Privacy Policy

1. Scope

This Policy applies to information processed by Tuguedr through the Services and related support or communications. It does not govern a third party's independent practices, including an electronic-signature, authentication, analytics, hosting, email, social-login, payment, or app-store provider. Those providers may process information under their own privacy notices.

The Services are intended for people located in the United States and are not directed to residents of the European Economic Area, United Kingdom, or Switzerland. The Services are not intended for anyone under 18.

2. Information We Collect

The information we collect depends on the features you use and the role you have in a transaction.

A. Information you provide

• Account and contact information: name, email address, telephone number, mailing address, account credentials, language preference, and user role.
• Authentication information: identifiers and profile details received when you sign in through Apple, Google, Facebook, or another authentication provider, subject to the permissions you grant that provider.
• Rental and document information: property address; landlord, tenant, occupant, or authorized-agent details; rent, deposits, fees, dates, notices, responsibilities, selected clauses, and other answers or text used to prepare, review, sign, or manage a document.
• Signature and consent information: electronic signature, initials, acknowledgments, consent records, document versions, signing status, timestamps, delivery history, and related audit-trail information.
• Transaction-participant information: information one user supplies about another landlord, tenant, occupant, guarantor, representative, witness, or other participant, including that person's contact information.
• Communications: messages, support requests, survey responses, feedback, and records of communications with us.
• Payment information: information about a one-time Pro purchase, such as the product purchased, transaction identifier, purchase status, price, currency, and refund status. Apple or Google processes the payment and payment-card information under its own terms; Tuguedr does not receive or store the complete payment-card number.
• Other content: documents and information you voluntarily enter or generate through the Services.

Do not place Social Security numbers, complete financial-account credentials, medical information, or other highly sensitive information in fields unless a Tuguedr feature specifically requests that information.

B. Information collected automatically

• Device and network data: IP address, device type, operating system, browser, app version, language, time zone, mobile carrier, and device, account, or analytics installation identifiers.
• Usage and analytics data: pages or screens viewed, buttons selected, session dates and duration, referring URLs, and interactions with features.
• Security data: login events, authentication attempts, suspected abuse, fraud signals, and technical logs used to protect accounts and the Services.
• Cookies and similar technologies: cookies, SDKs, local storage, and comparable technologies used for authentication, preferences, analytics, and security.

At launch, Tuguedr does not request access to precise or approximate device location, contacts, camera, photo library, microphone, advertising identifier, or general device file storage. Analytics and security providers may derive a general region from an IP address without using the device's location permission. We do not use that information to track a user's precise movements.

C. Information from other sources

We may receive information from:

• another user who invites you to a transaction or enters information about you;
• authentication, electronic-signature, payment, analytics, cloud-hosting, email, social-login, and app-store providers;
• public authorities or other persons when reasonably necessary to prevent fraud, investigate abuse, or comply with law; and
• business partners or referral sources, where permitted by law.

3. How We Use Information

We use personal information to:

• create and maintain accounts;
• authenticate users and protect accounts;
• generate, display, deliver, revise, sign, retain, and retrieve user-requested documents;
• invite and connect transaction participants and share transaction records with authorized parties;
• attribute electronic actions to users, detect fraud, and preserve document and signature audit trails;
• process purchases and administer paid features;
• provide service, support, confirmations, security alerts, document reminders, and other transactional communications;
• personalize language, preferences, and the user experience;
• operate, troubleshoot, measure, secure, and improve the Services;
• enforce our Terms, investigate misuse, protect rights and safety, resolve disputes, and comply with legal obligations;
• create aggregated or deidentified information that cannot reasonably be linked to an individual.

Tuguedr does not use signatures, lease contents, or other private transaction documents to train public or third-party artificial-intelligence models. Tuguedr does not currently send user data to OpenAI or another external AI provider. The Services may use deterministic software to assemble documents from a user's selections, but users remain responsible for reviewing every document.

4. How We Disclose Information

We may disclose personal information as follows:

• To transaction participants: information in a lease, invitation, signature request, notice, or related record may be shared with the landlord, tenant, agent, or other person participating in that transaction. A completed agreement and its audit trail may remain available to each party even if another party closes an account.
• To service providers: Google Firebase provides hosting, databases, authentication, and mobile analytics; Google Analytics provides website analytics; BoldSign provides electronic-signature services; SendGrid provides transactional email delivery; Apple, Google, and Facebook provide optional social sign-in; and Apple or Google processes applicable in-app purchases. These and similar providers may process information for us under contractual and platform restrictions. We require providers acting for us to protect personal information as required by applicable law and platform rules, use it only for authorized purposes, maintain appropriate security, and delete or return it when we validly instruct them to do so.
• At your direction: when you request an integration, send a document, invite another person, export information, or otherwise direct disclosure.
• For legal and safety reasons: to comply with law, legal process, or lawful government requests; enforce agreements; detect or prevent fraud or security incidents; or protect the rights, property, and safety of Tuguedr, our users, or others.
• In a business transaction: in connection with financing, due diligence, a merger, acquisition, reorganization, sale of assets, bankruptcy, or similar transaction, subject to appropriate confidentiality protections where required.
• With professional advisers: lawyers, auditors, insurers, and other advisers who need the information to provide services to us.
• In aggregated or deidentified form: information that cannot reasonably identify you may be used or disclosed for lawful purposes. We will not attempt to reidentify information that applicable law requires us to maintain as deidentified.

We do not sell personal information for money. As of the effective date, we do not share personal information for cross-context behavioral advertising or targeted advertising as those terms are defined by applicable U.S. state privacy laws, and we do not track users across other companies' apps or websites for advertising.

5. Cookies, Analytics, and Privacy Signals

We use essential technologies to keep users signed in, remember settings, prevent fraud, and operate the Services. We use Google Analytics on the website and Firebase Analytics in the mobile apps to understand feature usage and improve performance. We do not use Meta Pixel, Google Ads, TikTok Pixel, advertising SDKs, cross-site retargeting, or session-recording/replay tools at launch.

Browser settings may allow you to block cookies, but some features may not function correctly. Because there is not a uniform industry standard for browser “Do Not Track” signals, the Services do not currently respond to those signals. Where required by applicable law, we will process a recognized universal opt-out signal, such as Global Privacy Control, as a request to opt out of applicable sale, sharing, or targeted advertising. This sentence does not imply that Tuguedr currently engages in those activities.

Google Analytics and Firebase Analytics may process device, installation, usage, and general-region information under Google's terms. Tuguedr configures these services for product analytics, not targeted advertising, and does not use them to track users across unrelated third-party apps or websites. On the website, Google Analytics sets first-party cookies (such as _ga and _ga_*) that last up to two years; we have disabled Google signals and ad personalization, and we do not send signing links or their tokens to Google Analytics. You can block cookies in your browser settings or install Google's opt-out add-on at https://tools.google.com/dlpage/gaoptout.

Consent, permissions, and withdrawal

Where consent is required, we request it through a clear affirmative action before the relevant collection or sharing begins. You may withdraw an optional consent by contacting support@tuguedr.com. Withdrawal applies prospectively and does not invalidate processing already lawfully completed. Tuguedr will update this Policy and provide any required notice before introducing a feature that requests a new sensitive device permission or materially changes our data practices.

We will not repurpose personal information for a materially different purpose without providing any additional notice and obtaining any consent required by law or platform rules. If we introduce third-party artificial-intelligence processing of personal information beyond processing necessary to provide a feature you expressly request, we will clearly identify the processing and sharing and obtain explicit permission where required before it occurs.

6. Electronic Communications

At launch, we may send transactional emails concerning account verification, invitations, signatures, completed documents, security, support, or requested Services. Tuguedr does not send SMS messages or push notifications and is not conducting marketing email campaigns at launch. If we introduce marketing emails, each message will include a working unsubscribe mechanism, and opting out of marketing will not stop necessary service or legal communications.

If you give us another person's phone number or email address, you represent that you have authority to provide it and to request the relevant transactional communication. You may not use Tuguedr to send spam or unlawful marketing.

7. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Services, preserving transaction integrity, complying with law, enforcing agreements, resolving disputes, preventing fraud, and maintaining security.

Retention depends on the record:

• account and profile data is retained while the account is active and is deleted or deidentified within 30 days after we verify a valid deletion request, except for the limited records described below;
• incomplete drafts are deleted after 180 days of inactivity and are also deleted when the associated account is deleted;
• executed agreements, consent records, signature audit trails, payment records, and related transaction evidence may be retained for up to seven years after the transaction ends, or longer if required by law, legal hold, dispute, or the legitimate recordkeeping needs of another signing party;
• ordinary support communications may be retained for up to three years, or longer when reasonably necessary for a dispute, security matter, or legal obligation;
• account-linked analytics data is retained for no longer than 14 months before deletion or aggregation, subject to the provider's configured retention controls;
• security logs are retained only as long as reasonably necessary for security and fraud prevention, and deleted account data may remain in encrypted rolling backups for up to 90 days before automatic expiration; and
• information is deleted or deidentified when retention is no longer reasonably necessary, subject to technical backup cycles.

An account-deletion request does not necessarily delete an executed agreement or audit record that is also the record of another party, must be kept to establish or defend legal rights, or must be retained by law. Where possible, we will separate, restrict, or deidentify the requesting user's account information while preserving the necessary transaction record.

Tuguedr is not your exclusive document archive. Each party should promptly download and securely retain copies of signed agreements and notices.

8. Your Choices and Privacy Rights

Depending on where you live and subject to legal exceptions, you may have the right to request that we:

• confirm whether we process your personal information and provide access to it;
• correct inaccurate personal information;
• delete personal information;
• provide certain information in a portable format;
• opt you out of sale, sharing, targeted advertising, or certain profiling, if we engage in those activities; and
• review an appeal if we deny a qualifying request.

You may update certain information in account settings. To submit a privacy inquiry or request concerning your personal information, email support@tuguedr.com with the subject line “Privacy Request.” We may take reasonable steps to verify your identity before processing the request. To request deletion of your Tuguedr account, use the Delete Account option within the application or visit https://tuguedr.com/account-deletion. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and direct identity confirmation. We will not discriminate against you for exercising a privacy right.

You may initiate deletion in the app at Account → Legal → Delete account. The manual request process requires you to email support@tuguedr.com from the email address associated with the account. You may also initiate the request without reinstalling the app by signing in at https://tuguedr.com/account-deletion. We will authenticate the request, explain any information we must retain and why, request deletion from service providers where applicable, and generally complete the request within 30 days unless a longer period is permitted or required by law. We will confirm completion. Account deletion removes the account and associated personal information except for the specific records described in Section 7 that we must or legitimately need to retain. Temporarily disabling or freezing an account is not account deletion, and deleting the app from a device does not delete an account.

You may manage any future optional device permissions through device settings and unsubscribe from any future marketing communications as described above.

9. Information About Other People

Users may enter information about a landlord, tenant, occupant, or other transaction participant. If you do so, you must have a lawful reason and appropriate authority to provide that information, give any notice required by law, and use it only for a legitimate rental transaction. We may notify that person that you supplied their information and identify you as the source.

If you received an invitation you did not expect or believe someone submitted your information improperly, contact us at support@tuguedr.com.

10. No Screening, Identity Verification, or Biometrics

At launch, Tuguedr does not collect selfies or government-identification images, perform liveness or facial matching, create biometric templates, or use an identity-verification provider. Tuguedr also does not perform credit, criminal, eviction, tenant-screening, or background checks and is not a consumer-reporting agency. Account authentication, email delivery, electronic signatures, and audit trails are not guarantees of a person's identity, authority, trustworthiness, financial condition, or suitability.

11. Security

We use administrative, technical, and physical safeguards designed to protect personal information, taking into account its nature and the risks involved. These safeguards include modern encryption for personal and sensitive information in transit, such as HTTPS/TLS, access controls, authentication, logging, and protections appropriate to the systems involved. No system, transmission, or storage method is completely secure, and we cannot guarantee absolute security. Users are responsible for protecting credentials, using secure devices, and notifying us promptly of suspected unauthorized access.

12. Children's Privacy

The Services are for adults age 18 or older. We do not knowingly collect personal information directly from children under 13 or permit minors to create accounts. Information about a minor occupant may appear in a lease when entered by an adult with authority to provide it; that does not permit the minor to use the Services. If you believe a child submitted information directly to us, contact support@tuguedr.com.

13. Third-Party Services and App Stores

The Services may link to or integrate with third-party services. Their privacy practices are governed by their own policies. Apple, Google, other app stores, and device-platform providers may independently process purchase, device, diagnostic, or account information.

The disclosures in this Policy must match the privacy and data-safety disclosures submitted in App Store Connect and Google Play Console. If there is a conflict, contact us; the existence of an app-store disclosure does not reduce rights provided by applicable law.

14. Changes to This Policy

We may update this Policy to reflect changes in the Services, data practices, or law. We will post the revised Policy and update the “Last updated” date. If changes are material, we will provide additional notice as required, such as an in-app notice or email. Where law requires consent, changes will apply only after valid consent.

15. Contact Us

To submit a privacy inquiry or request concerning your personal information, email support@tuguedr.com with the subject line “Privacy Request.” We may take reasonable steps to verify your identity before processing the request. To request deletion of your Tuguedr account, use the Delete Account option within the application or visit https://tuguedr.com/account-deletion.