In effect from 11 October 2026
This policy is about your firm's information — what Overlook Innovations, LLC holds about you as a customer of Cartenda, and what we do with it.
It is not about the documents your clients send you. We hold those on your firm's behalf and act on your instructions; what we may and may not do with them is set out in the Data Processing Addendum. If you received a form from a firm and want to know what happens to what you sent, read the notice written for you instead.
This policy covers Cartenda only. We do other work under the same company, and that work is not described here.
Because you have an account. Your name, email address, and password stored as a hash we cannot reverse. If you turn on two-factor authentication or use a passkey, the secrets that make it work. The times you last signed in, so you can see an unfamiliar one.
Because you have a workspace. Your firm's name, the display name and colours your clients see, your logo, and who else you invited.
Because you signed up. How you told us you heard about us, if you did, and where the visit that ended in your signing up began: the first of our pages you opened, the site that linked to it, and any campaign tags in that link. If that link was one of our own ads on Google or Microsoft Bing, the click id that company put on it. It is kept with your workspace and goes when it does.
Because we spoke with you about Cartenda. If we approached your firm or you approached us, your name and your firm's name, your email address if we have it, where we came across you, our own notes on the conversation, and how far it has got. We keep it as our record of who we have spoken to.
Because we made you an offer. If we sent you an offer after speaking with you, your name, email address and firm's name, the terms we offered, and whether you signed up through it. We keep it as our record of what we offered.
Because another firm referred you. If you signed up through another firm's referral link, which firm that was, and whether each of you has been given the credit it earns. The referring firm sees how many firms signed up and subscribed through its link, never which ones.
Because you use the product. The forms you build, the contacts you enter, the requests you send, and how many documents you processed. Actions taken in your workspace are written to an audit log along with the internet address they came from — that log is your firm's record of who did what, it cannot be altered or erased, and it is there so a firm can answer that question about itself.
Because you reported a problem. What you wrote, with the screen you were on, your browser, the size of your window and the time, and a reference to the pages you had just opened in our own monitoring. It is kept for no more than a year to fix what went wrong, and is emailed to us so we can answer you. It never includes the page's address or anything on your screen.
Because you pay us. A customer identifier from Stripe, your plan, and the card's brand and last four digits. Stripe takes the payment; we never receive your card number.
Because we send you email. Whether a message we sent bounced or was reported as spam, so we stop writing to an address that cannot receive it.
To run the Service, bill you for it, tell you things you need to know about your own account, send a few tips on getting started in your first week (which you can turn off from any of them, or in your settings), answer you when you write to us, keep the product secure, learn which of the ways firms find us are worth our time, and meet our legal obligations. That is the whole list.
We do not sell your information. One thing about you goes to an advertising company, and only if you came to us by clicking one of our own ads on Google or Microsoft Bing: that company fetches from us the click id it put on that ad and the time you signed up, which is how it learns which of our ads find firms. Each is sent only its own click ids. Your name, your email address and your firm's name never go with them, nothing goes if you did not come from an ad, and no script or cookie of Google's or Microsoft's is on any page for it. Beyond that we do not share your information for advertising, and we do not use it to show you ads anywhere. There is no advertising in this product and no analytics vendor. Third-party code runs in two places only: Stripe's card fields on the pages where you pay, and, where a document can be attached from Dropbox, Google Drive or OneDrive, that company's own code, so that its button can open. That code is fetched only when you open the dialog to upload something, but every page you see signed in allows it, so the button works however you reached the page. Signed out, every page but the ones a client sends documents from (a form, and their page with a firm where it lets them add to a vault) refuses to load code from anyone else's servers, and our test suite fails if that ever changes.
If Overlook Innovations, LLC is ever sold or merged, whoever takes over Cartenda takes on these promises with it. Your information passes to nobody who will not keep them.
Where your plan includes it, Cartenda sends your clients text messages on your firm's behalf — the link to a form you asked them to fill in, a reminder while it is outstanding, and the one-time code they sign or open files with.
The mobile numbers involved are your clients', held on your firm's behalf under the Data Processing Addendum. What your clients are told about them is in the notice written for them. We pass each number to the messaging network that carries the message, named on the subprocessors page, and to nobody else.
No mobile information is sold or shared with third parties for promotional or marketing purposes. This covers your own number as much as your clients': a number reaches us to carry the messages the Service sends, and is used for nothing else. There is no list, and nothing goes to anyone who would market from it.
Every text names the firm it came from and tells the client they can reply STOP. A client who does is recorded as having asked us to stop, and the Service stops offering them as somebody to chase — a firm can see that they asked, and cannot clear it with a button. Replying START begins it again.
A number is only texted where somebody at your firm has confirmed the client agreed to it, or the client agreed themselves on a form your firm sent them. Either is recorded against the client — who confirmed it and when, or the form they agreed on and when — and your firm can withdraw it at any time. A client who chooses email on their form has withdrawn it, and only they can give it again.
Either way, the first text to a number asks the client to reply YES, and nothing else is texted to it until they do, except your firm's answer to a text the client sends. The reply is recorded with when it came.
What a client agrees to, in the words they see, is in the text message terms.
The companies that make the Service work are listed, with what each one does, on the subprocessors page. Each is bound by written terms.
Beyond those, and Google or Microsoft as described under "What we do not do" if you came from one of their ads, we disclose information only when the law requires it, and where we are permitted to tell you first, we will.
If the business is ever sold or merged, information may transfer with it. You would be told before anything about you became subject to a different policy.
These are all the cookies Cartenda uses, and each exists to make the application work:
| Cookie | What it does | How long |
|---|---|---|
| Session | Keeps you signed in, remembers a client part-way through a form, and on our own pages remembers where your visit began until you sign up | 2 hours after you last use it |
XSRF-TOKEN |
Proves that a form you send came from our own pages, so another site cannot send one in your name | 2 hours after you last use it |
remember_web_… |
Keeps you signed in on this browser, only if you tick Remember me when you sign in | Until you sign out, or 400 days |
appearance |
Remembers whether you chose light or dark | 1 year |
sidebar_state |
Remembers whether you collapsed the sidebar | 7 days |
legal_notice |
Remembers that you closed the notice about a change to these terms, so it is not shown again | 1 year |
billing_notice |
Remembers that you closed a notice about your plan or payment, so it is not shown again | 1 year |
cartenda_referral |
Remembers which firm's referral link you opened, only if you opened one, so you get its terms when you sign up | 60 days |
__stripe_mid, __stripe_sid |
Set by Stripe, our payment processor, only on the pages where you enter a card, to detect fraudulent payments | 1 year, and 30 minutes |
There are no advertising cookies, no analytics cookies, and no tracking pixels — which is why you have not been shown a consent banner. There is nothing to consent to, and a banner that asked would be misleading about what it was asking for.
Your account and workspace information, for as long as your workspace is open, and up to 90 days after it closes. Two things are kept after that.
Our billing records — what your firm was charged, and when — because tax law requires them. They contain nothing belonging to your clients.
Your workspace's audit log. Nobody can alter or delete it, us included, and that is the point of it: it is the record of what was done with your clients' information and by whom, and it names the clients your firm dealt with. It is kept after your workspace closes, so that record is never lost when it would be most needed.
Your clients' documents are kept until you set a retention window for your workspace, and are then deleted when it expires. That is covered by the Addendum, not this policy.
Your own account is yours rather than your workspace's. Your name, your email address and the ways you sign in stay after your workspace closes, so that you can open another, until you delete your account from your profile. Closing a workspace does not delete the people who worked in it.
You can see and change your own name and email in your profile, change or export your firm's information from your workspace, close your workspace at any time, and delete your account from your profile.
Depending on where you live, you may have the right to know what we hold about you, to get a copy, to correct it, to have it deleted, and not to be discriminated against for asking. We do not sell or share personal information, so there is nothing to opt out of — but you may still ask. Write to privacy@cartenda.com and we will respond within the time the law allows. We will need to be reasonably sure it is you before we act.
If we ever cannot honour a request, we will tell you why.
How the Service is built and run is set out on our security page. If you believe you have found a vulnerability, write to security@cartenda.com.
Cartenda is a tool for professional firms. It is not for children, and we do not knowingly collect information from anyone under 13. If you believe we have, write to privacy@cartenda.com and we will delete it.
We are a Delaware limited liability company operating from the United States, and the Service runs in the United States. Your information is processed there.
If we change this policy materially, we will give notice by email and in the application before it takes effect. The version in force is the one published here, dated at the top.
Write to privacy@cartenda.com about anything in this policy, or legal@cartenda.com for anything else. We are Overlook Innovations, LLC.