This policy explains what personal information FaxToFax collects through FaxToFax, why we collect it, who we share it with, how long we keep it and the rights you have. We collect only what we need to run the service: account details, billing information, the faxes our customers send and receive, and technical logs. We do not sell or share personal information, we do not use advertising or analytics cookies, and we never use the contents of faxes for advertising or to train artificial intelligence. For the faxes themselves we act on behalf of the customer organization that uses FaxToFax, and that organization decides how they are used.
1. Who we are
FaxToFax (faxtofax.com) is operated by FaxToFax.com ("FaxToFax", "we", "us" or "our"). FaxToFax is the controller of the personal information described in this policy as "Account Information".
You can contact us about privacy at privacy@faxtofax.com. We have not appointed an EU or UK representative; contact privacy@faxtofax.com.
2. Our two roles
We handle personal information in two different capacities, and it matters which one applies.
- As a controller, we decide how and why we use Account Information: details about our customers and their users, billing records, logs, and messages you send us. This policy mainly covers this information.
- As a processor (also called a service provider, or a business associate under HIPAA), we handle "Customer Data" on behalf of our customers: the documents, faxes, cover pages, contacts, fax numbers and transmission details that customers send, receive and store using FaxToFax. We use Customer Data only to provide the service and as our customer instructs, under our Terms of Service, Data Processing Addendum and, where signed, Business Associate Agreement.
If you are a patient, client, or another person whose information appears in a fax sent to or from one of our customers, that customer is responsible for your information and its own privacy notice applies. Please contact that organization directly. If you contact us, we will pass your request to the customer where we can identify it.
3. Information we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account and profile | Name, email address, organization name, role, two-step verification settings, and the signer name and job title if you sign our Business Associate Agreement | You, or the administrator who invited you |
| Billing | Billing contact details, plan, invoices, payment history and status, card brand, last four digits and expiry date. We never receive or store full card numbers. | You and our payment processor, Stripe |
| Customer Data (fax content) | Documents you upload, faxes you receive, cover pages, saved contacts, sender and recipient fax numbers, dates and times, page counts, delivery status and a SHA-256 fingerprint of each fax | Our customers and their users, people who send faxes to our customers' numbers, and our telecommunications carrier |
| Logs and security | IP address, browser user agent, sign-in events, and audit events recording views, downloads, sends and settings changes, with dates and times | Collected automatically when you use FaxToFax |
| Communications | Emails you send to our support, privacy or security addresses, and our replies | You |
| Cookies and browser storage | A session cookie that keeps you signed in, and small preference settings stored in your browser | Your browser; see our Cookie Notice |
| Website visit statistics | The pages viewed on our public website, the website that referred you, your country and your type of device, counted with a code that changes every day. We do not use cookies for this and do not store your IP address. | Collected automatically when you visit our website |
Customer Data may include sensitive information, such as health, legal or financial information. We process it only on our customer's behalf and as described in section 2.
4. How we use information and our legal bases
If you are in the European Economic Area, the United Kingdom or Switzerland, data protection law requires us to have a legal basis for each use of your personal information. The bases we rely on, under Article 6(1) of the GDPR and UK GDPR, are shown below.
| Purpose | Information used | Legal basis |
|---|---|---|
| Creating and running your account, signing you in with one-time codes and two-step verification, and applying team roles | Account and profile, logs | Performance of a contract (Art. 6(1)(b)); for users invited by a customer, our and the customer's legitimate interests in running the customer's account (Art. 6(1)(f)) |
| Sending, receiving, storing and displaying faxes, and sending new-fax alerts | Customer Data, account and profile | Performance of a contract (Art. 6(1)(b)); for Customer Data we act on the customer's instructions |
| Taking payments, issuing invoices and receipts, renewal reminders and keeping tax records | Billing, account and profile | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Keeping the service secure, keeping audit logs, preventing fraud, junk faxes and toll fraud, and enforcing our policies | Logs and security, account and profile, transmission details | Legitimate interests in protecting our customers, our service and the telephone network (Art. 6(1)(f)); legal obligation where applicable (Art. 6(1)(c)) |
| Answering support, privacy and security requests | Communications, account and profile | Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)); legal obligation for privacy requests (Art. 6(1)(c)) |
| Fixing problems and improving the reliability of the service | Logs (not fax content) | Legitimate interests in running a reliable service (Art. 6(1)(f)) |
| Complying with the law, responding to lawful requests, and establishing or defending legal claims | Any relevant information | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have balanced those interests against your rights. You can ask us for more information about this balancing, and you can object, as described in section 10.
5. What we do not do
- We do not sell personal information, and we do not share it for cross-context behavioural advertising.
- We do not use the contents of faxes for advertising, profiling or training artificial intelligence models.
- We do not use advertising or analytics cookies, and our website does not load third-party fonts.
- Our new-fax alerts never contain the contents of the document.
- We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
6. Who we share information with
- Subprocessors: providers that help us run FaxToFax, namely Cloudflare (hosting, storage, database and email), our telecommunications carrier (fax transmission and fax numbers) and Stripe (payments). They may use the information only to provide their services to us. See Annex 3 of our Data Processing Addendum.
- Your organization: if you use FaxToFax as part of a customer's team, the account owner and administrators can see your name, email address and role, and the audit log of your activity, such as which faxes you viewed, downloaded or sent.
- Fax recipients: when you send a fax, the recipient receives the document and the sender identification on each page, which includes your organization's name, fax number and the date and time.
- Professional advisers, such as lawyers, accountants and auditors, under duties of confidentiality.
- Authorities: where we are legally required to disclose information, for example to comply with a court order. If a request concerns Customer Data, we will try to redirect it to the customer and, where the law allows, tell the customer about it.
- A buyer or successor, if our business or the FaxToFax brand is sold, merged or reorganized, subject to this policy.
- Anyone else, with your permission or at your direction.
7. International transfers
Our providers process information in the United States and, for Cloudflare, on its global network, and for Stripe, in the United States and Ireland. This means your information may be processed outside the country where you live. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum and Swiss amendments where applicable, or another lawful transfer mechanism. If you are in Canada, your information may be processed outside Canada, mainly in the United States, where courts and authorities may be able to access it under local law; our contracts with providers require them to protect it. You can ask for more information about these safeguards at privacy@faxtofax.com.
8. How long we keep information
| Information | How long |
|---|---|
| Fax documents and images | For the retention period the customer chooses (30 days, 90 days, 365 days, 7 years, or until deleted manually), after which they are purged automatically. Faxes the customer deletes leave the account at once and are permanently purged within 30 days; closing the account deletes them immediately. Our fax provider is instructed not to store outbound fax documents, and we delete inbound documents from its systems after copying them to our storage. |
| Account and profile information | While the account is open. When an account is closed, personal data is deleted except the records described below. |
| Invoices and billing records | For as long as tax and accounting laws require, including after the account is closed. |
| Audit log | For the life of the account. After closure, only those audit records we are required by law to keep, for as long as the law requires. |
| Security and server logs | Up to 30 days. (Your account’s audit log is kept for the life of the account.) |
| Support and privacy correspondence | As long as needed to deal with your request and any follow-up, and longer only where we need it to show that we handled a legal request correctly. |
| Backups | Deleted information may remain in encrypted backups for up to 30 days before it is overwritten. |
9. How we protect information
We use technical and organizational measures designed to protect personal information, including encryption of fax documents in transit (TLS 1.2 or higher) and at rest (AES-256), email one-time-code sign-in, optional or required two-step verification, automatic sign-out after inactivity, role-based access, an append-only audit log, and restricted access to production systems. No system is perfectly secure, and faxes are not encrypted while they travel over the public telephone network to a recipient's fax machine. Our Security Overview gives more detail.
10. Your rights
Depending on where you live, you may have some or all of the rights below. These rights have limits and exceptions under the law, and we will explain if one applies to your request. If your request concerns Customer Data held for one of our customers, we will refer it to that customer or help the customer respond.
10.1 European Economic Area, United Kingdom and Switzerland
- Access: get a copy of your personal information.
- Rectification: have inaccurate information corrected.
- Erasure: have your information deleted.
- Restriction: ask us to limit how we use your information.
- Portability: receive information you gave us in a structured, machine-readable format, or have it sent to another provider.
- Objection: object to processing based on legitimate interests.
- Complaint: complain to your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to address your concern first.
10.2 California and other U.S. states
If the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), or a similar state law applies to us, residents of the relevant state have the following rights.
- Right to know what personal information we collect, use and disclose, and to get a copy of it.
- Right to delete personal information we collected from you.
- Right to correct inaccurate personal information.
- Right to opt out of the sale or sharing of personal information. We do not sell or share personal information, as those terms are defined in the CCPA, and have not done so in the past 12 months. If your browser sends a Global Privacy Control signal, we treat it as a valid opt-out request.
- Right not to be discriminated against for exercising these rights.
In the past 12 months we have collected the categories of personal information described in section 3: identifiers (such as name, email and IP address), customer records and commercial information (such as billing details and purchase history), internet or network activity (such as logs and audit events), professional information (such as organization name and job title) and account log-in information. We collected it from the sources and used it for the purposes described in sections 3 and 4, and disclosed it for business purposes only to the recipients described in section 6. We use sensitive personal information, such as account log-in information, only for purposes permitted by the CCPA, such as providing the service and keeping it secure. Retention periods are described in section 8. Protected health information governed by HIPAA is not covered by the CCPA and is handled under our Business Associate Agreement.
You may use an authorized agent to make a request on your behalf; we may ask the agent for proof of authorization and ask you to verify your identity. If we decline your request, you can appeal by replying to our decision; if we deny your appeal, you can contact your state attorney general.
10.3 Canada
Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and similar provincial laws, you can ask to access and correct your personal information and withdraw consent to its use, subject to legal and contractual limits (for example, we cannot provide the service without your email address). You can complain to the Office of the Privacy Commissioner of Canada.
10.4 Ontario health information
If your personal health information is in a fax handled for an Ontario health information custodian, such as a clinic or hospital, that custodian answers access and correction requests under Ontario's Personal Health Information Protection Act (PHIPA). We will forward any such request we receive to the custodian.
10.5 How to exercise your rights
- Email privacy@faxtofax.com and tell us which right you want to exercise.
- Account owners can also export all of the account's data, and close the account, from within FaxToFax. Closing an account deletes fax documents and personal data, except invoices and audit records we are required by law to keep.
- To protect your information, we will verify your request, usually by confirming it from the email address on the account.
- We respond within the time limits set by applicable law, for example one month under the GDPR and 45 days under the CCPA, which can be extended in some cases. We will tell you if we need more time.
- Exercising your rights is free, unless a request is clearly unfounded or excessive.
11. Emails we send
We send service emails that you need in order to use FaxToFax, such as sign-in codes, receipts, renewal reminders, cancellation confirmations and security notices. You cannot opt out of these while you have an account, because they are part of the service. We will not send you marketing emails without your consent where the law requires consent, and every marketing email will include a way to unsubscribe.
12. Children
FaxToFax is a service for businesses and adults. It is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact privacy@faxtofax.com and we will delete it.
13. Changes to this policy
We may update this policy as our service or the law changes. We will post the updated version here with a new "last updated" date. If a change materially affects how we use your personal information, we will tell account owners by email or in the app before it takes effect.
14. Contact
FaxToFax.com. Privacy questions and requests: privacy@faxtofax.com. Security reports: security@faxtofax.com. We have not appointed an EU or UK representative; contact privacy@faxtofax.com.