StreamLien Privacy Policy

This Privacy Policy applies to personal information we collect through the Service, in email and other communications with us, and from third-party sources as described below. It does not apply to third-party websites, services, or applications that we do not control, even if linked from the Service. Those third parties have their own privacy policies.

We collect the following categories of personal information. The California Consumer Privacy Act (CCPA) category corresponding to each is noted in Section 12.

Account and identity information. Name, email address, phone number, company or business name, business address, role or title, username, and password (stored in hashed form).

Project and document information. Information you enter to generate documents, including: project name; property street address, unit, city, state, ZIP code, and county; descriptions of work or materials; first furnishing dates; estimated contract amounts; your relationship to the parties; the city and state from which a document is signed or mailed; claimant name, email, phone, and mailing address; property owner names and mailing addresses; customer/hiring party names and addresses; direct contractor or general contractor names and addresses; construction lender names and addresses; and preparer/signer name, email, and phone. This information may include personal information about you and about third parties (see Section 4).

Bulk upload information. If you use bulk workflows, spreadsheet or CSV data you upload or paste may include the same categories of project, property, claimant, owner, contractor, lender, and work-description information listed above. We validate uploaded rows and create draft matters from them.

Matter, order, and certification records. Operational records for each matter and order, including matter and order identifiers, status, products and add-ons selected, amounts and currency, payment processor session and payment-intent identifiers, payment status and timestamps, document-generation status and file metadata, template version metadata, audit records evidencing that you reviewed required disclosures, acknowledged the Terms of Service, and certified the accuracy of your information, and, where you purchase a fulfillment service, records evidencing your review and approval of the specific recipient names and mailing addresses to be used (in each case with associated timestamps and identifiers).

Fulfillment and mailing information. If you purchase a fulfillment service, we collect and generate records of that fulfillment, including: the recipient names and mailing addresses you approved; the document mailed and a copy of the printed item; the class of mail used; the date and place of deposit with the carrier; carrier tracking numbers; delivery, non-delivery, refusal, and return status information received from the carrier; and postage and carrier charge records.

Payment and transaction information. Purchase history, products purchased, amounts, dates, payment status, and billing details. Full payment card numbers are collected and processed directly by our payment processor; we do not receive or store full card numbers.

Communications. The contents of support requests, emails, and other communications you send us, and our responses. If you contact us about an accessibility issue, we may process the information you choose to provide, such as the affected page or feature, the accessibility issue encountered, and any assistive technology, browser, device, or operating-system information you voluntarily include.

Usage and analytics information. We operate our own first-party analytics (no third-party analytics providers). It records page views and a limited, pre-defined set of product events (such as signup started, login started, intake started or saved, bulk upload started or validated, checkout started or completed, document certification started, and document downloaded), together with the page path and query string, the destination link path of tracked clicks, the button or link label, and the location of the interface element clicked. Our analytics is designed to exclude data fields containing secrets, tokens, passwords, card or payment-method data, and IP addresses. Because URLs are recorded, page paths and query parameters may be processed for analytics and operational purposes.

Technical, log, and error-monitoring information. Our hosting infrastructure and error-monitoring tools process standard request and diagnostic data, including IP address, browser/user agent, requested URLs, referrer, date/time of request, device and browser characteristics, error and performance logs, stack traces, affected routes, runtime metadata, and region/network metadata, for operational, debugging, performance, fraud-prevention, abuse-detection, and security purposes. Error-monitoring tools are configured to limit personal information and are designed to remove request bodies, cookies, authorization headers, query strings, secrets, passwords, payment data, and customer document content before error events are sent to our error-monitoring provider.

Cookie and browser storage data. Information stored through cookies and browser storage, as described in Section 6.

Inferences. Limited inferences derived from the above, such as workflow progress, funnel stage, product interest, and order or document readiness, used to operate and improve the Service.

We do not intentionally collect sensitive personal information as defined by the CCPA (such as social security numbers, government identification numbers, precise geolocation, biometric data, or health information), and we do not collect birthdates, race, religion, union membership, or similar characteristics. Free-text fields (such as project names and work descriptions) should not be used to submit sensitive personal information; please do not enter sensitive personal information unless it is necessary for the requested service.

Directly from you, when you create an account, enter project or notice information, upload or paste bulk spreadsheet data, make a purchase, certify a document, or communicate with us.

Automatically, through cookies, browser storage, server logs, and our first-party analytics when you use the Service.

From service providers, such as our payment processor (payment status and transaction confirmations) and email delivery provider (delivery status).

From carriers, if you purchase a fulfillment service (tracking, delivery-status, and returned-mail information).

From property-data providers, public-record sources, and county records, if you purchase the property owner search assistance add-on.

The nature of the Service means you may submit personal information about people other than yourself - for example, names and mailing addresses of property owners, contractors, lenders, or their representatives - in order to generate construction documents.

You are responsible for ensuring that you have a lawful basis to provide that information to us and to use it in the documents you generate.

We process such third-party information solely to provide the Service to you - to generate, store, and deliver your documents and related features, and, where you purchase a fulfillment service, to print, address, and mail the document to the recipients you approved and to obtain tracking information - and for security, compliance, and legal purposes. Where you purchase a fulfillment service, we transmit recipient names and mailing addresses to the carrier as necessary to effect the mailing you directed. We do not use third-party information to market to those third parties, and we do not enrich, supplement, resell, or otherwise use it for any purpose other than performing the Service you requested.

To the extent laws such as the GDPR apply to that information, we act as a processor (or service provider) on your behalf with respect to it, and you act as the controller (or business).

If you are a person whose information was submitted to us by one of our customers — for example, a property owner or contractor named in a document — and you wish to make a request regarding that information, contact us at support@streamlien.com. Because we process that information on our customer's behalf, we will generally refer your request to the customer who submitted it and will assist that customer as required by applicable law. We will respond to you directly where applicable law requires us to do so.

We use personal information for the following purposes:

To provide the Service: creating and administering accounts, generating documents from the information you provide, saving drafts, processing payments, and delivering purchased documents.

To perform fulfillment services you purchase: printing and addressing documents, depositing them with the carrier, purchasing postage, obtaining and recording tracking information, making tracking and status information available to you, and retaining records of what was mailed, to whom, and when.

To communicate with you: transactional and operational messages about your account, saved drafts, payments, document readiness, support, security, and service updates.

Marketing (with opt-out): to send newsletters, product announcements, and promotional communications about StreamLien products and services. You may opt out at any time as described in Section 9.

To improve and secure the Service: analytics, debugging, error identification, testing, research, service improvement, fraud prevention, abuse detection, and protecting the security and integrity of the Service.

For legal and compliance purposes: complying with applicable law, responding to lawful requests, enforcing our Terms of Service, establishing or defending legal claims, and maintaining business records.

For business operations: accounting, auditing, and, if applicable, evaluating or completing a merger, acquisition, financing, or sale of assets.

We do not use personal information for automated decision-making that produces legal or similarly significant effects concerning you.

For individuals in the EU/UK, the legal bases on which we rely are set out in Section 13.

We use a deliberately limited set of cookies and browser storage technologies. We do not use third-party advertising cookies, marketing pixels (such as Google Analytics, Google Tag Manager, Meta/Facebook Pixel, TikTok Pixel, or LinkedIn Insight Tag), session replay, heatmapping, or browser fingerprinting, and we do not permit third parties to place tracking cookies on the Service for their own purposes. The technologies we currently use are:

Technology

Purpose

Details

Authentication/session cookies (strictly necessary)

Keeping you signed in, session management, security, and access control for account, dashboard, matter, checkout, and settings pages. Cannot be disabled without breaking sign-in.

Set by our authentication provider; cookie names are project-specific and may include authentication-token or related session-cookie fragments. Not used for advertising.

Browser session storage (strictly necessary/functional)

Temporarily preserving unfinished intake form values so your form can be restored if validation fails or the page reloads.

sessionStorage key streamlien.caPreliminaryNoticeIntakeDraft, stored in your browser only (not a cookie, not sent as a tracking identifier), cleared when your browser session ends or when no longer needed. May temporarily hold intake information you have typed.

First-party analytics (cookieless)

Understanding how the Service is used (page views and defined product events) to improve it.

Our own analytics; it does not set cookies and does not currently create or store a browser session identifier. Data is stored in our own database, not sent to a third-party analytics service. Designed to exclude secrets, passwords, payment data, and IP addresses.

Payment processor checkout cookies

Payment processing, fraud prevention, and security when you are redirected to the payment processor's checkout page.

Set and controlled by the payment processor on the payment processor's pages, under that processor's own privacy policy and cookie policy. We do not control payment processor cookies.

Hosting/server logs

Operations, security, debugging, and performance of our hosting infrastructure.

Standard request logs (IP address, user agent, URLs, referrer, timestamps, error logs) processed by our hosting provider. Not advertising cookies.

No non-essential tracking cookies. Because we currently use only strictly necessary cookies and cookieless first-party analytics, we do not currently deploy a cookie-consent banner. If we ever introduce non-essential cookies or third-party trackers, we will update this Privacy Policy and, where required by law, obtain your consent first through a banner offering symmetrical choices (accepting and declining equally easy). You can control or delete cookies through your browser settings; disabling strictly necessary cookies may prevent parts of the Service (including sign-in) from functioning.

Global Privacy Control (GPC). Because we do not sell or share personal information (see Section 8), there is currently nothing to opt out of. If our practices ever change such that a sale/share opt-out right applies, we will honor legally recognized opt-out preference signals such as Global Privacy Control as required by California law.

Do Not Track. Other than GPC as described above, we do not currently respond to browser "Do Not Track" signals, for which no common industry standard exists.

We disclose personal information to the following categories of recipients. We generally identify service providers by category rather than by name, because vendors and infrastructure providers may change over time. We disclose each category of personal information listed in Section 2 to service providers as needed for the purposes described in Section 5.

Service providers and contractors, who process personal information on our behalf under contracts restricting their use of it, including:

Hosting and infrastructure providers (website and application hosting, serverless functions, deployment, and runtime/error logs; processes IP addresses, device/browser/request metadata, URLs, and operational telemetry).

Authentication, database, and storage providers (account authentication and session cookies, database, and document/file storage; processes account information, session data, matter/project/intake data, party contact and address information, order and payment-status records, document records, audit events, and our first-party analytics events, protected by row-level access controls).

Payment processors (checkout and payment processing; process payment card information, billing details, and fraud/risk/device information under their own privacy policies; we receive and store only checkout session and payment-intent identifiers, order/payment status, amount, currency, and payment timestamps - never full card numbers).

Email delivery providers (transactional/workflow emails such as draft saved, payment received, and document ready, and, if you have not opted out, marketing emails; processes recipient email addresses, email content, matter/project references, and delivery metadata).

Error-monitoring and security-diagnostics providers (application error monitoring, exception reporting, stack traces, affected routes, browser/device/runtime metadata, and sanitized diagnostic context; our configuration is designed to disable default personal-information collection and remove request bodies, cookies, authorization headers, query strings, secrets, passwords, payment data, and customer document content before error events are sent).

Property-data providers, public-record sources, and related service providers, if you purchase the optional property owner search assistance add-on (they process property addresses, county information, any owner name/address information supplied, matter/order identifiers, and search results; see Section 11 of the Terms of Service).

Mailing and delivery carriers and vendors, if you purchase a fulfillment service. We disclose recipient names and mailing addresses, sender information, the document to be mailed, and related matter and order identifiers to the applicable carrier in order to effect the mailing you directed, and we receive tracking and delivery-status information in return. Carriers act under their own privacy practices, not as our service providers. If we engage a postage, shipping-label, address-validation, or print vendor, that vendor processes the same categories of information on our behalf under contract. Printing and preparation of mailed items is currently performed by StreamLien.

We do not use third-party analytics providers. Our analytics is first-party and stored in our own database, as described in Section 6.

Professional advisors, such as lawyers, accountants, and insurers, where necessary.

Legal and safety disclosures: to comply with applicable law, regulation, legal process, or governmental request; to enforce our Terms of Service; or to protect the rights, property, or safety of StreamLien, our users, or others.

Business transfers: in connection with, or during negotiations of, a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, in which case personal information may be transferred as a business asset, subject to this Privacy Policy or successor terms.

At your direction: when you direct us to disclose information, such as recipients of documents you generate and choose to send, and recipients to whom you direct us to mail a document through a fulfillment service you purchase.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined in the CCPA. "Sale" and "sharing" are defined broadly under California law and can include making personal information available to third-party analytics or advertising providers through cookies and trackers - which is why we do not use third-party advertising cookies, marketing pixels, or third-party analytics providers on the Service (see Section 6). Our service providers and contractors process personal information only on our behalf, under contracts restricting their use of it, which is not a sale or sharing.

We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. If our practices ever change, we will update this Privacy Policy before the change takes effect and will provide all legally required notices and opt-out mechanisms, including a “Do Not Sell or Share My Personal Information” link and recognition of Global Privacy Control signals.

Marketing emails: You may opt out of marketing emails at any time by using the unsubscribe link in any marketing email or by contacting support@streamlien.com. Opting out of marketing does not affect transactional or operational emails (such as receipts, document readiness, security notices, and legal notices), which we may still send as necessary to provide the Service.

Optional workflow emails: You can opt out of optional workflow notification emails (such as draft-saved reminders) in your account settings page. Your dashboard remains the system of record for matter and document status regardless of email preferences.

For individuals in the EU/UK: we send marketing communications only with your consent or as otherwise permitted by applicable law, and you may withdraw consent at any time.

Cookies: see Section 6 for cookie choices and GPC.

Account information: you may access and update your account information through your account settings or by contacting us.

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Criteria used to determine retention periods include: the duration of your account and our relationship; legal, tax, and accounting record-keeping obligations; the legal significance of generated documents (which we and you may need to retain as evidence of preparation and content); statutes of limitations and the need to establish or defend legal claims; and fraud prevention and security needs.

As general guidelines: account information is retained for the life of the account and up to two (2) years after closure; matter, order, certification, recipient-approval, and generated-document records are retained for up to seven (7) years consistent with legal, accounting, audit-trail, and dispute-resolution requirements; fulfillment and mailing records, including recipient names and addresses used, copies of printed items, tracking numbers, and carrier status information, are retained for up to seven (7) years for the same reasons; property search and owner-lookup results are retained with the associated matter record; support and email communications are retained for up to three (3) years; and server logs and first-party analytics events are retained for up to twenty-four (24) months (hosting-provider logs are retained according to the provider's operational and security practices). Unfinished intake form values held in your browser's session storage are stored locally on your device only and are generally cleared when your browser session ends. When retention is no longer necessary, we delete, aggregate, or de-identify the information.

We maintain reasonable administrative, technical, and organizational safeguards designed to protect personal information, including: encryption of data in transit (TLS); authenticated accounts with hashed credentials and session controls; row-level database access controls; server-side verification of checkout and payment events; access-gated dashboards and administrative pages; handling of payment card data exclusively by our payment processor; restricted management of secrets and credentials; audit and operational records; and use of established infrastructure and operations providers with independent security programs. In addition, our first-party analytics is designed to exclude secrets, passwords, payment data, and IP addresses from analytics events. Where we print and mail documents as part of a fulfillment service, printed materials are handled in a controlled work area, are prepared and deposited by authorized personnel, and are not retained in physical form after deposit with the carrier except as needed to resolve a fulfillment issue; any retained physical materials are securely destroyed when no longer needed. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials. If we become aware of a breach affecting your personal information, we will notify you and regulators as required by applicable law.

This Section applies to California residents and supplements the rest of this Privacy Policy. It is provided in accordance with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations, including the regulations effective January 1, 2026 (collectively, the “CCPA”), to the extent the CCPA applies to StreamLien.

Categories of personal information: collection and disclosure

In the preceding 12 months, we have collected the following categories of personal information (as categorized by the CCPA), and disclosed each of them to the service providers and contractors identified in Section 7 for the business purposes described in Section 5:

CCPA Category

Collected

Disclosed to (business purposes)

A. Identifiers (name, email, phone, mailing address, account ID; IP address and online identifiers processed by hosting, authentication, payment, and error-monitoring providers)

Yes

Hosting, authentication/database/storage, payment, email, and error-monitoring providers; property-data providers if property search purchased; carriers and mailing vendors if a fulfillment service is purchased.

B. Customer records (Cal. Civ. Code § 1798.80) (name, address, phone, email, payment/order records)

Yes

Hosting, authentication/database/storage, payment, email, and error-monitoring providers; carriers and mailing vendors if a fulfillment service is purchased

C. Protected classification characteristics

No

-

D. Commercial information (products purchased or considered, orders, add-ons, payment status, transaction history)

Yes

Payment, authentication/database/storage, email, and error-monitoring providers; carriers and mailing vendors if a fulfillment service is purchased

E. Biometric information

No

-

F. Internet or network activity (pages visited, button/link interactions, workflow events via our first-party analytics; device/browser/request logs)

Yes

Hosting provider (server logs); error-monitoring provider (sanitized error and diagnostic events); first-party analytics events stored in our own database

G. Geolocation data (coarse region/network metadata derived from IP by hosting infrastructure; no precise geolocation)

Yes

Hosting provider

H. Sensory information (audio, visual)

No

-

I. Professional or employment-related information (company names, contractor names, hiring party names, construction-project roles)

Yes

Hosting, authentication/database/storage, email, and error-monitoring providers; carriers and mailing vendors if a fulfillment service is purchased

J. Education information

No

-

K. Inferences (limited: workflow progress, funnel stage, product interest, conversion status)

Yes (limited)

Stored in our own database

L. Sensitive personal information

No (account log-in credentials are collected but used only to authenticate you)

-

We collect these categories from the sources described in Section 3, for the purposes described in Section 5, and retain them as described in Section 10. As stated in Section 8, we do not sell personal information and we do not share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA.

Your California rights

Right to know/access: to request the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes, and the categories of recipients.

Right to delete: to request deletion of personal information we have collected from you, subject to legal exceptions. Deletion requests may not extend to information we are required to retain for legal, accounting, audit-trail, or dispute-resolution purposes, including records of documents generated, certified, or mailed, or to information submitted about you by another customer, which is addressed in Section 4.

Right to correct: to request correction of inaccurate personal information.

Right to opt out of sale or sharing: we do not sell or share personal information; if that changes, we will provide the required “Do Not Sell or Share My Personal Information” link and honor opt-outs, including Global Privacy Control signals where legally required (see Section 6).

Right to limit use of sensitive personal information: we do not use sensitive personal information beyond permitted purposes.

Right to non-discrimination: we will not discriminate against you for exercising your rights.

How to exercise your California rights

You may submit a request by emailing support@streamlien.com with the subject line “California Privacy Request,” or through any other method identified on the Service. We will verify your request by matching information you provide (such as your account email address and recent transaction details) against our records, and we may require you to log in to your account. We will respond within the time required by law (generally 45 days, extendable once by 45 days with notice). You may designate an authorized agent to make requests on your behalf; we may require proof of the agent's authority and verification of your identity. We do not charge a fee to process verifiable consumer requests unless permitted by law.

Shine the Light: California Civil Code § 1798.83 permits California residents to request information about disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

This Section applies to individuals in the European Economic Area, the United Kingdom, and Switzerland, and supplements the rest of this Privacy Policy. The Service is designed for construction projects located in California, United States, but where the GDPR or UK GDPR applies to our processing, this Section governs.

Legal bases for processing

Purpose

Legal basis

Providing the Service (account, document generation, payments, delivery, and fulfillment services you purchase)

Performance of a contract (Art. 6(1)(b))

Transactional and service communications

Performance of a contract; legitimate interests (Art. 6(1)(b), (f))

Marketing communications

Consent (Art. 6(1)(a)); you may withdraw at any time

First-party, cookieless analytics and product usage measurement

Legitimate interests (Art. 6(1)(f)); you may object at any time (see below)

Non-essential cookies and third-party trackers

Not currently used; if introduced, consent (Art. 6(1)(a))

Security, fraud prevention, service improvement, debugging

Legitimate interests (Art. 6(1)(f))

Legal compliance, record-keeping, responding to lawful requests

Legal obligation (Art. 6(1)(c))

Establishing, exercising, or defending legal claims

Legitimate interests (Art. 6(1)(f))

Your EU/UK rights

Subject to conditions and exceptions under applicable law, you have the right to: access your personal data; rectify inaccurate data; erase your data; restrict processing; data portability; object to processing based on legitimate interests or for direct marketing; withdraw consent at any time (without affecting prior processing); and not be subject to solely automated decisions producing legal or similarly significant effects (we do not make such decisions). To exercise these rights, contact support@streamlien.com. You also have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office).

International data transfers

We are located in the United States, and personal information is processed and stored in the United States and other countries where our service providers operate. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards where available and applicable, including provider data processing terms or addenda, the European Commission's Standard Contractual Clauses and the UK Addendum or International Data Transfer Agreement, and/or the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where a provider is certified.

Residents of other states with comprehensive privacy laws (including Colorado, Connecticut, Texas, Oregon, Virginia, and others) may have similar rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, or certain profiling, to the extent those laws apply to StreamLien. You may exercise any applicable rights by contacting support@streamlien.com. If we deny your request, you may appeal by replying to our decision, and we will respond as required by the applicable law.

The Service is intended for business use by adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18 years of age. If you believe a child has provided us personal information, contact support@streamlien.com and we will delete it.

We may update this Privacy Policy from time to time. The "Last Updated" date above reflects the most recent version. Material changes will be communicated by posting on the Service, by email, or by other reasonable means before they take effect. Your continued use of the Service after the effective date of an updated Privacy Policy constitutes acknowledgment of the update; where consent is required by law for a new processing purpose, we will obtain it.

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, contact:

StreamLien, LLC

30 N Gould St, Suite 33327

Sheridan, WY 82801

Attn: Privacy - support@streamlien.com