Privacy Policy

PropperDocs, Inc., doing business as Propper (“Propper,” “Company,” “we,” “us,” or “our”) is committed to protecting the privacy and security of personal information entrusted to us. This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information in connection with our websites, applications, platforms, and related services (collectively, the “Services”).

This Privacy Policy is built on a small set of data-protection principles: we collect only the personal information we need, use it only for the purposes described here, retain it only as long as those purposes require, protect it with documented security controls, and honor your rights to access, correct, and delete it.

1. Roles and Responsibilities

Propper processes personal information in one of two roles:

• Data Controller – where Propper determines the purposes and means of processing (e.g., account administration, billing, marketing).
• Data Processor – where Propper processes personal information solely on behalf of customers and in accordance with their documented instructions (e.g., documents uploaded for signature or approval).

Where Propper acts as a data processor, the customer is responsible for determining the lawful basis for processing and for responding to data subject requests.

2. Categories of Personal Information Collected

Information Provided by Users

• Identifiers and contact information (name, email, phone number)
• Account credentials and profile information
• Billing and payment information
• Electronic signature and transaction participation data
• Customer support communications

Information Collected Automatically

• IP address and device identifiers
• Browser type, operating system, and application metadata
• Usage logs, audit trails, and activity timestamps
• Approximate or precise geolocation (where enabled)

Information from Third Parties

• Customer-provided transaction participant data
• Authorized integrations and service providers
• Affiliates and business partners, where legally permitted

3. Purpose Limitation and Use of Data

Propper processes personal information strictly for legitimate business purposes, including:

• Provision, operation, and maintenance of the Services
• Identity verification, authentication, and access control
• Transaction integrity, auditability, and non-repudiation
• Billing, invoicing, and contract administration
• Customer support, training, and service communications
• Security monitoring, incident detection, and fraud prevention
• Compliance with legal, regulatory, and contractual obligations
• Internal analytics, service improvement, and product development

Personal information is not used for purposes incompatible with those listed above without notice or consent where required by law.

4. Cloud Integrations and API Access

Propper supports optional integrations with third-party cloud services (e.g., Google Drive, Google Contacts, Dropbox).

• Access is explicitly user-initiated and read-only
• Data access is limited to user-selected content only
• All transfers occur over encrypted HTTPS connections
• Data is stored and processed within secure cloud environments
• Propper complies with the Google API Services User Data Policy

Propper does not sell, mine, or monetize cloud-sourced data.

5. Information Security Controls

Propper maintains a comprehensive information security program designed to protect personal information against unauthorized access, disclosure, alteration, or destruction.

Security controls include, but are not limited to:

• Role-based access controls and least-privilege enforcement
• Encryption of data in transit and at rest
• Logical and physical access restrictions
• Continuous monitoring and logging
• Vulnerability management and patching
• Incident response and breach notification procedures
• Employee security awareness and confidentiality obligations
• Vendor risk management and contractual safeguards

Access to personal information is limited to authorized personnel with a legitimate business need.

6. Data Retention and Deletion

Personal information is retained only for as long as necessary to:

• Fulfill contractual and service obligations
• Meet legal, regulatory, or audit requirements
• Resolve disputes and enforce agreements

Upon termination of Services or upon customer instruction (where applicable), personal information is deleted, anonymized, or securely archived in accordance with documented retention schedules and technical limitations.

7. Data Sharing and Disclosure

Propper may disclose personal information to:

• Service providers performing services under contractual confidentiality and security obligations
• Affiliates under common ownership, subject to this Policy
• Transaction participants as required to complete electronic transactions
• Legal or regulatory authorities where required by law
• Successor entities in connection with corporate transactions

Propper does not sell personal information. When we report an ad conversion to Google Ads with a hashed email address (see Section 13), Google acts as our service provider for conversion measurement only. We do not use that data for ad targeting, remarketing, or audience lists.

8. International Data Transfers

Personal information may be processed in jurisdictions outside the user’s country of residence, including the United States. Where required, Propper relies on appropriate safeguards, including contractual protections and recognized transfer mechanisms.

9. User Rights and Requests

Depending on jurisdiction, individuals may have rights to:

• Access, correct, or delete personal information
• Restrict or object to certain processing activities
• Withdraw consent where applicable
• Request data portability

Requests may be submitted to support@propper.ai and will be handled in accordance with applicable law and contractual obligations.

10. Children’s Data

The Services are not intended for use by individuals under the age of 18. Propper does not knowingly collect personal information from minors.

11. Changes to This Policy

Propper may update this Privacy Policy to reflect changes in legal requirements, security practices, or business operations. Material changes will be communicated as required by law.

12. SMS / Mobile Information

When you use Propper to send agreements via SMS, we collect and process the recipient’s mobile phone number, the SMS messages we send, and any opt-out (STOP) or help (HELP) replies received from the recipient.

Mobile phone numbers and SMS opt-in / consent data are not shared with third parties or affiliates for marketing or promotional purposes.

We share mobile numbers only with our SMS service provider (Twilio Inc.) as a processor solely to deliver the transactional messages you request.

Lawful basis. We process this data on the basis of the Sender’s attestation of consent (see Section 20 of our Terms of Service) and our legitimate interest in delivering the signing service the Sender has asked us to perform.

Retention. We retain SMS delivery records for the lifetime of the associated agreement, plus the audit-trail retention period applicable to that agreement under our Data Retention Policy.

Opt-out and help. Recipients may reply STOP to any Propper SMS to opt out of further SMS for that agreement, or reply HELP for help. You may also contact support@propper.ai for assistance with SMS preferences.

13. Analytics, Advertising Measurement, and Cookies

On our marketing website we use Google Analytics to understand how the site is used, and Google Ads conversion measurement to understand whether our advertising leads to signups and purchases. The cookies involved, their providers, durations, and consent categories are listed in our Cookie Policy.

Google Analytics

Google Analytics, provided by Google, uses cookies to collect information about how visitors use our website, such as pages viewed, referring sources, and approximate location. We use it to improve our website and marketing. Analytics cookies are set only after you consent to marketing cookies.

Google Ads conversion measurement

When you arrive from a Google ad, the ad click identifier in the page address (for example, gclid) and campaign parameters (UTM parameters) may be recorded. If you consent to marketing cookies, we store them for up to 90 days in Google Ads cookies and in a first-party cookie named propper_ads on .propper.ai, so that a later signup or purchase can be attributed to the campaign that led to it.

Consent mode

We use Google consent mode. Before you make a choice, or if you decline marketing cookies, the Google tags on our website do not set or read the advertising and analytics cookies described above. They may still send limited, cookieless pings to Google that include your consent state and basic request information, such as the page address, referrer, and browser details, which Google uses for aggregated conversion measurement. Ad click identifiers may also be carried in page URLs between our pages so that a conversion can be measured without cookies.

Hashed email matching for conversion measurement

When you sign up for or purchase a Propper product after clicking a Google ad, we may report that conversion to Google Ads from our servers. The report includes the ad click identifier and a SHA-256 hash of your email address, which Google Ads can match to Google accounts to attribute the conversion. We use this only for conversion measurement. The email address itself is not sent in this report. Google processes this data on our behalf under the Google Ads Data Processing Terms.

How to opt out

• Use the cookie banner or the cookie settings on our Cookie Policy page to decline marketing cookies or to withdraw consent at any time.
• Manage or turn off ad personalization in Google Ad Settings.
• Install the Google Analytics opt-out browser add-on.
• Contact us at support@propper.ai to ask us to stop using your information for advertising measurement.

Declining marketing cookies does not affect your ability to use our Services. Learn more about how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites.