Skip to main content
MechForms — Contractor DocumentsLegal

Privacy Policy

Last Updated: October 14, 2026

This Privacy Policy explains how MechForms, available at mechforms.app, collects, uses, protects and retains personal information when you use our contractor document services. For privacy questions or requests, contact support@mechforms.app.

1. Information We Collect

  • Account information: Your name, email address and sign-in information, including information supplied through Google sign-in when you choose it.
  • Business and team information: Company details, addresses, trade credentials, logos, tax settings, team memberships and other settings you provide.
  • Document information: Client names and contact details, scopes of work, estimates, line items, photos, signatures, payment links and saved document history.
  • Billing information: Subscription status, customer identifiers and payment-related records. Stripe processes payment card details; MechForms does not store complete payment card numbers.
  • Support and security information: Support messages, information submitted to our automated AI assistant, and operational or security logs needed to protect and maintain the service.

Provide only information you are authorized to use. Avoid including sensitive personal information in documents or support messages unless necessary.

2. How and Why We Use Information

We use information to create and secure accounts, provide document tools and team access, deliver requested emails, manage subscriptions, respond to support requests, and prevent fraud or misuse. Where the GDPR applies, our legal bases include performing our contract with you, complying with legal obligations, legitimate interests in operating and securing the service, and consent for optional tracking. You may withdraw consent without affecting the lawfulness of processing before withdrawal.

3. Cookies and Optional Tracking

Essential cookies or browser storage support sign-in, security and remembering your cookie choice. Optional analytics or tracking scripts may initialize only after you choose “Accept All” in the cookie banner. Choosing “Decline” blocks optional tracking and hides the banner. Your choice is saved locally in your browser, so it may differ across devices.

To change your choice, clear this site's stored cookie-consent preference in your browser and reload the site to see the banner again. You can also clear existing cookies and site data using your browser settings; doing so may sign you out. Declining optional tracking does not prevent you from using the service.

4. Sharing and Service Providers

We share information only as needed to provide the service, follow your instructions, protect legal rights, or comply with law. Providers include Lovable Cloud for hosting, authentication and data storage; Google if you choose Google sign-in; Stripe for billing; Resend for transactional email; and AI service providers used through the Lovable AI Gateway when you submit messages to our automated assistant. Requested document emails share their contents with the recipients you specify. Authorized company team members may access information according to their assigned permissions.

We do not sell personal information or share it for cross-context behavioral advertising as those terms are defined by the CCPA/CPRA. Service providers may process information in countries other than your own. Where required, transfers must be supported by applicable legal safeguards. Contact us for information about safeguards relevant to your data.

5. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described here. Account, business and document information is retained while needed to provide your account and document history. Billing records may be retained to meet tax, accounting or other legal obligations; security records may be retained as needed to investigate misuse or resolve disputes. Retention depends on the record's purpose, legal requirements and outstanding claims, rather than an unlimited right to keep your data.

When information is no longer needed, it is deleted or anonymized. Backup copies may remain until replaced through the normal backup cycle and must not be used for unrelated purposes. Copies already delivered to customers or held independently by third parties are not automatically recalled by deleting your MechForms records.

6. GDPR and CCPA/CPRA Rights and Deletion

Subject to applicable law, individuals covered by the GDPR may request access, correction, erasure, restriction of processing or data portability; object to processing based on legitimate interests; withdraw consent; and complain to their local data protection authority.

California residents covered by the CCPA/CPRA may request to know and access the categories and specific pieces of personal information collected, the sources, purposes and categories of recipients; request correction or deletion; and exercise applicable rights to opt out of sale or sharing and limit certain uses of sensitive personal information. We will not discriminate against you for exercising a protected privacy right. Authorized agents may submit requests with appropriate proof of authorization.

You can email support@mechforms.app at any time to request complete deletion of your account and associated personal data. We will verify your identity proportionately before acting and may ask for information needed to locate your records. Do not send passwords or full payment card details. Where we process client data on a contractor's behalf, we may refer the request to that contractor or coordinate with them as required by law.

We respond within applicable statutory periods: generally one month under the GDPR or 45 days for CCPA access, correction and deletion requests, with extensions only where legally permitted and with notice. Deletion rights are subject to lawful exceptions, including required recordkeeping, fraud prevention and legal claims. If an exception applies, we will explain it and limit any retained information to the permitted purpose. Deleting your account may make saved documents unavailable; export needed records first.

7. Security and Policy Updates

We use access controls and other reasonable safeguards to protect information, but no online service can guarantee absolute security. We will post revisions here with an updated date and provide additional notice when required by law. This policy does not waive your non-excludable statutory rights.

Privacy contact: support@mechforms.app.

C. Jordan
MechForms