Privacy policy

1. Who we are

This privacy policy explains how Firmlane ("Firmlane", "we", "us" or "our") collects, uses, shares and protects personal information when you visit firmlane.us, create an account, place an order or use our ongoing services.

Firmlane is operated by Firmlane, 47 W 13th St, New York, NY 10011. Where data protection laws use the term, that entity is the controller of the personal information described in this policy.

Firmlane helps founders in the United States and around the world form and maintain US companies. Forming a company means sharing some of your information with state agencies and, if you ask for EIN assistance, with the IRS. Some of that information may become part of the public record. Section 5 explains this.

This policy does not cover the websites or services of state agencies, the IRS, Stripe or other third parties, even when we link to them. Their own privacy policies apply.

2. Information we collect

2.1 Information you give us

• Account details. Your name, email address and password when you create an account. We store a secure hash of your password, not the password itself. If you turn on two-factor authentication, we store the settings needed for it.
• Profile and billing details. The country of residence you confirm, your phone number and postal address, and your billing name, country and address.
• Formation details. The information needed to prepare your filings, such as the entity type and state, your proposed company names, your business activity, and the ownership and management structure. This includes the names, addresses and roles of the members, managers, organizers, incorporators, directors, officers and other people you list in your order.
• EIN application details. If you ask for EIN assistance, the information the IRS application requires about your company and its responsible party.
• Identity documents. When we need to verify identity, or when a filing or service requires it, we may ask you to upload a copy of a passport or other government-issued identification and related documents.
• Payment details. The payment method you choose and, for bank transfers and UPI, any statement you make that you have sent a payment (for UPI, the UTR) and any proof of payment you choose to upload. For UPI payments, our bank's credit alert also shows us the UPI ID and name of the account that paid, which we keep with your payment record. Card details are entered directly into Stripe's payment form. We do not receive or store full card numbers.
• Support messages. Messages and files you send us through support chat, your account or email, and our replies.
• Contact form submissions. Your name, email address, the topic you choose, an order reference if you include one, and your message.
• Marketing sign-ups. If you give us your email address and actively opt in to marketing emails, we keep your email address, any name you provide, the context of your request, and a record of your consent, including when you gave it and the wording you agreed to.

2.2 Information about other people

If you give us information about co-founders, members, officers or other people, you confirm that you are allowed to share it and that you have told them how it will be used, including that it may be filed with a state agency or the IRS and may become public.

2.3 Information collected automatically

• Technical logs. When you use our website, our systems record technical information such as the pages requested, the time of each request, browser and device details, and error details. Before we store an IP address in our security and activity records, we convert it into a one-way hashed value.
• Security and audit records. We record significant account, order, payment and administrative actions, such as sign-ins, changes to account settings, payment confirmations and refunds, so that we can detect misuse and show who did what.
• Location hint. Our hosting provider may tell us which country a request appears to come from. We use this only to suggest a default country in the formation wizard, and we ask you to confirm it. We do not use GPS or other precise location.
• Formation drafts. The formation wizard saves your answers as you go. If you are not signed in, your draft is linked to a short-lived anonymous cookie in your browser. When you sign in or create an account, the draft moves to your account.
• Cookies. We currently use only strictly necessary cookies. See our cookie policy.

2.4 Information from third parties

• Stripe, which tells us whether a card payment succeeded, failed or was refunded, and about any dispute.
• State agencies and the IRS, which send filing confirmations, filed documents, EIN confirmation letters, notices and rejection reasons.
• Our bank, whose statements show incoming transfers that we match to orders.
• Registered agent and mail services, when legal papers, official correspondence or mail for your company arrive as part of a service you ordered.
• Professionals who provide bookkeeping or tax services you ask for, who may send us updates on their work.

2.5 Live chat, Firmy and chat context

• Chat context. When you start a chat with our team, or when Firmy, our AI assistant, hands your chat to a person, we record details that help our team assist you: your approximate location (country, region and city, as reported by our hosting provider Cloudflare, never your precise location), your device type, operating system and browser, your browser's language and time zone, the page you arrived on, the website that referred you (its address only, without search terms or other query details), campaign (UTM) tags in the link you followed, up to the last 10 pages you viewed on firmlane.us in that browser session, whether your browser has visited before, and a one-way hashed value of your IP address. We never store or show the IP address itself. The pages you view are kept only in your browser until you start a chat.
• Returning visitor cookie. We set a first-party cookie (fl_rv) that records the date of your first visit, so our team can tell new and returning visitors apart. It contains no identifier and is not shared with anyone.
• Contact details in the chat. If you give us your email address and, if you choose, your phone number in the chat, we use them to reply to your chat and follow up on your request, and we keep them with the conversation. We send marketing emails only if you tick the separate box and then confirm your subscription from the email we send you.
• Typing and live visitors. While a chat is open, our team can see that you are typing (never what you type). While the chat widget is open, or if you have a recent conversation, our team can see the page you are on and how long you have been on the site. This live information is not stored.
• Files and ratings. Files you send in the chat (PDF, PNG, JPEG or WebP, up to 10 MB each) are stored privately and opened only through short-lived links. If you rate a chat, we keep your rating and comment with the conversation. Transcripts you ask for are emailed to the address you gave us and list attachments by name only.
• Retention. Chat context, contact details and ratings are kept with the conversation for as long as we keep the conversation (see section 7).

3. How we use information

• To provide our services, including creating and managing your account, preparing and submitting filings, assisting with EIN applications, providing registered agent, business address, compliance and other services you order, and coordinating with professionals you ask us to involve.
• To process payments, including matching bank transfers and UPI payments to orders, issuing refunds, handling disputes and keeping accounting records.
• To communicate with you about your account and orders, including status updates, requests for information, payment confirmations, renewal reminders, compliance reminders and support replies.
• To verify identity, keep our services secure and prevent misuse, including fraud prevention, abuse and spam protection, and screening that the law requires, such as sanctions screening.
• To meet legal obligations, such as tax, accounting and record-keeping duties, and responding to lawful requests.
• To send marketing emails, only if you opted in. You can unsubscribe at any time.
• To improve our services, for example by reviewing support topics, order volumes and processing times. We do not use advertising or analytics cookies for this.

We do not sell your personal information, and we do not share it for targeted advertising.

Our staff review orders, payment confirmations and refunds. Some checks are automated, for example whether a proposed name meets a state's format rules or whether a payment method is available in your country. If you think an automated check has affected you unfairly, contact us and a member of our team will review it.

4. Legal bases for processing

If you are in the European Economic Area, the United Kingdom or another region with similar laws, we rely on these legal bases:

• Contract: to provide the services you request and to manage your account and orders.
• Legal obligation: to keep financial records, respond to lawful requests and meet screening and other legal duties.
• Legitimate interests: to keep our services secure, prevent fraud and abuse, keep audit records, improve our services and defend legal claims. We balance these interests against your rights.
• Consent: for marketing emails, and for any non-essential cookies we may introduce in future. You can withdraw consent at any time. Withdrawing does not affect processing that happened before.

5. How we share information

We share personal information only as needed for the purposes in this policy:

• State agencies and the IRS, to submit your filings and, if you ask for EIN assistance, your EIN application. Information in a state filing, such as the company name, the registered agent and, in some states, the names and addresses of organizers, managers, directors or officers, may become part of the public record. Once a state has made information public, we cannot remove it.
• Payment processors, such as Stripe for card payments, and the banks and payment networks that carry bank transfers and UPI payments.
• Email delivery providers, which send account and order emails and, if you opted in, marketing emails for us.
• Hosting, database and file storage providers, which store and process data on our behalf.
• Registered agent and mail-handling providers, where a service you order is delivered at a physical in-state address.
• Professionals, such as bookkeepers and tax preparers, when you ask us to arrange bookkeeping or tax services.
• Courts, regulators and law enforcement, when the law requires it, or when it is needed to protect the rights, property or safety of our customers, our team or others.
• A buyer or successor, if Firmlane's business is sold, merged or reorganized. This policy would continue to apply to your information.
• Anyone else you ask us to share with.

Our service providers may use personal information only to provide services to us, and they must protect it.

6. International transfers

Firmlane serves founders worldwide and forms companies in the United States, so your information is processed in the United States and in other countries where our service providers operate. Data protection laws there may differ from the laws where you live. Where the law requires it, we use appropriate safeguards for these transfers, such as standard contractual clauses.

7. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy or as the law requires.

• Account and order records are kept while your account is open, and afterward for as long as needed to complete services, resolve disputes and meet legal duties.
• Financial records, such as payments, refunds and accounting entries, are kept for the period that tax and accounting laws require, even if you close your account.
• Identity documents are kept only as long as needed for the verification or filing they were collected for, and then deleted.
• Support messages and contact form submissions are kept for as long as needed to help you and to keep a record of our communication.
• Technical and security logs are kept for a limited period for security and troubleshooting.
• Marketing records are kept until you unsubscribe. After that, we keep a minimal record of your opt-out so that we do not email you again.

We keep personal information only for as long as we need it for the purposes in this policy. Order, payment and company records are kept for as long as tax, accounting and corporate record-keeping laws require, usually up to 7 years after the order. When you ask us to delete your account, we delete or anonymize your personal information, except records we must keep by law.

8. How we protect information

• Encryption in transit (HTTPS) for traffic to and from our website.
• Private storage for documents you upload and documents we deliver to you. Files are not publicly accessible, are opened through short-lived links, and access to them is logged.
• Access controls, so that team members can see only the information their role requires.
• Audit logs of significant account, payment and administrative actions.
• Optional two-factor authentication for your account, and the ability to review and sign out of your active sessions.
• IP addresses stored as one-way hashes in our security and activity records.

No system is perfectly secure. If a security incident affects your personal information, we will notify you and the relevant authorities as the law requires.

9. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct information that is inaccurate;
• ask us to delete your personal information;
• receive a copy of your information in a portable format;
• object to or restrict some processing;
• withdraw consent at any time, where we rely on consent; and
• complain to the data protection authority where you live.

You can update most account and profile details in your account settings. For any other request, use the options in your account settings or email [email protected] (opens in a new tab). We may need to verify your identity before we act on a request, and we will respond within the time the law requires.

Account deletion. You can ask us to delete your account from your account settings or by contacting support. When we complete the request, we anonymize your personal information but keep the records the law requires us to keep, such as financial records. Deleting your account does not remove information already filed with a state agency or the IRS, and we cannot delete records those agencies hold. If you have active services, such as registered agent service, we will explain what needs to happen to them first.

US state privacy rights. Residents of some US states have additional privacy rights. We do not sell personal information or share it for targeted advertising, and we will not treat you differently for exercising your rights.

10. Emails

We send service emails, such as order updates, requests for information, payment confirmations, renewal reminders and important account notices, because they are part of the service you use. You can manage some reminders, such as compliance reminders, in your account settings.

We send marketing emails only if you have opted in. Every marketing email includes an unsubscribe link, and you can also turn marketing emails off in your account settings.

11. Children

Firmlane is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date at the top of this page and, for significant changes, tell you by email or in your account before they take effect.

13. Contact us

For questions or requests about your personal information, email [email protected] (opens in a new tab) or use our contact page.

Operator: Firmlane, 47 W 13th St, New York, NY 10011