Legal
Privacy Policy
How we collect, use, and protect your information when you use CompleteLane.
Last updated: May 3, 2026
Contents
- 1. Information We Collect
- 2. How We Use Your Information
- 3. File Storage and Security
- 4. Client Portal Data
- 5. Email Communications
- 6. Information Sharing
- 7. Cookies and Similar Technologies
- 8. Data Retention
- 9. Your Rights
- 10. Children's Privacy
- 11. International Data Transfers
- 12. Changes to This Policy
- 13. Contact Us
This Privacy Policy explains how CompleteLane ("we", "us", or "our") collects, uses, and shares information about you when you use our document collection platform (the "Service"). By using the Service, you agree to the practices described in this Policy.
1. Information We Collect
a) Subscriber Account Information
When you create an account, we collect your name, email address, and password (stored as a secure hash). We also collect your organization name. Payment and billing information is processed directly by our billing provider, Polar — we do not store payment card numbers on our servers.
b) Client Data
When you create document requests for your clients, you provide client names and email addresses. Clients who access magic link portals do not create accounts with CompleteLane. We collect the files they upload, their email address (used only to send automated reminders), and metadata about each upload such as file name, size, type, and upload timestamp.
c) Usage and Log Data
We automatically collect log data when you use the Service, including IP addresses, browser type, operating system, pages accessed, features used, and timestamps of actions. This data is used to maintain, secure, and improve the Service.
d) Error and Performance Data
We use Sentry for error monitoring. When an error occurs, Sentry may collect error messages, stack traces, the URL where the error occurred, and basic session context. This data is used solely for diagnosing and fixing issues.
2. How We Use Your Information
- To create and manage your account via Supabase Auth.
- To operate the document request and upload portal features.
- To send automated reminder emails to your clients about pending document submissions.
- To send billing notifications, trial expiration warnings, and payment failure alerts to you.
- To process subscription payments through Polar.
- To schedule and process background jobs (such as reminder batches) via Upstash QStash.
- To monitor errors and improve reliability using Sentry.
- To enforce our Terms of Service and prevent abuse.
- To respond to your support requests and inquiries.
3. File Storage and Security
Files uploaded through magic link portals are stored in encrypted cloud storage using presigned upload URLs. This means files travel directly from the client's browser to encrypted cloud storage — they never pass through CompleteLane's application servers.
Files uploaded on or after May 3, 2026 are encrypted at rest using a unique 256-bit AES data encryption key per file. Each data encryption key is wrapped using an AWS Key Management Service (KMS) customer master key under CompleteLane's control; our cloud storage provider does not retain the data encryption keys after each request. Files uploaded before that date remain encrypted at rest using industry-standard encryption provided by our cloud storage. All data in transit between your browser and our services is encrypted using TLS. We implement row-level security and access controls to ensure that files are only accessible by authorized Subscribers.
You retain ownership of all files uploaded through the Service. CompleteLane accesses file content only as necessary to provide the Service (for example, to serve download links to authorized Subscribers). We log security and access events — sign-in attempts, file uploads, file downloads, role changes, settings changes, and billing events — for 12 months. These records include the IP address and user agent of the requesting device, and are accessible to your organization's owners and admins through the in-app audit log.
4. Client Portal Data
When a Subscriber creates a document request, they provide their client's name and email address. CompleteLane uses this information exclusively to:
- Generate a unique, time-limited magic link for the client to access their upload portal.
- Send the initial request email and automated follow-up reminder emails.
- Display the client name in the Subscriber's dashboard.
Clients are not required to create an account, provide a password, or share personal information beyond their uploads. CompleteLane does not use client data for marketing, profiling, or any purpose other than delivering the document collection service on behalf of the Subscriber.
Subscribers are responsible for having appropriate authorization to share their clients' contact information with CompleteLane and for complying with applicable privacy laws in their use of the Service.
5. Email Communications
We send emails through Resend, our email delivery provider. The types of emails we send include:
- Initial document request emails to clients (sent once when a request is created).
- Automated reminder emails to clients with outstanding documents (up to 5 reminders per request, spaced at least 48 hours apart). Reminders stop automatically when all documents are uploaded.
- Completion notifications to Subscribers when all documents in a request have been received.
- Trial expiration warnings to Subscribers (sent 3 days before the trial ends).
- Payment failure notifications to Subscribers.
- Service announcements and important policy updates.
To suppress specific transactional emails or update your communication preferences, contact us at privacy@completelane.com.
6. Information Sharing
We do not sell your personal information. We share information only with trusted sub-processors, and only as necessary to operate the Service:
We engage a small number of trusted sub-processors to deliver the Service (for example, hosting, storage, email delivery, error monitoring, and billing). A current list, including each sub-processor's purpose and processing region, is available at /subprocessors.
We may also disclose information when required by law, to protect our rights, or in connection with a business merger or acquisition (in which case we will notify you before your data is transferred).
8. Data Retention
Subscriber account data and uploaded files are retained for the duration of your subscription. You may request deletion at any time. Deletion completes automatically within 30 days of your verified deletion request. If your subscription ends — either by cancellation, non-payment, or expiry of a free trial — your account data and uploaded files are automatically deleted within 60 days, unless you re-subscribe within that window. Some data may be retained longer where required by law or to resolve disputes.
- Client email addresses and names are retained for the lifetime of the associated document request.
- Email delivery logs and reminder records are retained for 90 days.
- Error logs collected via Sentry are retained per Sentry's default retention policy (90 days for the free tier).
- Audit log entries are retained for 12 months from the date of the event, after which they are automatically purged.
9. Your Rights
EU / EEA Users (GDPR)
If you are located in the European Union or European Economic Area, you have the right to access, rectify, erase, restrict processing, and port your personal data. You also have the right to object to processing and to lodge a complaint with your local supervisory authority.
California Residents (CCPA)
California residents have the right to know what personal information we collect and how it is used, to request deletion of their personal information, and to opt out of the sale of their personal information. We do not sell personal information.
To exercise any of these rights, contact us at privacy@completelane.com. We will respond within 30 days.
10. Children's Privacy
The Service is not intended for individuals under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will delete it promptly.
11. International Data Transfers
Your information may be stored and processed in the United States or other countries where our service providers operate. By using the Service, you consent to such transfers. We ensure that transfers to third-party providers occur under appropriate safeguards, such as standard contractual clauses where required.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by emailing the address associated with your account or by posting a prominent notice on the Service. Your continued use of the Service after changes take effect constitutes your acceptance of the updated Policy.
13. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us:
CompleteLane
Email: privacy@completelane.com