Privacy Policy

Effective date: 2026-10-23. Last reviewed: 2026-10-23.

DocPost is a legal technology platform. It is operated by Goliath Dynamics Inc. ("GDI", "we", "us"), a Florida corporation with its principal place of business at 7901 4th St N, STE 300, St. Petersburg, FL 33702.

This Privacy Policy explains what personal information we handle when you use DocPost, why we handle it, who we share it with, and the choices and rights you have. It applies to the DocPost web application, our marketing pages, our APIs, and the e-signature signing flow at signing links.

This policy is written to satisfy our obligations under the U.S. Electronic Signatures in Global and National Commerce Act (ESIGN), state Uniform Electronic Transactions Acts (UETA) and equivalent state law, the Health Insurance Portability and Accountability Act (HIPAA) where DocPost handles electronic protected health information ("ePHI"), the EU and UK General Data Protection Regulations (GDPR / UK GDPR), and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Who this policy applies to

DocPost has two categories of users:

(a) Account holders — people who sign in to an organization workspace on DocPost. We are the data controller for account-holder personal information (name, email address, organization membership, authentication state, billing identity, and product activity).

(b) Signers — people who receive a signing link and complete an electronic signature inside a sender's signing flow. For signer personal information processed inside a specific signing transaction, the sender (the organization that initiated the signing request) is the controller and DocPost is the processor acting on the sender's instructions. The processing notice we surface to signers at signing time is the DocPost E-Sign Act & Data-Processing Disclosure that appears in the signing flow; the same notice is the E-Sign Act & Data-Processing Disclosure.

This Privacy Policy describes both categories. Where a section applies to only one, we say so.

2. Personal information we handle

We handle the following personal information:

Account-holder information

Identity: name, email address, phone number (optional, for SMS two-factor authentication if enrolled), profile photo (optional), organization name and role.
Authentication: one-time passcodes (OTPs) delivered to your email, session tokens, multi-factor authentication state, IP address and user-agent string at sign-in.
Billing: business name, billing email, payment method on file at our payment processor (Stripe; card numbers themselves are stored by Stripe, not by DocPost), invoice history, subscription plan, seat counts, and usage-pack balances.
Product activity: documents you create, upload, send, sign, and store; the contents of those documents; templates you define; signature requests you initiate; webhook destinations you configure; API keys you mint (we store only a salted hash of the secret, never the plaintext after creation); support requests; and the audit-log events your actions produce.

Signer information (signing transactions on behalf of senders)

Identity: name, email address, IP address, device fingerprint, user-agent string, and the image of the signature you draw or upload.
Signing activity: the time you opened the signing link, the time you completed each action, the content of every field you complete, your ESIGN / UETA consent affirmation, your intent-to-sign affirmation, and any decline or consent-withdrawal events.
Tamper-evidence: a SHA-256 hash of the final document, a hash-chained audit log (every event carries the SHA-256 of the previous event so any later tampering is detectable), and an RFC-3161 timestamp from a trusted timestamp authority.

Marketing-surface visitors

Information you voluntarily submit through public contact / chat / "Request access" / "Talk to sales" flows.

Everyone who visits DocPost

Server request logs: for every page you load, our servers record your IP address, the address of the page, your user-agent string, the time, the device identifier described next, and, if you are signed in, your account. We keep them as described in §6.
Cookies and browser storage: DocPost's own cookies keep you signed in, carry a sign-in that is in progress, and hold a device identifier that our own code computes in your browser. We use that identifier to detect and prevent fraud and abuse; it is never sent to a third party. Your browser's storage also keeps your preferences, such as the appearance you chose, and your choice about Google Analytics. We rely on our legitimate interests for these (§4), so we do not ask first; you can object (§8).
Usage analytics, described next.

Usage analytics (Google Analytics)

We use Google Analytics, a service of Google LLC, to understand in aggregate how people find and use DocPost. It runs on our public pages and in the signed-in app.
Your choice. If you are in the European Economic Area, the United Kingdom or Gibraltar, Google Analytics does not run until you accept it in the cookie notice we show you, and it stays off if you decline. We judge where you are in your browser, from your device's time zone or, when that names no place, your device's language; we do not look up your location. Everyone else is measured unless they decline. Anyone can accept or decline at any time under Cookie settings, which is also linked at the foot of our pages. We keep your choice in your browser; if you accepted, we ask again after 13 months.
Google Analytics sets cookies on our site whose names begin with _ga. They hold a random identifier for your browser and expire two years after your last visit.
For each visit, Google Analytics receives the page you viewed; your browser, operating system, device type, screen size and language; your approximate location (country, region and city), which Google derives from your IP address; the website that referred you, reduced to its home address; any utm_ campaign tags in the link you followed; and engagement events: time on the page, scrolling most of the way down it, starting or submitting a form (never what you type into it), and playing an embedded video. Google states that Google Analytics does not log or store IP addresses.
What we report as the page you viewed: for a public page (a case, statute or article page, or a marketing page), its public address and title. For a page in the signed-in app, only the kind of page it is, for example "an organization's workspace page", and never your organization's name, a document's name, an identifier, a search term or anything else from the page's address or contents. We remove every part of an address after a "?" except utm_ campaign tags.
We do not send Google Analytics your name, email address, account or organization. We have not turned on Google Analytics' User-ID, user-provided data, Google signals or advertising-personalization features.
Signing transactions. Google Analytics does not run on the pages of a signing transaction: the signing page a signing link opens, the page that downloads a completed document, and the certificate verification page. Nothing about a signer, a signing request or a signed document is sent to Google Analytics.
You can stop Google Analytics from measuring your visits; see §8.

Electronic protected health information (ePHI)

A signing transaction or a document uploaded to a workspace may itself contain ePHI (for example, a HIPAA authorization, a release of medical records, or a BAA-covered services agreement). Where DocPost handles ePHI on behalf of a covered-entity customer, we do so as a HIPAA business associate under a Business Associate Agreement ("BAA"). We do not access, use, or disclose ePHI other than as permitted by the BAA, the customer's written instructions, and applicable law. We do not require ePHI to operate the service.

Inferred or derived information

Bot/abuse signals derived from request metadata (rate, fingerprint patterns) for in-house abuse prevention; we do not use third-party bot-management vendors or sell this signal.

What we do not handle

Government-issued identifier numbers (e.g. SSN, passport number) are not required by DocPost to use the service. If a customer's signing flow asks a signer for such an identifier as a form-field value, the value is treated as signer information above and surfaces to the controller (the sender), not to DocPost as controller.
Payment-card numbers are processed and stored by our payment processor (Stripe), not by DocPost.
We do not use advertising cookies, and we do not sell or "share" personal information for cross-context behavioral advertising.

3. Why we handle personal information

We handle personal information for these purposes:

(a) To deliver the service you asked for — sending and receiving signing requests, generating the certificate of completion, storing documents in your workspace, fulfilling API calls, and so on.

(b) To produce tamper-evident evidence that a signature happened — the audit log, document hash, and TSA timestamp described in §2 exist so that the resulting contract is enforceable against the parties.

(d) To bill account holders accurately, including computing seat counts and pack-balance consumption.

(e) To send transactional notices that the service requires — signature-request invitations, completion notices, decline notices, security alerts, billing receipts. These are not marketing; you cannot opt out of them while you continue to use the service.

(f) To send product, marketing, and account-status emails you have opted in to receive. You can manage these at /notifications and unsubscribe from the link in any such message.

(g) To comply with applicable law and respond to lawful requests from courts, regulators, and law-enforcement authorities.

(h) To understand how people find and use DocPost, and to improve it, through usage analytics: our own aggregated, deidentified usage measures and Google Analytics (§2). We do not train AI models on customer documents — see §10.

When we process personal information of individuals in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following Article 6 lawful bases:

Article 6(1)(b) — performance of a contract — for account-holder data necessary to provide the service you signed up for and for billing.
Article 6(1)(f) — legitimate interests — for (i) producing tamper-evident evidence of who signed, when, from where, and on what device, so that the resulting contract is enforceable against the parties; (ii) detecting and preventing fraud, impersonation, link sharing, and replay attacks against the signing flow; (iii) understanding, through usage analytics (§2), how people find and use DocPost so that we can improve it, except where §2 says we ask for your consent first; (iv) protecting DocPost and the people who use it from fraud and abuse, through our server request logs and the device identifier (§2); and (v) remembering your preferences. We have weighed these interests against the rights and freedoms of data subjects and reasonably consider that participants in a commercial e-signature workflow expect this evidentiary processing and would not reasonably object to it, and that visitors expect a site to guard itself against fraud and abuse and to remember the choices they make on it. The balancing record for the signing-transaction case is in the published E-Sign Act & Data-Processing Disclosure. For usage analytics, Google Analytics receives only what §2 lists, never measures a signing transaction, has its advertising features turned off, and can be stopped at any time (§8).
Article 6(1)(a) — consent — for optional features that are not necessary to the service (for example, opting in to product-marketing emails or to SMS two-factor authentication), and for Google Analytics when you are in the European Economic Area, the United Kingdom or Gibraltar (§2). You can withdraw this consent at any time without affecting your access to the service.
Article 6(1)(c) — legal obligation — when we must process personal information to comply with a law that applies to us.

For signing-transaction personal information, the sender is the controller and DocPost is the processor; the sender determines and notifies the lawful basis.

We share personal information only as follows:

(a) Sub-processors and infrastructure providers acting on our written instructions:

Google Cloud Platform — hosting, compute, object storage (Google Cloud Storage), managed databases. Region(s): primarily United States. Bound by Google's Cloud Data Processing Addendum.
Stripe — billing and payment processing for paid plans. Card data is collected directly by Stripe.
Amazon Web Services (Simple Email Service) — outbound transactional email delivery.
Google (Google Analytics) — usage analytics for our public pages and the signed-in app. It receives only what §2 lists, and never the contents of a document, signing-transaction information, or ePHI. Google processes this information for us under the Google Ads Data Processing Terms. See how Google uses information from sites that use its services.
A trusted timestamping authority — RFC-3161 timestamps for signature events. Only a SHA-256 hash of the content being timestamped is sent; the document itself is not transmitted to the timestamp authority.
Large-language-model providers used to power optional product features (e.g. Google Gemini). LLM use is governed by §10 (no-training guarantee); the per-provider enumeration, contractual terms, and per-call-site verification are published in our Data Processing Agreement.
Where you connect a third-party storage provider yourself (e.g. Google Drive), DocPost exchanges the documents you direct it to with that provider under the OAuth grant you authorize.

(b) Other users in your organization — documents, signature requests, and activity are visible to other members of your organization workspace based on role and access settings the workspace administrator controls.

(c) Counterparties — signers and approvers you invite to a signature request receive the documents, fields, and metadata necessary to complete their step.

(d) Senders (for signer information) — when you sign a document on DocPost, the sender (the organization that initiated the request) receives your signing-transaction information described in §2 and the audit trail.

(e) Recipients of contracts you elect to share — for example, when you elect to export a completed envelope into a connected cloud-storage provider, that provider receives the export.

(f) Professional advisors and acquirers — auditors, accountants, lawyers, and counterparties involved in a corporate transaction (financing, merger, reorganization, sale of assets, or insolvency), subject to confidentiality and proportionate to the legitimate need.

(g) Government and law enforcement — when required by valid legal process or as needed to protect the rights, property, or safety of GDI, our customers, or others.

We do not sell personal information and we do not "share" personal information for cross-context behavioral advertising as defined by California Civil Code §1798.140.

6. Retention

We retain personal information only for as long as we need it for the purposes described above and to meet our legal, accounting, and reporting obligations.

Audit-trail data on a completed envelope is retained for the duration of the signed contract plus any limitation period applicable to claims arising from it. Deletion of audit data after a signature has been affixed may invalidate the legal effect of the signature; if you require earlier deletion, contact the sender (controller).
Account-holder records are retained while the account is active and for a reasonable post-termination window to honor open billing and legal-hold obligations.
Server request logs (§2) are retained on a rolling per-month basis for abuse prevention and capacity planning, and then aged out.
Google Analytics deletes event-level data two months after it is collected, and user-level data fourteen months after the browser's last visit. Reports that aggregate many visits and identify no one are kept.
Backups containing the above categories are retained on a rolling schedule and rotate out within the backup window.
ePHI handled under a BAA is retained per the BAA, the customer's instructions, and HIPAA requirements; on termination, we return or destroy ePHI as the BAA specifies.

7. Storage location and international transfers

GDI stores personal information in the United States through the DocPost platform. If you access DocPost from outside the United States, you understand and agree that your personal information will be transferred to, processed in, and stored in the United States.

For transfers of EEA, UK, or Swiss personal information into the United States, we rely on the European Commission's Standard Contractual Clauses and equivalent UK and Swiss addenda as the transfer mechanism, supplemented by appropriate technical and organizational measures.

8. Your rights

Account holders. You may at any time:

access, correct, or update your account information through your profile and organization settings;
export the documents and signing data that your role permits;
close your account by contacting us at the address in §13 (we will then delete or anonymize your personal information, subject to the retention rules in §6 and any legal-hold obligation).

Signers. DocPost acts as a processor for signing-transaction personal information; the sender is the controller. Direct rights requests (access, rectification, restriction, portability, erasure, objection) to the sender. We will assist the sender as required by applicable data-protection law. The published E-Sign Act & Data-Processing Disclosure — the same notice surfaced at signing time — also explains your right to receive a paper copy, your right to withdraw consent before completing your signature, and what happens to your slot if you do. The published PIPEDA Canadian-Handling Notice records the PIPEDA-specific appropriate-purposes / business-necessity basis (subsection 5(3) and Principles 4.2/4.4/4.5) for the same signing-transaction processing, parallel to the GDPR Article 6(1)(f) framing in the disclosure.

Analytics. You can accept or decline Google Analytics at any time under Cookie settings, which is also linked at the foot of our pages. Declining turns it off in that browser at once and deletes its cookies, and DocPost works the same either way. You can also block or delete its cookies (names beginning with _ga) yourself, or install Google's opt-out browser add-on. Because we do not give Google your identity (§2), we cannot find your Google Analytics data from your name or email address; if you send us the value of your _ga cookie at the address in §13, we will delete the Google Analytics data held for that browser.

Objecting. Where we rely on our legitimate interests (§4), including to protect DocPost against fraud and abuse and to remember your preferences, you may object at any time by writing to us at the address in §13. We will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the information to establish, exercise or defend legal claims.

General. You also have the right to lodge a complaint with a supervisory authority — your local data-protection authority in the EEA/UK, the Office of the Privacy Commissioner of Canada under PIPEDA (see the PIPEDA Canadian-Handling Notice §9 for routing), or the relevant authority in your jurisdiction.

We do honor Global Privacy Control signals where the law requires it for opt-out of sale or sharing; because we do not sell or share personal information for cross-context behavioral advertising, this signal does not change our processing.

9. HIPAA and ePHI

Where DocPost handles ePHI on behalf of a covered entity, we do so under a Business Associate Agreement. We maintain administrative, physical, and technical safeguards for ePHI as required under the HIPAA Security Rule. To request a BAA, contact us at the address in §13.

We do not use ePHI for any purpose other than the permitted purposes set out in the BAA and applicable law. We do not train AI models on ePHI.

10. No AI training on customer data

We do not train any AI or machine-learning model on the contents of customer documents, signing fields, audit trails, or ePHI. Where optional product features call an external large-language-model provider on behalf of a customer (for example, to support natural-language search over the customer's own executed agreements), we use the provider under contractual terms that prohibit the provider from training or fine-tuning models on the content we submit and that require zero-retention or short-retention handling of inputs and outputs. Our published Data Processing Agreement is the public source of truth — it names every LLM provider DocPost calls, the contractual no-training terms each call is bound by, and the per-call-site verification that no customer document content is sent under terms that permit provider-side training. A customer who wants to disable LLM-powered product features against their content can do so per organization under §8 of that page.

11. Security

We protect personal information with technical and organizational safeguards including encryption in transit (TLS) and at rest (Google Cloud Storage), least-privilege access controls, multi-factor authentication for workforce access, tamper-evident audit logging (hash-chained audit log; RFC-3161 timestamps), backup and disaster-recovery procedures, vendor management, vulnerability management, and workforce security training. No system can be guaranteed against every possible breach; if a breach occurs, we follow documented breach-notification procedures.

12. Children

The DocPost platform is a contracts and e-signature service for business use. It is not directed to children under 16 and we do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us at the address in §13 and we will delete it.

13. Contact

For privacy questions, rights requests, or to request a BAA, or contact:

Goliath Dynamics Inc. Attn: Privacy 7901 4th St N, STE 300 St. Petersburg, FL 33702 United States

For questions about a specific signing transaction, contact the sender — they are the controller for that flow.

14. Changes to this policy

We may update this Privacy Policy from time to time. The "Effective date" at the top of this policy records the date of the current version.

This is version 3. Google no longer uses the information Google Analytics collects for us to improve Google's own products and services (§5(a)). Version 2 took effect on 2026-10-21. It added our use of Google Analytics, with a cookie notice that asks visitors in the European Economic Area, the United Kingdom and Gibraltar first; the cookies and browser storage we use; the full scope of our server request logs; and your right to object to what we do on our legitimate interests (§2, §3(h), §4, §5(a), §6 and §8). Version 1 took effect on 2026-06-24.