Legal
Privacy Policy
Effective October 7, 2026
In short: we collect what we need to run your account and prepare your documents. We don't sell your information, we don't use advertising or analytics trackers, and we never ask for taxpayer data.
Who we are
ShieldSheet is operated by Comblektra LLC, a Florida limited liability company ("ShieldSheet", "we", "us"). ShieldSheet prepares written information security plans and answers security questionnaires for small businesses and the IT providers who serve them. This policy covers shieldsheet.com, app.shieldsheet.com, and email you exchange with us. Questions: support@shieldsheet.com.
What we collect
- Account details: your name, email address, firm name, and a hashed version of your password (we never see or store the password itself).
- Billing details: Stripe processes payments. We receive your name, email, billing address, and the status of your purchases. Your full card or bank account number goes to Stripe, not to us.
- Content you give us: intake answers about how your office works, documents you upload (such as security questionnaires and policies), and the drafts and plans we prepare from them.
- Activity records: an audit log of actions in your account (for example, who exported a document and when), session records that keep you signed in, and short-lived server logs that include IP addresses and browser details.
Please don't send us taxpayer data such as Social Security numbers, returns, or client bank details. The intake never asks for it, and the service doesn't need it.
How we use it
- To create and secure your account, and to sign you in.
- To prepare your plans, draft questionnaire answers, and deliver them to you.
- To process payments, send receipts, and tell you about failed payments, renewals, and cancellations.
- To answer your questions and provide support.
- To keep the service secure, prevent abuse, and meet legal obligations.
We don't sell or rent personal information, and we don't share it for advertising.
Service providers
We use a small number of providers to run ShieldSheet. Each receives only what it needs for its job.
| Provider | What it does |
|---|---|
| DigitalOcean | Hosts our servers and database in the United States. |
| Stripe | Processes payments and runs the billing portal. |
| Anthropic | Provides the AI model that drafts text from the content you give us. Under its commercial terms, Anthropic doesn't use this content to train its models. |
| Resend | Sends account emails such as password links and receipts. |
| Google Workspace | Handles email you send to hello@shieldsheet.com and support@shieldsheet.com. |
| Google Fonts | Serves the typefaces on shieldsheet.com. Your browser requests them from Google, which receives your IP address. |
We may also disclose information if the law requires it, to protect our rights or the safety of others, or as part of a sale or reorganization of the business, in which case this policy continues to apply.
Cookies
The app uses one essential cookie to keep you signed in. Stripe sets its own cookies on its checkout and billing pages. We don't use analytics, advertising, or tracking cookies.
How long we keep it
We keep account data and content while your account is open. After you ask us to close your account, we delete it within 30 days. Copies in our encrypted backups expire within a further 30 days. We keep billing records as long as tax and accounting law requires. Server logs rotate automatically and are kept for a few weeks at most.
Security
Connections use HTTPS. Passwords are stored as one-way hashes. Each firm's data is kept separate from every other firm's, and access to production systems is limited to the people who run the service. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.
Your choices and rights
You can ask us to access, correct, export, or delete your personal information by writing to support@shieldsheet.com from the email address on your account. You can download your plans and documents at any time, including after a subscription ends. Depending on where you live, you may have additional rights under state privacy law; we honor those requests and won't treat you differently for making one.
Children
ShieldSheet is a business service and is not directed to anyone under 18. We don't knowingly collect information from children.
Changes
If we change this policy, we'll update the date at the top. If a change is significant, we'll also email account owners before it takes effect.