Legal

Privacy Policy

Get Safe Now LLC, doing business as KeepSealed · Last updated October 21, 2026

Your documents are encrypted on your devices before they are uploaded, and we have no way to open them. We do not sell, rent or otherwise make money from anyone’s personal information.

This policy explains what KeepSealed keeps, why, for how long, and who helps us run the service. In this policy:

• “KeepSealed”, “we”, “us” and “our” mean Get Safe Now LLC, which operates KeepSealed.
• “Firm” means a law firm or other organization that subscribes to KeepSealed.
• “Staff” means the people at a firm who sign in to KeepSealed.
• “Clients” means the people a firm shares documents with through KeepSealed.
• “Service” means the KeepSealed web app and the website at keepsealed.com.

Use of the service is covered by our Terms.

1. Who is responsible for your information

Get Safe Now LLC is responsible for the information we collect about firms and their staff, and for the website.

Clients’ details, and the documents a firm shares, are added by the firm. The firm decides whose details to add and what to share with them. We hold and use them on the firm’s behalf, to provide the service to that firm, answer its support requests and keep the service secure, and for nothing else unless the law requires it. Our Data Processing Addendum sets out the terms of this. If you are a client, your law firm is your first point of contact for questions about your details; we help firms answer those questions.

2. What stays encrypted

These are encrypted on the devices of the people who use KeepSealed before they are uploaded. We store them only in encrypted form and have no way to open them:

• The contents of every document
• File names and file types, folder names and case names
• Document request titles
• Exact file sizes. Files are stored at standard sizes, so their real size stays hidden

3. What we keep, and why

Firms

• The firm’s name, plan and subscription status, and identifiers from Stripe, our payment provider, so we can provide and bill for the service.

Staff

• Email address and, if given, name, so staff can sign in and be recognized by colleagues.
• A one-way hash of the password, never the password itself.
• Role, which cases each person is authorized for, when they joined and who approved them, and when they were last active, so the firm controls access.
• The security information that lets each person’s devices exchange encrypted documents, stored in encrypted form that the staff member’s recovery kit opens.
• If notifications are turned on, the browser’s address for receiving them (see section 6).

Clients

• Name, company, email address and mobile number, as entered by the firm or imported from its Clio account, so we can email invitations and text sign-in codes.
• Which cases they can see, and the devices they have signed in on, so their documents reach only them.
• Sign-in codes are stored only as one-way hashes, and expire after 10 minutes.

Clio

• If a staff member connects their Clio account, their Clio user and account numbers and their Clio access, stored encrypted, so KeepSealed can read their matters and contacts when they ask. Disconnecting Clio deletes the stored access.
• Matter and contact details read from Clio pass through our servers to that staff member’s browser and are not stored, except the clients the firm imports (kept as described under Clients) and the Clio numbers that link imported clients and cases to Clio. Case names made from Clio matters are encrypted like every case name.

Documents and cases

• Approximate file sizes, how many files and folders a case has and how they are arranged, who uploaded each file and when, and document request due dates, so the service can store, list and deliver documents.

The activity record

• Actions in KeepSealed, including sign-ins and failed sign-in attempts; sign-in codes sent; cases, folders and requests created, renamed or deleted; devices added; files uploaded, opened, downloaded, exported or deleted; invitations; changes to access and to client details; and billing changes, each with the time and the IP address involved. This is the firm’s activity record. Staff at the firm can view it, and nothing in KeepSealed lets anyone edit or delete an entry.
• A record of each email and text we send: who it went to, which kind, and when.

Server logs

• Our servers record IP addresses, browser types, the pages and actions requested, errors, and the time, to keep the service secure and working. Sign-in links and secrets are removed before anything is written.

Support

• If you email us, your name, email address and what you write, so we can help you.

Payment

• Card details are entered into Stripe’s secure payment form and go directly to Stripe. We never see or store them. We share with Stripe the firm’s name and the email address of the administrator who sets up billing.

4. Why we are allowed to use it

Where UK data protection law applies to information we are responsible for, we rely on:

• Our contract with the firm, for accounts, sign-in, the service itself, and billing
• Our legitimate interests in keeping the service secure, preventing fraud and misuse, and answering support requests
• Legal obligations, for tax and accounting records and lawful requests

5. Text messages

We text clients one-time verification codes only when they ask for one. We use mobile numbers only to provide the service, never for marketing. We do not sell or share mobile numbers with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third parties. The full details, including how to stop texts, are on our text message page.

6. Notifications

Staff can choose to turn on browser notifications. When they do, we keep the address their browser gives us for receiving them. Notifications are delivered through the browser maker’s push service (Google, Apple, Mozilla or Microsoft). Each notification is encrypted and contains no names or case details: only that a client is waiting, a client has uploaded documents, a new colleague has joined, or, when staff ask for one, that notifications are working. Turning notifications off removes the address.

7. Cookies and browser storage

• The website sets no cookies and runs no analytics, advertising or tracking scripts.
• Signing in sets two cookies: one that keeps you signed in and one that protects your requests. Both are needed for the service to work, and both end within 12 hours.
• The billing page uses Stripe’s secure payment form, and Stripe may set its own cookies there to prevent fraud. (Stripe’s cookie policy)
• The app keeps what your device needs to open your documents, the details of your current sign-in, a few settings and, for clients, the names of the firms they use on that device, in your browser’s own storage. What opens your documents is stored encrypted.

8. How we use information

We use the information above only to:

• Provide the service: sign-in, sharing, delivery of documents, notifications and the activity record
• Send invitations, sign-in codes, and service and billing emails
• Take payment and manage subscriptions
• Answer support requests
• Keep the service secure and protect against fraud and misuse
• Meet our legal obligations, and establish or defend legal claims

We do not use anyone’s information for advertising, we do not build profiles, and we make no decisions about anyone by automated means.

9. Who helps us run KeepSealed

We do not sell, rent or trade anyone’s information. These providers help us run the service:

• Contabo hosts our servers, including our mail server, in the United States.
• Cloudflare carries all traffic to and from KeepSealed over encrypted connections, protecting the service from attacks, and stores the encrypted documents and our encrypted database backups (Cloudflare R2). (Cloudflare’s privacy policy)
• Stripe takes payments. (Stripe’s privacy policy)
• Twilio delivers sign-in codes by text. (Twilio’s privacy policy)
• Google, Apple, Mozilla and Microsoft deliver browser notifications for staff who turn them on.

Legal demands. If we receive a legal demand for a firm’s information, we refer the requester to the firm and, unless the law prohibits it, tell the firm promptly so it can respond or object. We disclose only what the law requires. Documents are stored encrypted, and we have no way to open them.

Business transfers. If Get Safe Now LLC is sold or merges with another company, the information we hold may transfer as part of that, and this policy continues to apply to it. Where we can, we tell firms in advance.

10. How long we keep it

• Documents are kept until the firm deletes them. A deleted file is removed from storage immediately.
• Firm, staff and client details, and the activity record, are kept while the firm has a KeepSealed account. Removing a colleague or client ends their access; their details stay with the firm’s account, so its activity record stays complete.
• When a subscription ends, the firm can open, download and export its documents for 30 days, and the account is then kept for a further 90 days so the firm can restart and carry on where it left off. After that, we permanently delete the firm’s documents, cases, requests, staff accounts, client details and activity record. We keep the firm’s name and its billing history as our record of our customer. An administrator can ask us to do this sooner, and we do so within 30 days of the request. Deleted information leaves our encrypted backups within a further 30 days.
• Server logs on the servers that run KeepSealed are kept for up to 14 days.
• Backups of our database are encrypted and kept for up to 30 days. Documents are not part of these backups.
• Notification addresses are kept until notifications are turned off, the staff member is removed, or the browser stops accepting them.
• Support emails are kept for as long as the firm has an account.
• Payment records are kept by Stripe as the law requires.

11. How we protect it

Documents are encrypted end to end, and everything travels over encrypted connections. Only the few people at Get Safe Now LLC who run the service can reach our systems, and only to do that work. Some of them are in Canada, and the same limits apply to them. We keep our protections under regular review. No method of storing or sending information is perfectly secure.

If a security incident affects personal information, we tell the affected firms without undue delay after we become aware of it, and help them meet their own duties to notify. Where we are responsible for the information, we notify regulators as the law requires (in the United Kingdom, the Information Commissioner’s Office, within 72 hours where feasible).

12. Your choices and rights

You can ask us to:

• Tell you what information we hold about you, and give you a copy in a common format
• Correct it
• Delete it, or limit how we use it
• Stop using it for a particular purpose (you can object to any use based on our legitimate interests)

Staff and firms can email support@keepsealed.com. Clients can ask their law firm, which can correct client details directly in KeepSealed; if you contact us about your details as a client, we pass your request to your firm and help it respond. We respond to requests about information we are responsible for within one month, and usually much sooner. Some records, such as the firm’s activity record, are kept for as long as the firm’s account exists; if we cannot meet a request in full, we explain why.

Firms can export any case, decrypted, while they have access.

If you are in the United Kingdom, you can also complain to the Information Commissioner’s Office.

13. Information transferred to the United States

Get Safe Now LLC is based in the United States and our servers are in the United States. Cloudflare, which carries our traffic and stores encrypted documents, may process data in the countries where its network operates. If you are in the United Kingdom, your information is transferred to the United States. Our personnel in Canada may also access it, to run the service. Where UK law requires a safeguard for that transfer, we rely on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it, or otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Email us for details of the safeguard that applies.

14. Children

KeepSealed is for law firms and their clients, and is not directed at children under 13. We do not knowingly collect information from children under 13, and if we learn that we have, we delete it.

15. Changes to this policy

If we change how we collect, use or share personal information, we will post the new policy here and email firm administrators at least 30 days before it takes effect. Smaller changes, such as wording or contact details, take effect when posted. The date at the top shows the latest version.

16. Contact

Get Safe Now LLC, doing business as KeepSealed
1309 Coffeen Avenue, STE 1200, Sheridan, Wyoming 82801
support@keepsealed.com