Privacy Policy

Who we are

Hand & Seal is software that mobile notaries, the businesses they work in, their assistants, and the companies that send them work use to run their business: jobs and calendar, client bookings, orders from title, escrow, lending and law offices, invoices and payments, a mileage log, an index of the notary journal, and the books. It is operated by Tessera Systems, LLC ("Hand & Seal", "we", "us"), PO Box 7221, Laguna Niguel, CA 92607-7221. You can reach us about privacy at privacy@handandseal.app.

This policy covers the Hand & Seal website at handandseal.app, the Hand & Seal apps for phones and tablets, and the pages Hand & Seal hosts for notaries (for example a notary's booking page).

Three kinds of people, and our role for each

• Notaries and their assistants — the people who work in a Hand & Seal account: a notary's own, or a business's, with its partners, employees and assistants. We decide how their account information is handled, and this policy explains how.
• Companies — title, escrow, lending and law offices and signing services, with their own company accounts, who send notaries orders through Hand & Seal. We decide how their account information is handled too.
• The people in their records — a notary's clients and signers, the people who book, pay, follow a request or leave a review on a notary's page, and the borrowers named in a company's orders. Here the notary (or the ordering company, for what it sends) decides what is kept and why; we hold and process it on their behalf, as their service provider, and only to provide Hand & Seal to them. If you are in a notary's records, the notary is your first point of contact for questions about your information; we will help them answer.

We decide for ourselves in a few places, and answer for them directly: reviews shown on public pages, the directory and the order it lists notaries in, the early-access list of notaries and companies who asked to be let in first, and the records we keep to secure the service.

What we collect

Your account. Your name and email address, and how you sign in. You can sign in with your email address and a password, which we store only as a one-way hash; with a passkey you add (we keep only its public half); or with Google, when we keep the identifier Google gives your account, with the email address and name Google shares; or with Apple ("Sign in with Apple"), on the web and in both apps. Apple shares the identifier it gives your Apple ID for Hand & Seal, an email address and — the first time only — the name you choose to share, and we keep them with a token from Apple, sealed, which we use only to tell Apple to forget Hand & Seal for you when you disconnect Apple or close your account. If you choose Hide My Email, Apple gives us an address of its own at privaterelay.appleid.com instead of yours; your account uses it, and Apple forwards our letters to your real address (you can stop that in your Apple ID's settings, and then our letters stop reaching you). A reply to that address would not reach you — Apple turns back senders it does not know — so we do not give it to your clients as the address to write back to: we ask you for one they can use, confirm it by a link sent to it, and use it where your clients and the companies you work with reach you — as the reply address on the letters sent in your name or your business's, on your invoices and on a company's desk — and to tell whether a payment came from someone who is or was in your business. The keys for two-step sign-in, if you turn it on, are sealed. Your business name and details, your commission (state, commission number and expiry), your bond and errors-and-omissions dates if you add them, your fees, your working hours and the area you work from. If you say on your page that you are an attorney licensed in your state, we keep that you said so, and when.

We also keep which version of our terms you accepted and when — and, if you subscribe, the words you ticked agreeing that your plan renews by itself, and when.

Your taxes. If you use the tax set-aside pages: your filing status, last year's total tax, the estimated tax you have paid, and the share you choose to hold back. They are used only to work out your own estimate.

How your drives from home are filed. If you answer them: your answers to "Is your home your main place of business?" and "Do you also have a regular place of work away from home, in the same business as your signings?" and, where it was kept, when you gave each — and on which of your signed-in devices, with that device's own time, so that two answers from one device keep the order you gave them in. They are used only to file the drives between your home and a signing — as business miles or as commuting — and they are shown to nobody else, apart from what you send us yourself: not the other people in a business you work in, and not a company.

The records you keep. Jobs (dates, times, places, the kind of signing, fees — and, for a loan signing, the lender's name and the loan or order number), your clients (names, email addresses, phone numbers, addresses, the terms you agree with them), invoices and what has been paid, expenses and the receipt photos you choose to keep, proof photos from a signing, messages between you and a client or a company on a request's page, the letters and texts sent for you, and reviews.

Your journal index. Hand & Seal keeps an index of your notary journal: for each entry, who signed and their address, what kind of act and document it was, the kind of identification shown with its issuer and expiry date, the last four digits of the ID number (never the whole number — the database refuses more than four characters in that field), credible witnesses' names and addresses, your notes, the book, page and line of your paper journal, and the fee. Your notes are yours to write, and nothing checks what is in them: the form asks you to leave an ID's number out of them. A journal line is never rewritten or deleted: it is corrected by an amendment, and it is kept until your account is deleted. The one exception is a person who asks to be removed: their address and your notes are taken out of the line, and the rest of it stays ("Your choices and rights", below). Your journal — or, for a signing by video, the record kept by the platform that ran it — is the official record; this index is not. Where a state does not allow an ID's number in a journal, no part of the number is kept here.

The phone app can read the barcode on the back of a driver's license, where the notary's state lets a notary's phone do that: in some states the scan is not offered at all, in some the signer is asked first, and in California the address on the license is not taken from it. It reads the name, the address, the kind of ID, who issued it, its dates and the last four characters of its number, and the notary confirms them. No picture is taken, and the date of birth and the rest of the number are never kept.

What is never kept. A picture of an ID, a thumbprint, or a signature.

Documents a company sends for a signing. A company may send a notary the documents for a signing. They are sealed on the company's computer so that only the notary's own approved devices can open them — we cannot read them. They are deleted 72 hours after the signing is done — at once if the order is canceled or the company takes them back — and are never kept more than 14 days after they were sealed. They are never in our backups.

Your commission, checked. Where your state publishes its notaries in a form a program may check, your commission is looked up there — by its number, or by your name where the state shows no numbers — and we keep the answer. We never ask for your commission certificate, and nobody at Hand & Seal reviews one.

Your W-9, if you add one: it holds your Social Security or employer number. It is sealed before it is stored, and shown only to companies whose orders you have taken, and only if you turn sharing on. Every time a company opens it, that is recorded, and you are told. When you remove it, or put another in its place, the file is deleted for good — no earlier version of it is kept — and what our backups held of it is gone within 35 days.

Location, in the phone app. If you turn on drive recording, the app records your route while you drive, to build your mileage log. You choose when it records: "During my working hours" — in the hours you set, and around your appointments; "All the time" — whenever you drive, at any hour of any day; or "Only when I tap Record" — only a drive you start yourself. A work drive keeps its route, where it started and ended, when, and how far. A drive you mark personal, or remove, keeps no route and its ends only to about 100 meters (about 330 feet); a removed one also loses its labels and notes. You can turn recording off, or withdraw the phone's location permission, at any time. Also:

• "On my way" uses your approximate location once, to estimate when you will arrive; only the expected time is kept.
• "I'm here" checks how far the phone is from the signing's address; only that distance is kept. To place the address on the map for that one check, Amazon Location Service is told the address and your location to about a kilometer (just over half a mile); neither the address's place on the map nor your location is kept.
• Proof photos keep where they were taken, while they are kept; a photo you remove loses its place and its caption, and so does each photo of a signing that a person is taken out of ("Your choices and rights", below).
• Your home base is kept as a point on the map, privately: your public page shows only your town.
• The phone's own map service (Google on Android, Apple on iPhone) looks up the addresses you pick and the places your drives start and end.
• From these steps we work out badges you can earn — "Reliably on time" and "Ships by the next morning" — and only a badge you have earned is ever shown to anyone else: on your public page, in the directory and to companies. A late arrival, a count or a rate is never shown to anyone but you, and without a badge you are listed exactly like someone new (a badge gives a small lift in the directory; nobody can pay to be listed higher). To be fair to you, the time you arrived is the earliest moment the app knew you were there: your "I'm here", or when your phone's drive log shows you parked at the address. Your drives are used only to make an arrival earlier, never later, and nothing about them is shown to anyone. Your own record, with what was counted and what was not, is shown only to you.

Taking a card on the phone. When you take a card with a card reader or with Tap to Pay, the phone's precise location and details of the device go to Stripe: Stripe's own software in the app asks for them, as it requires for a payment taken in person, and we do not receive or keep them. The address you confirm for your reader — offered from your home base — is sent to Stripe as well. On an iPhone, Tap to Pay is Apple's and Stripe's together: Apple's software reads the card, and neither we nor the app sees the card's number.

This phone's calendar. If you turn on "jobs in this phone's calendar", the app writes each job's title, the client's name and the signing's address into a calendar of its own. On Android that calendar stays on the phone. On an iPhone it is kept in your iCloud calendar account when your calendars are in iCloud — which stores it and shows it on your other devices, as that account does — and on the iPhone itself otherwise; the switch says which.

Busy times from this phone. If you turn on "Busy times from this phone" in the app (More → Settings → Calendar), the app goes through the events over the next 14 days — the days your page offers times for — in the calendars on that phone or tablet that you choose, and sends us when you are busy: the start and end of each event, and nothing else, never its title, place, notes or who is invited. Events marked free, and all-day events, are left out. The app sends those times to us each time it is opened or comes back to the screen. We use them only to keep those hours off your page, the directory and the forms that ask you for a time, in every business you work in, and to show them to you; nobody else sees them, the other people in your business included. Each time the app sends them they replace the last, and they are deleted as they pass — and all of them when you turn this off, sign out of the app on that phone or tablet, or close your account.

Near me. On the directory, "Near me" asks your browser where you are, once. The place is rounded to about a kilometer (just over half a mile), used to put the list in order, and not kept.

Maps in the app and on the web are drawn from OpenFreeMap's tiles, which tells OpenFreeMap your IP address and roughly which area is being looked at. Road distances are measured, and a signing's address is placed for "I'm here", with Amazon Location Service; a road distance is kept at most 30 days, as that service's terms require, and where an address was placed is not kept at all. Address suggestions as you type come from Google, looked up by our server with your approximate location (to about a kilometer, just over half a mile).

Your devices. For each device you sign in on: its name (which may include your name, as the phone reports it), its IP address, and the browser or app it is. The tokens that let us send you notifications (through Firebase Cloud Messaging on Android, and your browser's push service on the web), your app's version, and the kind of device.

What stays on your phone. The phone app keeps your drives, drafts of journal lines, photos waiting to be sent and your settings on the phone itself, protected by the phone's own lock and encryption. Signing out removes them. If we sign the phone out ourselves — a device you removed, a changed password, a closed account — while something is still unsent, they stay on the phone, unshown, for 30 days at most, and are removed at once if someone else signs in on it. On an iPhone, the place the car was last parked and the times of your upcoming appointments are kept in the app's own settings, which the phone's backup — to iCloud or to a computer — includes; your recordings, your drives and the photos waiting to be sent are left out of that backup.

Diagnostics you send us. If you choose "Send to support" in the phone app — or tick "Attach this phone's drive diagnostics" when you contact support from it — it sends what the drive recorder did and when, for the last 30 days: counts, times, distances, how each drive was filed, and where each work drive started and ended to about a kilometer — never routes, addresses, place names or notes, and personal or removed drives only as a count. Our support staff read it; it is deleted after 60 days. If you attach it and then don't send your message, it is deleted after a day.

Error reports the app sends by itself. When a screen of the app or of the site fails — it cannot be shown, or something goes wrong that it was not ready for — the app sends us a short report, so that we can find the fault and fix it: when it happened; which kind of screen it was (never its address, which can carry the number of one of your records); the error's name, a line of what it said, and where in our own code it happened; the app's version and build; and the kind of device — a phone's model and system, or a browser's name and version. It is made of the fault, not of your work: it has no place for what you typed, a client's name, an address, a document or a location. An error's own words can repeat something that was on the screen, so email addresses, phone numbers and long numbers are taken out of them before the report leaves your device, and again when it arrives. When you are signed in, the report is tied to your account and the business you were working in, so that we can see how many people a fault has reached and can find it when you write to us about it; signed out, it is tied to no one. It goes to Hand & Seal's own servers and to no one else, and our own staff read it. There is no switch for it: this is how a fault is found before many people meet it.

Messages you send us for help. What you write on Contact support — your name, email address, what it is about, a subject and your message (and, when you are not signed in, who you are: a client, a company, a notary) — and the note you add to "Send to support", kept as a support conversation with our own notes on answering it. When you write while signed in, we don't ask what we already know: the message carries your name and account email, your account, the business you were working in and your role there, where its plan stands, the page you wrote from, and your browser (and, from the phone, the app's version) — so we can help without asking. When you write from a screen that failed, by its "Report this", the message also carries that failure's reference and, from the phone, its model and system. Signed in or not, it carries the page you wrote from and your browser. It never carries your journal, anyone's ID or your clients' details. You may attach one screenshot when signed in; it is kept 60 days. We send you a copy of your message, with its case number. An email or a call to us may be written down the same way.

Connected calendars. If you connect Google Calendar, Hand & Seal creates one calendar of its own in your Google account and writes each of your jobs to it, with the job's title, the client's name and the signing's address. From your other calendars it reads only whether you are free or busy; it does not read their events. What Hand & Seal receives from Google is used only for these features, and its use and transfer to any other app adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Your calendar link. If you make one in Settings — once your email address is confirmed — you get a private web address for your booked jobs in one business, as a calendar, for a calendar app — Outlook, Apple Calendar, Google Calendar or another — to subscribe to; each business you work in has its own. It lists each job you are booked for there, from 90 days back on — never one offered to you that you have not taken — with its time, its title, the client's name, the signing's address, its job number, when it last changed, and a link back to it. The app you give the link to, and the company that runs that app, read it from us on the app's own schedule and keep what they read, as they keep your other calendars. Anyone who has the link can read it, so give it only to your own calendar apps. It works until you make a new one or stop it in Settings — the old one then stops at once — and only while you are a notary in that business; signing out or changing your password does not change it. We note when it was last read — at once when a new kind of app reads it, and otherwise at most every quarter of an hour — and what kind of app read it, as the app names itself, and show you both. Each time one is made we email you and note it in your account's security activity; making, renewing and stopping it also go in the business's activity log, which its owners can download.

Your Google profile set-up. Once you open it (Settings → Integrations → Google Business Profile), we keep the step you are on, what you tell it, and when, the two codes its links carry, the page address those links were made for — your own web address, if one was connected then, or your page here — and when your page was first opened by each link, with nothing of who opened it. It never signs in to Google or reads your profile.

Orders you forward to us. If you forward an order to your private Hand & Seal orders address, we read it once to draft a job for you and delete the email itself at once (within a day at most). The words of the order are kept with the draft until you book or dismiss it, and at most 30 days; the details read from it, the sender's address, the subject and the names of any attachments stay with the draft, and with the job if you book it. Once a draft has been booked or put aside, what was read from the order — the signers' names, phone numbers and email addresses, the address, the loan number and the lender, with its subject line, the names of its attachments and its sender's address — is cleared 90 days after the order arrived (the job you booked keeps its own). One part of the sender's address stays: what comes after the @, which is how the next order from the same company is known to be one. Files attached to an email you forward are checked for viruses with it and never kept — only their names are.

Information your clients give on your pages. Name, email address, phone number, the address of the signing, the appointment requested, what the document is, the signers' language and how many witnesses are needed (if they say), any note they add, and the messages they send on the request's page. If they press "Yes, this is my request" on the page that the email saying their request arrived opens, the request also keeps that they did, and when, with a one-way code of their email address — removed with their contact details. If whoever has that email address says there that they didn't send it, the email address and phone number on the request are removed from it, from any signer or person to call on that job who has the same one, and from the client record made for it, unless the notary has since made a booking of their own on that record, billed it or finished a signing on it, or filled it in from an import; accepting a request, this one or another filed under that record, doesn't keep it. The request keeps its name, that this was said and when, a one-way code made from that email address, and everything else that was asked: the signing's address, what the document is, any note and the messages. The code goes when the rest of the request's contact details do; on a signing that took place, it stays until we remove that person's details on request, or the notary's account is deleted. A review left on that signing stays, without the name or the town on it. A request goes to the notary asked, is seen in that notary's business by whoever handles its bookings, and is kept by Hand & Seal for them. A request sent to several notaries at once — which a client could do until November 2026 — is kept by each notary asked, even when another notary took it. To limit how often a form can be sent from one connection, a one-way code of the connection is kept with a request for a day, and gone by the next morning's run. A notary who declines a request from their page can also refuse its sender ("No more from this sender"). We then keep, for that notary alone, one-way codes made from the email address and the phone number on the request — nobody without our key can turn them back into either, and none is made from one on the notary's client records that the refusal leaves out, as below — with the one-way code of the internet connection it was sent from, if the request still holds it: each for 30 days from that refusal, and gone by the next morning's run. A phone number that can't be anyone's — ten of one digit, 1234567890, 0123456789 or 9876543210, or a North American number whose area code or exchange begins with 0 or 1 — is never refused, and no code of it is kept. Once that notary has used it on two different senders who wrote from the same connection — whether it refused something of theirs, or counted the connection of one whose request held nothing but what the notary's client records hold — that connection's one-way code is kept, refused, for a day, and gone by the next morning's run. If the email address or phone number is on a client record of the notary's that they can see when they open the request — one booked, changed or imported in that business, or one with a signing of theirs that took place, or an invoice — they are told whose, and the refusal leaves it out: no code of it is kept and it is not refused, unless the notary also ticks a second box beneath it, on the web, that names whose it is and refuses it too, keeping no code of the connection when ticked alone. If nothing else is on the request, the refusal keeps only the connection's one-way code, if the request still holds it, for 30 days, and gone by the next morning's run, so that it counts toward refusing that connection. While a refusal lasts, a new request to that notary from that email address or phone number, or from that connection, is not sent to them; unless something else stops it first, whoever sent it is told no more than that the notary is not taking requests through the platform at the moment — never that they were refused, or why. A refusal ends when its time is up, or sooner if the notary takes it back. A refusal of an email address also ends when whoever has that address says they didn't send a request in the business the refusal was made in, and a refusal of what someone typed ends when they are taken out of that business's records at their request — in both cases that address, or what that person typed, and nothing else refused with it, and never a refusal made in another business. A refused contact left with nothing refused that way keeps the one-way code of the connection it came from, if it had one, and nothing else — not even the request it was refused from — at most until the day its refusal would have ended, so that it still counts toward refusing that connection; a refusal of a connection lasts its day either way, unless the notary takes it back. As someone types the signing's street address on a notary's request form, what they have typed so far in that field is sent, through our server, to Google, which suggests matching addresses near the notary's town, or within the notary's state — never near the person typing. If they choose a suggestion, the address it fills in, with any changes they make to it, is kept with the request, as an address they typed would be; nothing else Google sends back is kept. How often one connection may ask for suggestions is limited by a one-way code of it, which changes every day; and only one chosen suggestion is looked up each time an address is typed, counted by a one-way code of a random number the form makes for that typing. Both codes are kept 7 days. Once a notary has confirmed a signing, its page offers Google Calendar, which opens Google's own page for adding an event with what the page's calendar file holds filled in: the time, the signing's address, the notary's name, what it is for, what to have ready and the page's private link. That goes to Google from the client's browser when they press it, and what Google keeps of it is under Google's own terms. After a signing asked for through a notary's page, we ask once how it went; that email says how to stop such asks, and an address that does is not asked again. Reviews are shown publicly with the reviewer's first name, last initial and town. If they pay a deposit or an invoice by card, the card details go to Stripe; we never see or store the card number. Text messages go to a client only if they ticked the box agreeing to them, and replying STOP ends them — as do QUIT, END, REVOKE, OPT OUT, CANCEL and UNSUBSCRIBE, or asking the notary or us. No person answers a reply to one of those texts. A reply is read by our software, to tell whether it asks us to stop or start again, and to note that someone at that number answered; a reply it cannot place gets the HELP words, once a day at most, where the number it came from agreed to our texts and hasn't stopped them. Where the software cannot tell whether a reply asks us to stop, and texts are still going to that number, a person on our team reads it for that one purpose. A mobile number given for texts, and the agreement to them, are used only to send those texts: they are never sold, and never shared with anyone for marketing. We keep the proof that someone agreed — the words they agreed to and when, whether they replied STOP, which texts were sent, the business they were for, and a one-way code of the number, which nobody without our key can turn back into it — for four years after the last text, because the law allows that long to question one. It is kept even when the request, or the notary's account, has been deleted.

Companies' accounts. The company's name and details, its staff's names and email addresses, the orders it sends (with the borrowers' and signers' names and the signing's address), messages with the notary, and the record of what it paid. Each order shows the notary it goes to who sent it — their name and the address they sign in with — whether that address is confirmed, and since when the company's desk has been on Hand & Seal. Someone at a company can start with a login of their own. Once their work address is confirmed, their desk shows them their company's desk if it is here already — one with someone on it whose confirmed address is at the same web domain, never a personal email service — and they may ask to join it; its owner sees the name and address of whoever asks, and decides. Nobody can search for which companies are here. Whoever joins may bring the orders they sent from their own desk, and the notaries they worked with, onto the company's desk; each of those notaries is told.

Early access. Before we open, notaries and companies can ask to be let in first. For each ask we keep: your email address; which you are (a notary, and what kind of work; a company; or something else); the ZIP code where you work most (a company's: where its office is) and the county it is in, which we look up ourselves; your company's name, if you are a company; how many signings or orders you handle a month and, for a notary, what you keep your books in today, if you tell us; the note you write, if any; when you ticked the box agreeing to our email; the word naming the link you followed to us, if it had one (for example "newsletter" — it names the link, never you); and the code of your own share link, with the code of the link that brought you, so we know who brought whom. Someone whose link brought you sees only how many people it has brought, never who. The IP address the form was sent from is kept 7 days, to limit how often it can be sent from one connection. We email you twice: once to confirm it was you who asked (again only if you ask again before confirming), and then your invitation — a notary's a week before sign-up opens to everyone, a company's the day desks for companies open, after the notaries have settled in. Nothing else is sent from the list, and it is never used for advertising. Each invitation — ours, and one a company sends a notary or a colleague through Hand & Seal — carries a link that stops such invitations for good, or every such letter from us at once (announcements and requests for a review too); an address that uses it is kept on a short list as a one-way code, which nobody without our key can turn back into the address, so that we can keep that promise. Someone who asks us another way — by email or a call — is put on the same list by a person here. How long each ask is kept is under "How long we keep it".

Visits to our pages. Before launch we count visits to our public pages by day, without setting or keeping any cookie, and keep nothing that identifies the visitor — only which page, the day, and the word naming the link that brought them. A browser where someone has signed in before is not counted. To stop abuse, how often one connection is counted is limited by a one-way code of it that changes every day and is kept a week at most. In the help center, the answers to "Was this helpful?" are counted the same way: which article, the day, yes or no, and nothing about who answered.

Cookies and your browser. We use no advertising cookies and no third-party analytics, and none of our cookies follows you anywhere else. These are all the cookies we set: the ones that sign you in and keep you signed in, with a short-lived one while you finish two-step sign-in; a fifteen-minute one called gmas_reset_proof, set when you choose a new password from a reset link — it holds, sealed, only which account that link was for, so that your next sign-in on that browser is not held up by someone else's wrong guesses at your password, and it is removed when you sign in; one called hs_known, set when someone signs in on a browser, which says only that someone has signed in on this browser before (and, while they are signed in, that they are) — so our public pages can offer "Sign in" or "Open Hand & Seal" instead of "Get early access". It is kept for a year, stays after you sign out, can be read by the page's own scripts, and gives no access to anything. One called hs_touch, kept for a year, says only that the browser is an iPad's: an iPad's browser describes itself as a Mac's, and our pages need to know which to draw. One more remembers light or dark mode (your browser's own storage keeps the same choice, for the help center and the offline page below); a one-hour one says that you arrived from the phone app; two carry a one-line message to the next page after you leave a business or close out a signing; and short-lived ones are set while you sign in with Google or Apple, connect Google Calendar or add a passkey. While you fill in a form, your browser may keep it until you close the tab. In the help center, your browser may remember whether you last read the steps for the web or for the phone (in its own storage, not a cookie; nothing is sent to us). Your browser also keeps a note of which of your businesses the last page you opened was drawn for, and when — a code, not your name — so another tab can tell it has changed. It is removed when you sign out. To open sealed documents, the browser keeps your device's key in its own key store. When you use the signed-in app, your browser also keeps a small helper from us (a service worker) and one page it shows when there is no connection, which says only that you are offline — none of your records are kept in it, and clearing this site's data removes it. Stripe may set its own cookies inside its payment and set-up pages. On the page where you set up card payments, Stripe's form uses a typeface that your browser fetches from Google Fonts, which tells Google your IP address.

Do Not Track. Our pages follow no one across other websites, so a browser's Do Not Track signal has nothing here to turn off. No other company collects what you do on our pages over time and across other websites, except Stripe on the pages where you pay or set up payments (including the set-up Stripe shows inside our settings), which may gather details about your device to prevent fraud, under its own privacy policy.

Security records. To stop password guessing we record login attempts with the IP address and a keyed hash of the email address — never the address itself — and delete them after 7 days. We record what happens to your login (signing in, a password changed, two-step sign-in or a passkey added or removed) and show it to you: each entry says what happened and when, with the IP address it came from and the device. It is kept 2 years. Our servers' error logs do not record personal details. Our content network's access logs record, for every request to our pages — a notary's page and the link to a request or an invoice among them — the IP address it came from, the browser, and the address of the page asked for, but not what was typed into it. The address of a private link — a request's, an invoice's, a review's, an invitation's — is its key, so the key is left out of what these logs keep: a line says which kind of link was opened, never which one. (Logs written before October 2026 hold the address as it was asked for; they are deleted with the rest, 90 days after they were written. Our hosting provider's own short-lived traffic reports can still show the address of a page that was asked for.) Only the people who administer our hosting can read any of this. The access logs are kept 90 days, in Virginia; our servers' error logs are kept 1 year.

Counting a business's letters. To keep a business from writing to more new people in a day than it may, and a company's desk from inviting more, we keep a one-way code of email addresses its letters or invitations reach — which nobody without our key can turn back into an address — with when the first one went and which of the day's limits, if any, it counted toward, for as long as the business's or the desk's account is kept. When someone is taken out of a notary's records, or a request's contact details are removed 90 days after it ended, the code of each address taken out goes too — unless one of the business's clients, contacts, jobs, requests, letters or emailed orders still holds that address; then it goes when that one is taken out, and stays, while the account is kept, if that one is deleted or changed some other way. If their first letter took a place in the last two days, that place stays counted, under a code that is no one's.

How we use it

To provide Hand & Seal: to show you your work, keep your records, work out your mileage deduction and tax set-aside, sync your calendar, pass orders between companies and notaries, and send what you ask us to send — invoices, reminders and receipts go out under your business's name, with replies going to you. To list notaries in the directory, in an order based on facts about each of them, including the badges they have earned for arriving on time and sending packages back promptly — a badge gives a small lift, and a late arrival carries no penalty: a notary without a badge is listed like someone new. To let the people on the early-access list in first, and to see where the asks come from. To see how people find our pages before launch, from visit counts that identify nobody, and which help articles answer people's questions, from counts of "Was this helpful?" answers that identify nobody. To keep the service secure and prevent abuse. To find and fix faults, from the error reports the app sends by itself. To answer you when you contact us. To meet legal obligations. To understand and improve Hand & Seal, from counts and totals that identify no one — how many jobs are booked in a week, for example.

A web address someone claims. If you show that an address is yours with the one more record we ask for — as we ask of anyone setting up an address another page here had at Amazon CloudFront, and of anyone claiming one another page holds ("Prove it's yours") — your claim waits 72 hours from when we find that record, whoever holds the address, or nobody. Then, if your record is still there, the address becomes your page's, unless the page holding it has got further first: it is live, or on its way to Amazon CloudFront. Your claim ends as soon as a look finds your record gone. While another claim's record is found at the address too, nothing moves: when only one is left, its own 72 hours start then. When your record is found, we tell everyone with a stake in the address at once that someone is claiming it — never your name, nor anything else of yours. Those are: the page holding it; every other claim of it; the page that last had it at Amazon CloudFront, for as long as our record of the address still names it; any account whose reservation of it ran out, or was taken off, in the last 30 days; and a page that takes the address up while your claim waits. If someone claims an address you have a stake in, we tell you at once: by email to your account's own address even if you have turned email alerts off, in the alerts you have on, and on your Settings page.

We do not sell personal information, and we do not share it for advertising. Nor do we give it to other companies for their own marketing.

Who else handles it

We use these companies to run Hand & Seal. Each handles information only to provide its service to us:

Payments between you and your clients are made through Stripe under your own Stripe account and Stripe's terms. Hand & Seal is not a party to those payments, never holds the money, and takes no share of it.

We may disclose information if the law requires it, to protect anyone's safety or rights, or as part of a sale or merger of our business (in which case this policy continues to apply to it).

What is public

Your public page, your listing in the Hand & Seal directory, and your clients' reviews are public because you choose to publish them. The directory lists notaries in an order based on facts including the badges they have earned; only badges are shown, never a late arrival. Companies can find listed notaries and send them orders, unless you turn off orders from new companies (it is on at first). Your credentials and your W-9 go to a company only if you turn sharing on. Each company's record of paying notaries — how quickly it has paid, and how often it has called a signing off late, worked out from the dates notaries recorded — is shown to notaries; a company can dispute a figure through Contact support. You can unpublish your page at any time.

In a business with more than one notary

A business's owners — its partners — see all of its records: its clients, jobs, invoices, payments and books. An employee sees the jobs handed to them and those jobs' clients; an assistant sees the bookings, clients and invoices, never the books. A notary's journal index and mileage log stay their own: nobody else in the business can read them, our support tools do not show them, and they go wherever that notary goes. A notary's commission, bond and errors-and-omissions dates are theirs and go with them too; the business's owners can see them, because the business answers for the notaries it sends, and our support staff can see a commission's state, number and expiry when helping with an account. The owners also see the timeline of each job the business gives a notary — when they set out, arrived and finished, and the proof photos they took, with where each was taken — but never a notary's drives or routes. A notary's refusals of senders ("No more from this sender") are their own: the business's owners and assistants see on a job's timeline that its sender was refused, and when, and so does the business's download, in that job's timeline and in its activity log, which lists every refusal made in the business — but never the notary's list of refusals, or the codes it is kept by. An owner or an assistant who takes someone out of the business's records at their request ends the notary's refusals of what that person typed that were made in that business, and the job taken out, and each of the business's jobs a refusal that ended was made from, says so on its timeline. Nothing of a refusal made in one business is shown in another, or ended there.

When a partner leaves a business, they may take a copy of its records up to that day, and copies of the clients they choose, into an account of their own — the information of the people in those records included; the business's owners agree to this when they add a partner. A partner is removed by another owner only with 14 days' notice. An employee or an assistant may leave at any time, and takes no copy of the business's records. Someone joining a business keeps their own account, and its records, as they were. When a business closes, the journal index, mileage log, W-9, public page and reviews of a notary who worked in it are not deleted with it: they go to that notary's own account, and the notary is told. Whenever someone joins a business, every owner of it is told who joined.

How long we keep it

While your account is open, your records are kept — your journal index, mileage log and books are the records of your work, and are never deleted by us on our own. Apart from that:

• A closed account: your page goes offline at once, and everything in the account is deleted 30 days later (signing in before then keeps it), except the records of a web address of your own described in the next bullet, which from then on name nobody. Copies in our backups are gone within 35 days after that.
• A web address of your own, once it is off your page, if it had gone as far as Amazon CloudFront, which serves it. We keep a one-way code made from it, a copy of it sealed with our key, and when it left. Until your account is deleted, we also keep that it was your page's. We keep it so that anyone else who sets the address up here is asked for one more record. It goes once our looks have found the address not pointing here for 90 days. Until then it is kept: for as long as the address goes on pointing here; for as long as our looks get no answer; and, if our key can no longer open its copy, for good. Until Amazon CloudFront has let go of the address (usually within a day), we also keep the same code and sealed copy with the entry that held it at Amazon CloudFront and the certificate it had, even after your account is deleted. If your reservation of an address ran out with no record found for it, or you took it off more than a day after setting it up with nothing found, we keep that, with a one-way code of the address, for 30 days. It goes with your account.
• Requests that ended without a signing (declined, expired, canceled, or taken by another notary): the requester's contact details, the signers' language, notes and messages are removed 90 days after the request ended. A client record made for it stays if the notary has since made a booking of their own on it or billed it, or a signing rests on it. A signing closed out as a no-show is kept as one that took place. When a company's order ends without a signing and something else of its sender's is still with the notary, the sender's name, email address and phone number can stay on the notary's record of that company for as long as something else of theirs does, which after a signing can be as long as the account lasts. Where the notary accepted an order sent from an address that isn't a free mail service's, the part of that address after the @ stays on that record. The company, and the name it was given, stay on that record. An address its bills go to, or a number others there share, stays too. Meanwhile we keep one-way codes made from the sender's email address and phone number — nobody without our key can turn them back into either — so that the sender's details can still be found and removed even if the notary deleted the sender's contact. The codes go when nothing of those details is left for us to remove from that record, and they are never in the notary's export. If that notary's own account is deleted, the requests and orders they were sent go with it, and these codes with them; the jobs those requests and orders made stay with that business. Just before, we take off what we would otherwise have taken later; where something else of the sender's is still with that business, or that can't be done at that moment, those details stay on the business's record until someone there takes them off.
• Devices you sign in on: a device's record, with its IP address and browser, 90 days after it is signed out or its sign-in runs out.
• Login attempts, and the IP address a form on our pages was sent from: 7 days; the one-way code of a connection that asked for address suggestions on a notary's request form (or, until November 2026, when asking several notaries at once), and the one-way code of each typing in which a suggestion was chosen there: 7 days; the one-way code of the connection a request or a company's order was sent from: for a day, and gone by the next morning's run; what is held for the few minutes between a right password and the code of a two-step sign-in: a day. Your login history (security activity), with the IP address and the device of each entry: 2 years.
• Senders a notary refused ("No more from this sender"): the one-way codes of the email address, the phone number and the internet connection on a request, 30 days from each time it is used; a connection's own, refused, a day; each gone by the next morning's run, or sooner when its refusal ends — but a contact's connection code, when its refusal ends early, at most until the day it would have ended.
• Diagnostics you send us: 60 days (attached to a message you then didn't send: a day). A screenshot you attach to a message: 60 days. Messages you send us for help, with the account details they came with and our notes on them: 2 years after we close the conversation — or after it was last touched, if it was never closed.
• Error reports the app sends by itself: 90 days; the note that a fault reached your account, 90 days after the fault was last seen. A description of the fault itself, which names nobody, is kept while we work on it. The count that keeps reports from being sent without end — against your account or, signed out, against a one-way code of your connection, never its address: 7 days.
• Sealed documents from a company: 72 hours after the signing is done (at once if the order is canceled or taken back), and never more than 14 days after they were sealed.
• A leaving partner's copy of a business's records, and the link emailed to them: 7 days, then deleted.
• A download too large to send to your browser directly ("Download everything" or "My data", once there are photos): the file is kept in our private storage for about a day at most, and the link to it works for five minutes.
• Notes kept so that a card payment is not lost or taken twice: that a card was started on a card reader — Stripe's reference for it, the amount, which invoice or job it was for and who started it — 7 days at most, and deleted sooner once Stripe says the card was cancelled; that Stripe's payment page was opened for an invoice or a deposit — Stripe's reference and the amount — 30 days after Stripe says how the page ended; that a payment was found at Stripe without its notice having reached us — Stripe's references and the times, nothing else — 30 days; and that Stripe told us of a dispute, a refund or a failed refund before the payment was in our records — Stripe's references, the amounts, a dispute's status, reason code and date to answer by, why a refund failed, and Stripe's time — until it is written on the payment, 30 days at most — or, where its payment is in our records and writing it has not worked yet, until it is, 60 days at most.
• The link that confirms the address your clients write to: it works once, for a day; its record, with the address it was for, is deleted 30 days after it runs out.
• Road distances: 30 days.
• Emails you forward: the email itself, a day at most; the words of an order still waiting as a draft, 30 days; what was read from an order that has been booked or put aside, 90 days after it arrived. Amazon's notice that such an email arrived, when our servers could not take it at once, waits up to 2 days to be read; its notice that a letter of ours bounced or was marked as spam, up to 14 days.
• An address one of our letters bounced from for good, or whose mail service reported one as spam: kept on our mail service's list of addresses not to write to, until we take it off.
• Proof that someone agreed to texts: 4 years after the last text (or after they agreed, when none was sent).
• A reply to one of our texts: its words and the number it came from, 30 days after it was sent — or, where a person had to read it to tell whether it asked us to stop texting, 30 days after they did.
• Addresses that asked for no more invitations, or no more requests for a review: kept, as one-way codes, for as long as such letters are sent — that is what keeping the promise takes.
• The codes a business's letters are counted by: for as long as the account is kept, unless the person is taken out of the notary's records first (see "Counting a business's letters"). A desk's, for its invitations: for as long as the desk's account is kept.
• Mobile numbers that asked us to stop texting them (in a reply, or by asking us another way): kept as one-way codes, which nobody without our key can turn back into a number, for 4 years after they last asked — so that no text goes to them on a later request until they reply START or UNSTOP.
• A mobile number that replied STOP, or another word that ends texts: also kept, as the number itself, on our texting service's list of numbers not to text, until it replies START or UNSTOP, or we take it off by hand.
• Notices we send every account's owners (that their data was reached, a new company, a change of price or terms): the letter is kept as the record that it was sent; the note of who received it goes when that person's account is deleted.
• Early access: an ask never confirmed, 30 days after it was made; once you have made your account with your invitation, 30 days after that; an invitation never used, a year after it was sent. A confirmed ask still waiting for its invitation is kept until the invitation goes.
• Invitations to a team or a company's desk never used: 90 days.
• Asks to join a company's desk: 90 days after they were answered or taken back.
• Files you remove: gone from Hand & Seal at once, and purged from storage after 30 days — a W-9 at once, with no earlier version kept; a proof photo's time stays on the job's timeline.
• Visit counts and "Was this helpful?" counts (no personal data): 395 days.
• Logs: our content network's access logs, 90 days; our servers' error logs, 1 year. Backups: 35 days.
• On your phone, after we sign it out with something unsent: 30 days at most.
• Privacy requests you send us: the record of it, 2 years after we answered.
• Our own team: the record that someone was on the team that runs Hand & Seal (their address and role), 2 years after they left it.
• What you paid us for Hand & Seal: the bills and payments are kept by Stripe, under its terms, for as long as tax law requires.

Most of these are deleted by a run each morning, on the first morning after their period ends — so they can stay up to a day past it.

Security

Hand & Seal is served only over HTTPS, and information is encrypted at rest by our hosting provider; the most sensitive items — two-step sign-in keys, calendar access, W-9s, and the private links kept in our database — are also sealed with a key of our own before they are stored. (When a private link is opened, our content network's access logs keep the kind of link and not its key, as "Security records" says above.) Each business's records are kept apart in the database itself, so one business cannot read another's — except what you exchange with the companies and notaries you work with: their orders, the messages between you, and what you choose to share.

Our own staff see personal information only where running the service needs it, and only through support tools that record every look and every action:

• the messages and diagnostics you send us, and the error reports the app sends by itself;
• an account they look up to help with it, or to help someone locked out of it — how it signs in, its devices and login history, its plan, and a notary's commission;
• the early-access list;
• the reviews on a notary's page, when one is to be removed for one of the reasons our terms give;
• each account's owners, by name and email address — to send them a notice we owe them, and to keep the list of whom to tell;
• and what answering a privacy request takes: which of the orders a company sent name a person (the notary's business, the job's number and its date), an address or a number that asked us to stop writing or texting, and what a number agreed to about texts.

Apart from what you send us yourself, those tools never show a notary's journal index, mileage log, clients or invoices. Staff cannot sign in as you. The few people who administer our hosting — today, the company's owner — can reach the database itself; connections to it are logged. If a security breach affects your information, we will tell you as the law requires.

Your choices and rights

Wherever you live, you can do all of this — and ask us for any of it at privacy@handandseal.app.

• See and correct your information in the app, at any time, including your email address (confirmed by a link to the new one; the old one is told). Journal lines are corrected by an amendment; messages already sent and reviews cannot be edited.
• Take your information with you: Settings → Your data → My data downloads what we hold about you yourself, whatever your role: your account, how you sign in and from where, your login history, the businesses you belong to, the devices you set up to open sealed documents, what you wrote to us for help and on requests, the error reports the app sent while you were signed in, your early-access request if we still have it — and, if you are a notary, your commissions, your journal index, your mileage log with its drives and odometer readings, your answers on how your drives from home are filed, your tax details, your home base and hours, the busy times your phone sends, the companies you stopped, your calendar links, your Google profile set-up (the step you are on, what you told it, and when, and when each of its two links first opened your page — those times start again when the links you put in no longer reach your page and you tell it the new ones are in; never the links themselves), the senders you refused (when, until when and on which job, and, for one whose refusal ended early, or whose request held nothing but what your client records hold, that still counts toward refusing a connection, until when it counts, with no job — never what they typed or the codes they are refused by), and your page. Any owner of a business can also download all of its records (Settings → Download everything): its clients, jobs, invoices, books, fees and reviews, with messages and photos. A W-9 file and private links are in neither download. A partner leaving a business may take a copy of it as they go.
• Delete your account: Settings → Your data → Close my account (on the phone, Settings → Close my account opens it). Everything is deleted 30 days later; until then, signing in keeps it. The records of a web address of your own that had gone as far as Amazon CloudFront stay, naming nobody, as "How long we keep it" says. If you sign in with Apple, Apple is told at once to forget Hand & Seal for you. Copies in backups are gone within 35 days after that. What is part of other people's records stays with them — jobs you worked on in someone else's account (without your name), orders you sent to notaries, messages you sent. If you take card payments, your Stripe account is your own and stays open: you close it, or disconnect Hand & Seal from it, in Stripe. Can't sign in? Reset your password from the sign-in page, then close it yourself. Or ask us (Help → Contact support, "Account & sign-in", or privacy@handandseal.app): once we have checked by email, at the address the account uses, that the request is yours, we close it for you in the same way. The steps are at handandseal.app/help/notaries/account/close-your-account.
• The record of a web address of your own that had gone as far as Amazon CloudFront is not deleted on request. It goes by itself 90 days after the address stops pointing here, and not before. A domain held by its registrar, or let lapse and won back, can come back with its old record pointing here, and the record is what keeps anyone else from setting the address up here with nothing more than that. To end it, remove the record where your domain is kept.
• Withdraw permissions — location, notifications, camera, calendar — in your phone's settings or in Hand & Seal's.

If you are in a notary's records, ask the notary: in Hand & Seal they can find the records that name you — clients, jobs, requests, orders forwarded by email, journal lines, messages — and take you out of them: your name, how to reach you, the address, the notes about you, the signers' language, the loan, file and tracking numbers of your signing, and where each photo of it was taken and what it was called. Six things Hand & Seal leaves, and the notary will tell you so:

• the core of a line in the journal index — who signed, the act, the date, the document, the kind of ID and its last four digits. A line there is corrected by an amendment and never rewritten;
• the place a drive ended, in the notary's mileage log;
• your name on an invoice already issued to you, on the lines of the notary's books for what you paid, and in a note the notary wrote on that invoice;
• a photo the notary took at the signing — the picture itself, which is the notary's proof of having come or of sending the documents, without where it was taken or its caption. The notary can remove the photo;
• the town the signing was in, on its job, though not its address;
• a review you wrote on the notary's page, without your name or your town on it; if its own words name you, we remove it if you ask us.

What a notary's own state has them keep is for the notary to say.

If you are named in an order a company sent, ask the company or the notary; a company asks us, and we take you out within 10 days — except from an order whose signing is still ahead, which keeps who is signing and where until it is done or cancelled. You can also write to us, and we will help.

California residents have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to limit the use of sensitive personal information; and to opt out of its sale or sharing for advertising. We will not treat you differently for using these rights. You can use them by writing to privacy@handandseal.app; we will confirm who you are (usually by a reply from the address we hold), an authorized agent may act for you with your signed permission, and we answer within 45 days. We honor these rights whether or not California's privacy law yet applies to a company of our size.

• What we collect, from whom, and why: identifiers and contact details, commercial records (jobs, invoices, payments), account credentials, precise location (drive recording, as above), photos, and the records described in "What we collect" — from you, from the notaries and companies you work with, and from the services listed above — to provide Hand & Seal, secure it and meet the law.
• Sensitive personal information we hold: Social Security or employer numbers (in a W-9), precise location, account login details, and the last four digits of an ID number. We use it only to provide the service you asked for, never to infer anything about you.
• We neither sell nor share personal information, so a Global Privacy Control signal from your browser has nothing to switch off.

Children

Hand & Seal is for adults running a notary business, and its accounts are for people 18 and over. We do not knowingly collect personal information directly from children, and if we learn that a child has given us personal information, we will delete it.

A notary's records can mention a minor — a minor who signs a document, or a child named in one. That information is part of the notary's records, which we hold on the notary's behalf (see "Three kinds of people, and our role for each"): the notary decides what is kept, and a parent or guardian with a question about it should ask the notary first; we will help them answer.

Changes

We will post any change here and update the date above; if a change matters, we will tell you by email or in the app before it takes effect.

Contact

Tessera Systems, LLC — Hand & Seal, PO Box 7221, Laguna Niguel, CA 92607-7221 — privacy@handandseal.app