In effect from 12 October 2026
Someone — usually a financial advisor, accountant, lender or agent you work with — sent you a link and asked you to answer some questions or send them some documents. This page explains what happens to what you send.
It is written for you, not for them. There is no legal vocabulary in it.
The firm that asked you. They receive everything you send. They asked for it, they decide what happens to it, and they are who you should talk to about it.
Us. We are Overlook Innovations, LLC, a company in the United States that makes Cartenda, the software the firm uses to collect documents. We hold your documents on that firm's behalf and act on their instructions. We do not decide what happens to them and we cannot use them for anything else.
If you were not expecting the form, call the firm on a number you already have for them — from a letter, an invoice, or their website you looked up yourself. Not a number from the message you received. That advice is worth following whoever sent it.
The answers you type, the files you upload, and the date and time you send them. The internet address your submission came from is recorded with it.
If you type an address, what you have typed so far is sent from our server to Google, which suggests the full address to pick from. Google receives only that line, never your name or anything else you wrote.
If your firm asks you to sign what you send, the name you type, the words you signed, where your code was sent and when, which version of the disclosure about signing electronically you agreed to, the browser you signed from, and, if you sign as more than one role, such as the client and a trustee, which role each signature was given as, are recorded too. The code itself is thrown away once it has been used or has expired.
A record of the signing is kept as well: when your code was sent, when you agreed, and when you signed, in a log that shows whether anything in it has been changed since. It is made into a document the firm can download, and you are sent a link to your own copy, which opens once you enter a new code. Once a day, a fingerprint of that day's records is sent to an independent timestamping service, so the date can be proven later. A fingerprint reveals nothing about what you wrote.
That is all. No location. No advertising. Nothing that follows you afterwards. No third-party code runs on the page, with one exception: where a question offers to attach a file from a drive such as Dropbox, Google Drive or OneDrive, the page loads that company's own code so its button can open. The firm's page for you does the same where it lets you add files to a vault. If you press the button, it asks you to sign in to your own account, lists your files there, and the one you pick comes to us as an upload would.
The firm chooses. Many are required to keep records for years, and documents are kept until the firm sets a time to delete them. When that time comes they are permanently deleted — genuinely deleted, not hidden or archived. If you signed, your signature and the record of it are deleted with them. Deleted documents can remain in our encrypted backups for up to 30 days, which are kept only to recover from a failure, and then they are gone from those too.
The firm can also keep a document in a vault for you and the people it serves with you, such as your household. A document in a vault is not deleted on that schedule. It stays until the firm removes it or stops serving you, and is then permanently deleted. If the firm keeps something you sent in a vault, the vault holds a copy, which stays after the original is deleted.
In the same way, the firm can keep some of your answers on your record, such as your date of birth or your employer, so that forms it sends you later arrive filled in for you to confirm. Nothing is kept that way until somebody at the firm chooses to keep it. A kept answer is not deleted on the firm's schedule for what you sent: it stays on your record until the firm removes it or deletes your record. A Social Security or account number kept this way is stored as your reply stores it: encrypted, shown by its last four, and read whole only by somebody at the firm allowed to, who has just confirmed their password, each time recorded. A later form shows you only its last four.
If you filled in a form through a link the firm published, rather than one it sent to you by name, and the firm does not already have you as a client, the firm is shown your name and email address and how much you sent, and nothing else, until it confirms you as a client. If it has not within 30 days, what you sent is permanently deleted.
The firm keeps its own record of what it asked you for and what arrived, because that is their professional record. That record outlives the documents.
If you want to know the firm's exact window, ask them. It is their setting, and they can tell you what it is.
Staff at the firm you sent it to.
If the firm asked more than one person to answer the same request, such as you and your spouse, each of you answers your own part at your own link. Each of you sees the others' first names, their role on the request, and how far along they are (not started, in progress, sent, waiting to sign or signed), and never what they wrote. If the firm asks more than one of you to sign, you each see the whole of what was sent before you sign it, you each sign all of it, and each signer's copy of the record shows all of it. The firm can read your part as soon as you send it, before everybody else has sent theirs. The person the request is for can answer someone else's part themselves, before that person has started it and with their agreement: the answers are kept as that person's part, the firm and the record show who typed them, and what they say about that person is kept as theirs. The other person is no longer asked for them, and sees them only if they sign. Where the form lets you correct what the firm has on file about you, each of you sees and corrects only your own details, never anyone else's. If a request reached you by mistake, or you have no part in it, you can say so from your link before you have saved anything: your link closes, you are not reminded, and the firm is told which of the two it was, along with anything you chose to add. Until you send your part, the firm can ask somebody else to answer it or take you off the request; anything you typed or uploaded and had not sent is then deleted, never shown to anyone, and your link says so. The firm can also answer your part for you: what it sends is recorded as the firm's, not yours, and if you are asked to sign, you still sign it yourself.
Our staff, only where it is needed to run or repair the service. Every time one of your documents is opened through the service, by anyone, it is written to a record the firm can read and nobody can alter or erase.
You. The firm has a page where you can look back at what has passed between you: what you sent, what they sent you, and what they are still waiting on. It opens with a code sent to the email address the firm has for you, so anyone who can read that inbox can open it. It also opens if you sign in on our website with a Google or Microsoft account that has that same address: Google or Microsoft then tells us the address is yours, along with your name (Google adds your profile picture). We keep only the address. Social Security and account numbers are shown there by their last four digits only, and only what was sent to or by you is shown, not what a spouse or business partner sent. It shows what the firm still keeps: once something is deleted, it is gone from that page too.
The exception is a vault. If the firm keeps documents in a vault for you and the people it serves with you, such as your household, everyone the firm lets into that vault sees the same files there, and the firm decides who that is, person by person. A document you sent is put in a vault only if somebody at the firm chooses to after looking at it, or if you add it to the vault yourself, where the firm lets you. Each time somebody opens a file in a vault, it is written to the firm's record.
If more than one firm that uses Cartenda has the same email address for you, signing in once lets you open each firm's page. Each firm's record is separate, and no firm sees what another holds.
Unless the firm has turned it off, our software reads each document to work out what it is, pull out the figures the firm asked for, and summarize what arrived. If your form was in Spanish, it also translates your answers into English for the firm, and keeps what you wrote as you wrote it. Social Security and account numbers are never sent to be translated. This runs on our own systems in the United States.
Your documents are not used to train artificial intelligence, are not sent to anyone else, and are not used for any purpose other than giving the firm the result.
Some firms keep documents in their own storage instead. Where that is set up, the document goes straight to the firm and we do not read it.
Some firms add an assistant to their form: an Ask about your form button in the corner. If you type a question into it, what you type goes to Claude, an artificial intelligence made by Anthropic, together with the questions on your form, the answers you have saved so far and what your firm filled in for you, so that it can answer you. Claude runs on Amazon Bedrock, in our own Amazon Web Services account, in the United States.
What you type is used only to answer you. It is not used to train artificial intelligence, Anthropic never receives it, and Bedrock keeps neither your question nor the answer. We keep the answer only until your page shows it to you, and delete it within two hours at the latest. Your firm does not see the conversation. It sees your answers, once you send them.
The assistant cannot change your form. What it suggests is a button, and nothing goes into your form unless you press it. Do not type your full Social Security number or an account number into it. If you type a Social Security number anyway, we hide it before your question reaches Claude.
Your firm may also use an assistant when it reads what you sent. It works the same way, on the same systems, under the same rules.
If something on your form is not working, you can say so with Report a problem with this form at the bottom of the page. What you write goes to your firm, which sees it beside your request, and to us, so that we can fix the form. Our copy says which request it came from, but not your name or how to reach you, and a Social Security number in it is hidden before we keep it. We keep our copy for no more than a year and use it only to find and fix what went wrong. We never write to you about it; your firm does.
Your firm may send the link by text instead of, or as well as, by email — and the code you sign or open files with arrives the same way. We text a number only where somebody at your firm has confirmed you agreed to that, or where you agreed yourself, on a form your firm sent you. Where you agree on a form, we keep when you did, the number you agreed for and the form you agreed on, so there is a record of it. Either way, our first text asks you to reply YES, and nothing else is texted to you until you do, except your firm's answer to a text you send them. We keep when you replied.
On a form that shows your details, you can choose how your firm reaches you: by email, by text or both. Choosing email turns texts off, and your firm cannot switch them back on for you. A few messages, such as the receipt for what you send, always come by email.
Every message says which firm it came from. Reply STOP to any of them and the texts stop; your firm can see that you asked, and cannot switch it back on. If you change your mind, reply START.
What the texts are, how often they come and how to stop them are in the text message terms.
No mobile information is sold or shared with third parties for promotional or marketing purposes — your number included. It goes to the network that carries the message and nowhere else. Standard message and data rates from your own carrier may apply.
Your documents are never sold. They are never shared for advertising. They are never used to build a profile of you.
If the company behind this service is ever sold, the new owner has to keep these same promises. Your documents do not go to anyone who will not.
The page you filled in is not indexed by search engines. There is nothing to sign up for and no account to create — that is deliberate, and it is why you were never asked for a password.
Documents are encrypted while they travel and while they are stored. Where the firm's plan includes it, uploads are checked for malware before anyone can open them, and a file that has not been checked is never labelled as though it had.
More detail is on our security page.
Ask the firm first. It is their record, they know your situation, and they can correct, produce or delete what you sent. They have the tools to do all three.
Deleting you removes the documents you sent, your answers, what you were asked for, and your name and contact details. Seven things stay. The firm's audit log, the record of who did what with your information, which nobody can alter: the entries it already holds that name you remain, and the deletion is recorded without naming you again. If you asked not to be emailed or texted, or an address of yours stopped accepting mail, that address stays on our list of addresses not to write to, which is what makes sure nobody writes to it again. A scrambled fingerprint of your phone number and email address stays for up to two years after the firm last wrote to you. It is not your number or address, and cannot be turned back into either without a secret key only our systems hold. It is used only so that a STOP or a bounce reaches every firm that wrote to you, and to count how many people were texted in a month. If the firm kept a household or business for you and someone else, the accounts recorded for it, such as an IRA and its balances, stay with it without your name, because they are part of the other person's record too. And if you signed a document alongside someone else, such as a spouse's account agreement, your signature stays on their signed copy, with your name, how you were contacted to confirm it and where you signed from, because it is what shows the document was signed. It goes when the firm deletes that copy. If the firm kept copies of your documents in a vault it shares with someone else, such as your household, those copies stay in that vault, because they are part of that household's record too; they go when the firm removes them or the vault is deleted. And if you answered part of someone else's request, such as a spouse's, your part stays with their request, your name, contact details, answers and documents included, because it is part of their record. Your answers and documents go when the firm deletes their reply; your name and contact details stay as long as their request does.
If you would rather not contact them, write to privacy@cartenda.com. We will pass it to them and tell you we have. We cannot change or delete your documents ourselves, because they are not ours to change — but we will make sure your request reaches someone who can.
Depending on where you live you may have rights over this information under law. Those rights are exercised against the firm, not against us, for the same reason.
privacy@cartenda.com, or write to the firm that sent you the form.