Privacy Policy

Last updated: July 7, 2026

1. Who We Are

BundleMaker ("we", "us", "our") is a web-based service that helps legal professionals compile court-ready document bundles. Our service is available at bundlemaker.app.

For privacy inquiries, contact us at: privacy@bundlemaker.app

2. What Data We Collect

We collect the absolute minimum necessary to operate the service:

• Email address — used to create and identify your account
• Password — stored as a one-way cryptographic hash (we cannot recover it)
• Bundle count — number of bundles you have generated (used to enforce free plan limits)
• Subscription status — your plan (Free, Solo, or Firm) and Stripe customer ID

We do not collect your name, address, phone number, or any information beyond the above.

3. Your Uploaded Documents

This is the most important section for legal professionals. What happens to your files:

• While you work — your uploaded documents stay in your bundle list, including after you generate, so you can adjust and regenerate the same bundle.
• Every uploaded document is automatically and permanently deleted within 24 hours of upload — sooner if you remove it or start a new bundle. Even if you simply close your browser and walk away, the clock is already running.
• Your finished bundle — automatically and permanently deleted within 2 hours of being created. Download it and it's yours alone.
• We do not read, index, analyse, copy, or retain any content from your uploaded documents, and nothing is ever used to train anything
• No employee or system at BundleMaker has access to your document contents

4. How We Use Your Data

Your email and account data are used only to:

• Authenticate you when you log in
• Enforce your plan limits (free plan: 3 bundles)
• Process your subscription payment via Stripe
• Send transactional emails (receipt, password reset) if applicable

We do not use your data for advertising, profiling, or any purpose other than operating the service.

5. Third-Party Services

We use the following third-party services:

• Stripe — payment processing. Stripe stores your payment card details; we never see or store your card number. Stripe's privacy policy: stripe.com/privacy
• Railway — cloud hosting. Our servers run on Railway's infrastructure in secure data centres. Railway's privacy policy: railway.app/legal/privacy

6. Data Security

• All data in transit is encrypted using TLS (HTTPS)
• Passwords are hashed using PBKDF2-SHA256 with 600,000 iterations
• Session cookies are HttpOnly and SameSite=Lax
• Each user's session data is stored in an isolated directory

7. Data Retention

• Uploaded documents: automatically deleted within 24 hours of upload — sooner if you remove them or start a new bundle
• Generated bundles: automatically and permanently deleted within 2 hours of generation
• Account data: retained until you delete your account

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and all associated data
• Withdraw consent at any time

To exercise any of these rights, email us at privacy@bundlemaker.app. We will respond within 30 days.

9. Cookies

We use a single session cookie to keep you logged in. We do not use advertising cookies, tracking pixels, or analytics cookies.

10. Children's Privacy

BundleMaker is intended for legal professionals. We do not knowingly collect data from anyone under 18.

11. Changes to This Policy

We will notify registered users by email of any material changes to this policy. Continued use of the service after changes constitutes acceptance.

12. Contact

For any privacy questions or requests: privacy@bundlemaker.app