SingleFax Privacy Policy

SingleFax is operated by Monocube LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA. For privacy questions, write to info@singlefax.com.

For GDPR and UK GDPR, Monocube LLC is the controller of personal information processed to provide SingleFax, unless we process data only on written instructions from a customer in a specific written agreement (for example, HIPAA Secure Mode under a Business Associate Agreement).

We collect what we need to send and receive faxes, take payment, keep your account secure, and support you. The details depend on how you use SingleFax (guest send, signed-in account, fax number, API, or support).

We access personal information to operate SingleFax, to support you, and to keep the service secure. We disclose it only as described in this policy.

We share information with the service providers listed below so they can process it on our behalf. We may also disclose information to our affiliated entities that help operate the service, to professional advisers under confidentiality, or when the law requires it (for example a valid legal process, or to protect people from serious harm).

We do not sell personal information. We do not share personal information for cross-context behavioral advertising as those terms are used in California law.

We use the following processors and service providers. They receive only what they need to perform their work for us.

We also use telecommunications and conversion vendors as needed to transmit a fax. Those vendors receive destination numbers and document media required to complete the transmission. We do not list carrier names here.

If you use our Form 5472 filing service, you can choose to connect a business bank account through Plaid (Transactions product), with your consent. You can upload bank statements instead if you prefer. When you connect through Plaid, Plaid's own privacy policy also applies: Plaid End User Privacy Policy.

We read one tax year of transactions only to suggest reportable related-party transactions, which you review and confirm. We do not move money, make credit decisions, sell bank data, or use it for advertising.

Plaid access tokens are encrypted and kept only while your bank is connected. We revoke them through Plaid (/item/remove) and delete them when you disconnect, when you ask us to, when you close your account, or after 90 days without use.

Transactions and statements are deleted 90 days after your filing is delivered, unless you choose to keep them as records (for up to 7 years).

You can disconnect your bank or request deletion at any time. Email info@singlefax.com. We complete deletion requests within 30 days.

We use cookies and similar technologies that are needed to sign you in, keep a session, and protect the site (including Cloudflare security cookies). Those are essential to operate SingleFax.

We also use Rybbit for product analytics (page views and product events, loaded from our own site) and PostHog for product analytics, feature flags, and client error reports. PostHog may record page views, selected clicks, and technical exceptions. We configure it so form fields that can contain email addresses or fax numbers are not captured as typed values.

We use Crisp for support chat. Its chatbox uses cookies to keep your support conversation available across visits. Crisp receives messages and contact details you provide through the chatbox. When you are signed in, we also share your account email address and SingleFax user ID with Crisp so support can identify your account. We use your email address as your chat display name.

Product-update, marketing, and inbound fax-notice emails may include a small open-tracking image and click redirects, as described above. We do not currently show a separate cookie-consent banner. Browser controls can block some cookies and pixels. Blocking essential cookies can break sign-in.

Monocube LLC is established in the United States. Personal information may be processed in the United States and in the European Union. Application and database hosting for the United States runs on Amazon Web Services. Application hosting in the EU runs on Hetzner. Some processors listed above may also process data in other countries where they operate.

When we transfer personal information from the EEA or the United Kingdom to the United States or another country that may not be treated as providing an equivalent level of protection, we rely on appropriate safeguards. Those typically include the European Commission Standard Contractual Clauses, and the UK International Data Transfer Addendum where UK law requires it, together with the contractual and technical measures we have in place with our providers. We do not claim a specific adequacy certification in this policy.

If you are in the EEA or the United Kingdom, we process personal information under these legal bases.

You have the right to request access, correction, deletion, restriction, or portability of your personal information, and to object to processing that is based on legitimate interests. Where we rely on consent, you may withdraw it. To exercise these rights, email info@singlefax.com. We may need to verify your identity before we act. We will respond within the time required by applicable law.

You also have the right to complain to a supervisory authority. In the United Kingdom that is the Information Commissioner's Office. In the EEA you can contact your local data protection authority. We hope you will write to us first so we can try to help.

For more information about each category of personal information, purpose of use, and third parties to which we disclose personal information, see What we collect and why and When we access or disclose your information on this page.

If we send you a product-update or marketing email, we may include a small tracking image to know whether the message was opened, and route links through singlefax.com to know which links were clicked. You can unsubscribe at any time via the link in the email or by writing to info@singlefax.com. We honor unsubscribe requests for future marketing mail. Transactional receipts (fax queued, delivered, failed) are unchanged.

The CCPA also allows you to limit the use or disclosure of your "sensitive personal information" (as defined in the CCPA) if your sensitive personal information is used for certain purposes. Please note that we do not use or disclose sensitive personal information other than for business purposes for which you cannot opt out under the CCPA.

See Your rights with respect to your information for the additional rights you have under California law and how to exercise them.

Retention of Your Personal Information: See Retention of your information on this page.

Depending on where you live, you may have some or all of the following rights in personal information we hold about you.

• Know / access: ask what personal information we have collected, used, and disclosed.
• Delete: ask us to delete personal information, subject to exceptions (for example completed transmissions, security, or legal records).
• Correct: ask us to correct inaccurate personal information.
• Opt out of sale or sharing: we do not sell or share personal information as defined by the CCPA, so there is nothing to opt out of today.
• Limit use of sensitive personal information: we use sensitive personal information only for the business purposes described in this policy.
• Non-discrimination: we will not deny service or charge a different price because you exercised a privacy right.

To exercise these rights, email info@singlefax.com from the address on your account when you have one. We may need to verify your identity. An authorized agent may submit a request if you provide signed permission or a power of attorney, and we may still need to confirm the request with you. We will respond within the time required by applicable law.

We keep personal information only as long as we need it to provide SingleFax, to meet legal or tax duties, or to resolve disputes. When we no longer need it, we delete it or anonymize it. Exact day counts vary by record type and are not all listed here.

• Fax documents (standard service): stored so we can complete delivery and so you can retrieve them from your dashboard. You can delete faxes. We also delete or anonymize documents when an account is closed and we no longer need them to operate the service or meet a legal duty.
• Failed document processing: if an uploaded document cannot be processed, we may retain a private copy for up to 30 days to investigate the failure. Access is restricted to authorized administrators and downloads are audited. The copy is then automatically deleted. This diagnostic retention also applies to failed uploads for HIPAA Secure and Enhanced Privacy.
• Free 24-hour fax numbers: recycled after a quiet recovery window (about 3 days after the 24-hour period ends). A later customer can receive a fax sent to a number you no longer hold. Do not use that SKU for PHI. See free fax numbers.
• Marketing unsubscribes and hard bounces: retained so we do not email you again after you opt out or after a permanent bounce.
• Account data: deleted or anonymized within 30 days after an account is closed, except records we must keep by law.
• Payment records: kept for 7 years for tax and accounting, then deleted or anonymized.
• Bank data (Form 5472 service): Plaid access tokens are deleted on disconnect, on request, at account closure, or after 90 days unused. Transactions and statements are deleted 90 days after the filing is delivered, unless you choose to keep them as records (up to 7 years).
• HIPAA Secure and personal Enhanced Privacy: document media is purged on a short operational window (normally 24 hours, with active transmission and recovery protected). BAA and required compliance records are kept for about six years. Details live on the HIPAA compliance page, not in this policy.

Individuals sending their own health records, or acting as an authorized personal representative, may use standard send without a HIPAA BAA. Enhanced Privacy is an optional paid upgrade: $6.50 for 1–10 billable pages or $10 for 11–100, plus any destination adjustment shown in the quote. It uses shorter document retention, privacy-safe notifications, and securely stored transmission receipts. A personal upgrade does not execute a BAA, make you a HIPAA covered entity, or bind the receiving clinic.

If you send patient information on behalf of a HIPAA covered provider or business associate, including as a sole proprietor, you must choose HIPAA Secure and have an authorized signer accept the BAA before uploading. The role you act in determines this requirement, not your account label or an automated document classification. Personal Enhanced Privacy does not substitute for the healthcare BAA.

For standard website uploads, we may extract text and use automated classification to show an advisory reminder that a document may contain health information. The check can miss or misclassify documents. It does not determine your legal role, automatically enable a premium option, change your price, or certify compliance. The hint stores a classification result rather than a retained OCR transcript. Secure sends skip this advisory classification. Any processing completed before you choose an upgrade remains subject to the policy that applied at that time; a later BAA does not retroactively cover earlier processing.

Neither option promises end-to-end encrypted fax transmission, delivery to the intended person, or control of the recipient’s handling of the fax. Verify the destination and your authority to send the document. Standard uploads also have transport and storage safeguards; the upgrade is not a claim that standard sending is unencrypted.

Do not use free or recycled fax numbers for PHI. Do not send PHI on MCP, MPP, the public API, or the Chrome extension. For the HIPAA product path and BAA, see HIPAA compliance and HIPAA fax. This privacy policy is not a Notice of Privacy Practices and is not a BAA.

The SingleFax Chrome extension reads only a PDF you choose or a PDF URL from a tab you invoke with the toolbar. It does not persist document bytes in extension storage. It uploads the selected PDF directly to SingleFax pending storage using a short-lived presigned URL. Abandoned pending objects are deleted by the existing one-day lifecycle. After checkout, normal SingleFax processing and retention apply.

Small upload capabilities live briefly in extension session memory and website session storage and are removed on adoption or expiry. The extension itself has no analytics SDK. Safe source, entry, version, and error enums may flow through SingleFax endpoints. Checkout and account sessions happen on singlefax.com. The extension is not Secure Mode and must not be used for PHI.

The extension does not persist bytes locally. SingleFax stores and processes the document under this policy after upload. We do not claim that fax content is never stored.