Privacy Policy

HootQuill is operated by Xplicit Tech Solutions, 6799 Main St, Cherry Creek, NY 14723. Reach us at support@hootquill.com.

Account data is information about the people who use HootQuill: name, email address, organization, and authentication records. We are the controller of this data.

Customer content is what you put into HootQuill — your clients, your pricing, your agreements, and the signatures collected on them. We process this on your behalf and at your direction. We do not sell it, mine it, or use it to train anything.

• Account and authentication details, to sign you in and secure the account.
• Content you create — clients, catalog items, quotes and agreements.
• Signature evidence: for each signer, the timestamp of consent and of signing, IP address, browser user agent, and a cryptographic hash of the exact document shown. This exists to make signatures defensible, and it is retained with the agreement.
• Operational logs and an immutable audit trail of actions taken in the product, used for security, support and dispute resolution.

We rely on these providers to deliver the service:

• Supabase — database and authentication (United States).
• DigitalOcean — application hosting (United States).
• Wasabi Technologies — document and backup storage (United States).
• An electronic signature provider where signature collection is delegated rather than handled in-house. The provider in use is disclosed in your account settings.

We will give notice before adding a subprocessor that handles customer content.

Executed agreements and their audit trails are retained for the life of your account and for a period afterwards, because their evidentiary value depends on being available long after signing. Deleting an agreement does not remove it from backups immediately; backup copies age out on their own schedule.

You may export your data at any time. On account closure we delete customer content within 90 days, except where retention is required by law.

Data is encrypted in transit and at rest. Tenant data is isolated at the database level, and the audit log is append-only and hash-chained so that alteration is detectable. No system is perfectly secure, and we do not claim otherwise.

You may request access to, correction of, or deletion of your personal data by writing to support@hootquill.com. If you are a signer rather than an account holder, contact the organization that sent you the agreement — they control that record, and we act on their instructions.

HootQuill is not intended for anyone under 18.

We will post material changes here and, for account holders, notify you by email before they take effect.