In effect from 11 October 2026
Overlook Innovations, LLC uses the companies below to run Cartenda. Each one is bound by written terms no less protective than our own, and we remain responsible to you for what they do.
This page is referred to by the Data Processing Addendum. If we add a company to it, we will give notice before it begins processing your clients' information, and you may object — see section 5 of that Addendum.
| Company | What it does | Reaches documents? |
|---|---|---|
| Laravel Cloud | Runs the application, the database and the job queue | Yes |
| Amazon Web Services | Stores uploaded documents, and runs the models that read them | Yes |
| Resend | Sends email, and receives your clients' replies | Emailed ones |
| Sent | Sends text messages to your clients | No |
| Stripe | Takes payment from your firm | No |
| Suggests an address as one is typed | No | |
| Laravel Nightwatch | Tells us when the application errors, and what went wrong | No |
All seven are United States companies and the Service is operated from the United States.
Laravel Cloud runs the application itself, so it hosts everything the Service holds — your account, your forms, the record of what was asked and answered, and the database those live in.
Amazon Web Services does two things, both inside our own AWS account.
It stores the documents your clients upload, encrypted at rest, in a single United States region. Amazon operates the storage; it does not read what is in it.
It also provides the models that classify a document, extract the figures you asked for, and summarize a submission. Amazon does not use the contents of your clients' documents to train models, and neither do we — that restriction is in our agreement with them and in ours with you. The models are Anthropic's Claude, run by Amazon inside our account: Anthropic never receives the documents, and Amazon keeps neither a document nor the answer once it has been read. The same models, on the same terms, draft a form from a description your firm types, which can name a client. They also answer the assistants: a question a member asks about using the product; a question a member asks about a submission, which goes with its answers (a Social Security or account number only as its last four), its documents and what reading them found; and a question a client asks about their form, which goes with their form and their answers so far. A Social Security number typed into any of them is hidden before it is sent.
Because the storage is our own account rather than a third party's service, the malware scanning described on the security page also happens inside it. Scanning adds no company to this list.
If your firm has turned document reading off, or if your workspace stores documents in its own storage, no document reaches this stage at all.
Resend delivers our email — the message that carries a form link to your client, and the notifications we send your firm. It receives the recipient's address and the body of the message. We never email a document: what we send links to it.
Resend also receives your clients' replies to that email, and anything they attach to one. We fetch each reply and its attachments from Resend and hold them as we hold any other upload, but Resend keeps its own copy of the email it received, under its own retention, and offers us no way to delete it. A client who would rather nothing sat there can upload through the form instead.
Resend also tells us when a message bounced or was reported as spam, which is how we stop writing to an address that cannot receive mail.
Sent delivers text messages, where your firm chooses to text a client rather than email them. It receives the phone number and the text. Every text carries the firm's name, and most a link. Depending on why it was sent, a text can also name the documents still needed, who sent something to sign, or a signing code, or carry a reply your firm wrote about one item, word for word. A client's reply to a text comes back to us through Sent. It also passes on STOP, so a client who replies STOP is not written to again.
Google suggests addresses, through its Places service, when a client or your firm types into an address question. Our server asks it, not the browser, so it receives what has been typed into that one field so far, a random number that ties one set of suggestions together, and which suggestion was picked. It never receives a name, an internet address or anything else on the form, and it is asked nothing where nobody types an address.
Laravel Nightwatch monitors the application for errors and slow requests. It receives the application's technical log and the errors it reports, which can say which workspace or submission was involved, and keeps them for up to 90 days. Addresses, link tokens and whole SSNs are taken out before anything is sent, and it never receives a client's answers or files.
Stripe handles subscriptions and payment. It receives your firm's billing details and your card. It never receives anything belonging to your clients, and we never receive your card number.
Where a workspace connects its own storage, documents go there instead and never reach ours. Documents held that way are not read by us and are not processed by the model provider — which is stated on the file and on the submission, because "we did not look" must never read as "this is fine".
No analytics or advertising company. There is none in this product. We advertise on Google and Microsoft Bing, and when a firm that clicked one of those ads signs up, the company whose ad it was fetches from us the click id it put on the ad and the time of the signup. That is about the firm, not its clients, and nothing of a client's or of a document's ever goes with it. Third-party code runs in two places, and only where it is used. Stripe's own card fields, on the three pages where a firm pays. And where a document can be attached from a drive, Dropbox's, Google Drive's or Microsoft's OneDrive code, so that its button can open: on the page a client sends documents from, on a client's portal page where the firm lets them add to a vault, and on every page a firm's member sees signed in, so the button works however they reached it. That code is fetched only when a question that takes a document appears, when the portal shows a vault the client may add to, or when a member opens the dialog to upload something. It opens the drive's own picker, signed in to the person's own account, and the file they pick comes to us as an upload would; we never hold the key to anyone's drive. Signed out, every other page refuses to load code from another origin, and our test suite fails if that changes.
No separate malware scanning company. Uploads are scanned inside the same AWS account that stores them, so no additional party sees a document in order to check it. What scanning does and does not promise is on the security page.
No timestamping company sees anything of a client's. Once a day, the Service sends a timestamping authority (DigiCert) a single SHA-256 hash made from that day's signing records, and the authority signs it with the time. That is how the date of a signing can be proven without relying on our own clock or database. A hash made from other hashes carries none of the information behind them, so nothing of your clients' reaches the authority, and it is not a subprocessor.
We keep this page current. The date it last changed is at the top. Write to privacy@cartenda.com with any question about it, or to ask to be told when it changes.