Privacy policy

Last updated 2026-10-20.

Who this covers

This policy covers visitors to this website, people who contact us, and the staff of firms that use Firmstead. When a firm uses Firmstead to store information about its own clients, the firm decides what is collected and how it is used; we process that information on the firm’s behalf and only to provide the service.

What we collect

• Information you send us, such as your name, work email, firm name and message.
• Account information for firm staff, such as name, email, role and sign-in security settings.
• Information a firm and its clients store in the service, such as records, documents and messages.
• Basic technical logs, such as request times and status codes, used to keep the service running and secure.

How we use it

• To provide, secure and support the service.
• To answer your questions and arrange demos.
• To send account and security messages. Emails link back to Firmstead and do not contain client data.

How we protect it

We encrypt information in transit and at rest, encrypt sensitive fields such as Social Security numbers individually, require multi-factor authentication for staff, and keep an audit log of access to sensitive data. See our security page for details.

Sharing

We share information only with service providers that help us run Firmstead (for example hosting, email delivery and payment processing), when a firm asks us to, or when the law requires it. We do not sell personal information or use it for advertising.

Retention and your choices

Firms control how long their records are kept and can export their data at any time. You can ask us to access, correct or delete information about you by emailing hello@firmstead.app. If your information was stored by a firm that uses Firmstead, please contact that firm.

Changes

If we change this policy we will update the date above and, for significant changes, tell firm owners.