Corral
The short version: we collect only what we need to run Corral, we use it only to run Corral, and we never sell your data.
Who we are
Corral (“Corral,” “we,” “us”) is a service at corraldocs.com that helps professionals collect documents from the people they work with. Corral is a product of AdPass LLC, a Florida limited liability company, 7901 4th St N, Ste 300, St. Petersburg, FL 33702. Questions about this policy go to hello@corraldocs.com.
This policy covers two groups of people:
- Users: professionals who make a Corral account and send document requests, such as real estate agents, property managers, loan officers, and tax preparers.
- Clients: people who receive a request from a user and upload documents. Clients don't make an account.
What we collect
- Account details from users: name, email address, mobile number, company name, and plan.
- Payment details: handled by our payment processor. We don't store full card numbers.
- Client contact details: the name and email address a user enters when sending a request, and the mobile number a client gives us if they choose to get texts.
- Documents: the files clients upload, and the checklist they belong to.
- Messages: records of the emails and texts we send for a request, and replies such as STOP or HELP.
- Technical data: IP address, browser and device type, and activity logs, which we use to keep accounts secure and fix problems.
How we use it
- To run Corral: create requests, store and deliver documents, and show progress.
- To send messages a request needs: the upload link, one-time codes, reminders about missing items, and confirmations.
- To keep accounts and files secure, and to prevent abuse.
- To bill users and provide support.
- To meet legal obligations.
We don't use client documents for anything other than delivering them to the user who asked for them.
We never sell your data
We don't sell or rent personal information, documents, or contact details to anyone.
Mobile numbers and text messages
We use mobile numbers only to send the texts described in our SMS terms, and only to people who opted in themselves, as shown on our text opt-in page.
No mobile information will be sold or shared with third parties for promotional or marketing purposes. We do not sell, rent, or share mobile numbers or text message opt-in data and consent with third parties or affiliates for their marketing or promotional purposes.
Text messaging originator opt-in data and consent will not be shared with any third parties, except the text message provider that delivers our texts (Telnyx) and wireless carriers, and only so they can deliver the texts you asked for.
Who we share it with
- The user who sent the request. Documents and details a client uploads go to the user who asked for them.
- Service providers that run parts of Corral for us, under contracts that limit their use of the data: hosting, storage, and bot protection (Cloudflare), email delivery (Resend), text delivery (Telnyx), payment processing (Stripe), and error reports (Sentry), which we strip of names, email addresses, phone numbers, and file names before they're sent.
- When the law requires it, such as a valid subpoena or court order.
- If Corral is sold or merged, the new owner must keep following this policy for the data it receives.
None of this sharing includes mobile numbers or text message opt-in data for anyone's marketing. The section above on mobile numbers always applies.
How long we keep it
- Upload links stop working 30 days after they're sent.
- Uploaded documents are deleted 90 days after the user closes the request, or right away if the user deletes them sooner. A request nobody has touched in 180 days closes on its own, so its documents follow the same schedule.
- The request itself (the checklist, file names, and history) stays in the user's account so they have a record, until they delete their account.
- Records of who signed in and who opened which file are kept for 1 year to keep accounts secure.
- Account details are kept while the account is open. When the user deletes the account, we delete its documents, requests, and client details right away. Backup copies age out within 30 days.
- We keep a few things after an account is deleted, only as long as the law requires or allows: billing records, proof that someone agreed to get texts, and the list of numbers and addresses that asked us to stop messaging them.
How we protect it
Files are encrypted in transit and at rest. Clients reach their checklist only with a one-time code sent to them, and each client sees only their own request. Users can turn on 2-step sign-in with an authenticator app, and an account owner can require it for their whole team. We log sign-ins and every time a user opens or downloads a file. No system is perfectly secure, so if we learn of a breach that affects you, we'll tell you as the law requires.
Cookies
Corral uses only the cookies it needs to keep you signed in. We don't use advertising or tracking cookies, and we don't sell or share data for advertising.
If you reach our site from an ad or a link, your browser remembers where you came from (for example, "Google ad") for up to 30 days, and we save that with your account when you sign up, so we know which ads work. We also count page visits with Cloudflare Web Analytics, which uses no cookies and doesn't identify you.
Our role for client documents
For the documents and details a client sends, Corral works on behalf of the user who asked for them. That user decides what to request and how long to keep it, and is responsible for their own privacy duties, such as the rules for tax preparers and lenders. We use client information only to run Corral for that user.
Your choices
- Users can view and update their account details in Settings, download each request's documents with Download all, delete a request's documents with Delete files now, and delete their whole account in Settings. Or email us to do any of it.
- Clients can ask the user who sent the request to remove their documents, or email us at hello@corraldocs.com.
- Reply STOP to any text to stop texts. Email reminders include a way to stop them too.
Depending on where you live, such as California, you may have extra rights to know, correct, or delete your data. Email us and we'll respond within the time the law requires. We won't treat you differently for asking.
Children
Corral isn't meant for anyone under 18, and we don't knowingly collect data from children.
Changes
If we change this policy, we'll update the date at the top. If a change is significant, we'll email users before it takes effect.