy, withdraw consent, and complain to a supervisory authority. In the United States that includes the right to know, to delete, to correct, to opt out of sale or sharing — which we do not do — and not to be discriminated against for exercising a right; in the EEA, the UK and Switzerland those rights come from the GDPR.
If a company sent you a link, ask that company: they decide what happens to your answers and we are not allowed to act on your data without their instruction. If you cannot identify or reach them, write to privacy@branfillable.com, tell us what you can about the form, and we will locate the customer and pass your request on.
If you are a customer or administrator, write to the same address. We answer within 30 days and will tell you if we need longer. We will verify who you are before acting, in proportion to what is being asked, and we do not charge for a first request. An authorized agent may act for you with written proof.
We do not make decisions about you by automated means that produce legal or similarly significant effects.
10. International transfers
We are established in the United States and our sub-processors operate in the United States and the European Union. Where data moves out of the EEA, the UK or Switzerland, the transfer relies on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and, for Switzerland, the Swiss addendum, together with the measures described on the security page. A copy of the clauses used for a particular sub-processor is available on request.
11. Security
Passwords are hashed, transport is encrypted, sensitive identifiers and all health information are encrypted at field level, every tenant's data is isolated by a global query scope and middleware that is enforced on the server, and privileged actions are written to an audit log. The full description, and how to report a vulnerability, is on the security page.
If a breach affects personal data we process for a customer, we notify that customer without undue delay and within 72 hours of becoming aware — and where Florida law applies to us as a third-party agent, within 10 days, which is the stricter statutory duty. Notifying affected individuals is the customer's decision and duty as controller; we give them what they need to make it.
12. Children
The Service is for organizations and their adult recipients. It is not directed to children and we do not knowingly collect data from anyone under 16. If a customer's document is used to collect a minor's data, that is the customer's responsibility and legal basis, not ours. Tell us at the privacy address if you believe we hold a child's data and we will remove it.
13. Changes to this policy
We will update the date at the top when this policy changes, and for a material change we will notify account administrators by email or in the application before it takes effect.
14. Contact
Privacy
Data protection
Security reports