Privacy Policy

Last updated: September 11, 2026.

Who we are. Demand Letter Factory is operated by Om Bhardwaj, sole proprietor, Meerut, India ("we," "us"), who is responsible for the data practices described in this policy.

Demand Letter Factory is drafting software for U.S. personal-injury attorneys and their staff. Attorneys upload case documents, typically medical records and bills relating to their clients, and the service produces a drafted demand letter with page-level citations back to those records. This policy explains what we collect, how we use it, and how it is protected.

1. What we collect

• Account data: your name, work email address, firm name, role, and sign-in information. You sign in either with your work email and a password, or with Google. With Google, we receive the account identifiers needed to operate your login, never your Google password. With a password, it is stored only as a one-way hash by our authentication provider, and we never see it.
• Uploaded case documents: the medical records, bills, and related files your firm uploads, together with the text extracted from them (including OCR text from scanned pages) and the drafts, citations, and review decisions derived from them.
• Service records: correspondence with support and the minimal operational records needed to run accounts, such as letter counts and download records.

2. How we use it

Uploaded documents and account data are used to produce the draft your firm requested and to operate the service: processing uploads, generating and verifying drafts, providing the review console, and supporting your account. We do not use case documents for advertising, and we do not sell personal or case data to anyone.

3. Cookies

We set only strictly necessary cookies: the ones that keep you signed in, plus a short-lived one that secures the hand-off when you sign in with Google. We set no analytics or advertising cookies. If you choose Google sign-in, Google handles that step under its own privacy policy. No consent banner is shown because we set no non-essential cookie.

4. Storage and encryption

• Records are encrypted in transit and at rest, with case files stored using S3 + KMS encryption.
• Infrastructure runs in AWS us-east-1 under a signed AWS Business Associate Addendum.
• The database is backed up nightly, and backups are encrypted.
• Access to case data is limited to what is needed to operate and support the service.

5. Subprocessors

We rely on a small number of service providers to run the product, in general terms: cloud hosting and encrypted storage, OCR for scanned pages, AI model providers used in the drafting pipeline, and the providers that handle sign-in and billing. Document text sent to model providers is routed with zero-data-retention settings, so it is not retained and is not used to train models. Each provider receives only the data its function requires.

6. Our role: processor for the firm

The firm is the controller of its case records. Demand Letter Factory acts as a processor and handles those records only on the firm's instructions and only to provide the service. Case data is not used to train any model. Model calls run with zero-data-retention settings, and we do not sell it or share it for advertising. This applies regardless of whether the records are subject to HIPAA, and it includes consumer health data covered by Washington's My Health My Data Act and California's CPRA.

7. Retention and deletion

Case data is retained while your account is active and as needed to provide the service. To request deletion of your firm's data, including uploaded documents and derived drafts, write to support@demandletterfactory.com. We will confirm once deletion is complete; encrypted backups expire on rotation.

8. No sale of data

We do not sell, rent, or share case documents or personal information with data brokers or advertisers, and we do not use uploaded records for any purpose other than serving the firm that uploaded them.

9. Your firm's responsibilities

Your firm is responsible for having the legal authority and any required client consent to upload case records to the service, and for reviewing every draft before any use. See the Terms of Service for the attorney's responsibility for work product.

10. Changes and contact

If this policy changes, the updated version will be posted here with a revised date. Questions about privacy or deletion requests go to the operator, Om Bhardwaj, sole proprietor, Meerut, India, at support@demandletterfactory.com.