Privacy Policy

We collect only what the product needs to draft, send, and track a public records request on your behalf.

• Account data. Name, email, password hash, firm or organization, role, and jurisdiction.
• Matter and request data. The subject of your request, the agency you are writing to, letter drafts, submitted letters, agency responses, and any files you upload or receive.
• Compliance records. Timestamps for your unauthorized-practice-of-law consent, your approval of each AI draft, and every submission you authorize.
• Billing data. Handled by Stripe. We store a customer ID and a per-action charge ledger. We never see or store your full card number.
• Technical data. IP address, browser and device information, and audit logs of access to your matters.

Your data is used to run the service you paid for, and for nothing else. Specifically, we use it to:

• Generate request letters and follow-ups that you review and submit.
• Track statutory deadlines and notify you before they lapse.
• Maintain the audit trail your matter may later depend on.
• Charge you for actions you explicitly authorize.
• Investigate abuse, and comply with law.

We do not sell your data. We do not share it with data brokers or advertisers, and we do not use your matters to target you with marketing.

FOIA FAST uses large language models to draft letters, summarize agency responses, and score exemption risk. All model calls happen on our servers — your browser never talks to a model provider directly.

• No training on your data. We use enterprise model endpoints under agreements that prohibit training on customer inputs and outputs.
• Drafts are drafts. Every AI output is labeled as such, carries a confidence indicator, and cannot be submitted until you approve it.
• Nothing is auto-submitted. No letter leaves the platform without an explicit action from you.

Records are stored encrypted at rest (AES-256) and in transit (TLS 1.2+), in United States data centers. Access to a matter is scoped to the account that owns it and the collaborators that account invites, and every access is written to an immutable audit log.

Our security posture, subprocessor list, and incident response commitments are documented in the trust center.

We keep matter data for as long as your account is active, because a records request is a paper trail you may need years later. You can export any matter at any time.

• Deleting a matter removes it from your workspace and purges it from backups within 30 days.
• Closing your account deletes your matters within 30 days.
• Compliance and billing records — consent timestamps, approval events, and invoices — are retained for seven years, as required for legal and tax purposes, even after deletion.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. You can exercise most of these directly from Settings. For anything else, email [email protected] and we will respond within 30 days.

California residents: we do not sell or share personal information as those terms are defined by the CCPA, and we do not offer financial incentives in exchange for personal information.

If we make a material change to how we handle your data, we will email you and post a notice in the product at least 30 days before it takes effect. Continuing to use FOIA FAST after that date means you accept the updated policy.

Questions about this policy, or about data we hold on you, go to [email protected]. Security reports go to [email protected].