# SingleFax Privacy Policy

Last updated: October 16, 2026. HTML: https://singlefax.com/privacy-policy

This policy explains how SingleFax collects, uses, and protects personal information for people in the United States (including California) and in the European Economic Area and the United Kingdom.

## Who we are

SingleFax is operated by **Monocube LLC**, 30 N Gould St Ste R, Sheridan, WY 82801, USA. Privacy contact: info@singlefax.com.

For GDPR and UK GDPR, Monocube LLC is the controller of personal information processed to provide SingleFax, unless we process data only on written instructions from a customer in a specific written agreement (for example, HIPAA Secure Mode under a Business Associate Agreement).

## What we collect and why

We collect what we need to send and receive faxes, take payment, keep your account secure, and support you.

- **Account and contact:** name, email, phone you give us, organization details you volunteer, and sign-in identifiers (including profile data from Google or Apple if you use those providers).
- **Fax metadata and documents:** destination and source numbers, page counts, timestamps, delivery status, and files you upload or receive so we can convert, transmit, and show them in your dashboard. Individuals may send their own records using standard send. Covered providers and business associates must use HIPAA Secure for patient information.
- **Payment:** processed by Stripe. We receive payment status and billing identifiers for receipts, refunds, and fraud checks. We do not store full card numbers.
- **Technical, device, and IP:** IP address, browser or app type, device information, approximate location from IP, pages viewed, referring URLs, and similar logs.
- **Support:** messages and attachments you send so we can answer you.
- **Marketing email engagement:** whether a product-update or marketing email was opened (small tracking image), which links were clicked (links routed through singlefax.com), plus unsubscribe and bounce records.

## How we use your information

- Deliver sent and received faxes, convert files, and show status
- Process payments, issue receipts, handle refunds, and prevent fraud
- Authenticate accounts, API keys, OAuth sessions, and MCP connections
- Send transactional mail (queued, delivered, or failed notices, inbound PDFs where that path applies, support replies)
- Send product-update or marketing email where we have a lawful basis, with an open pixel and click redirects. Unsubscribe anytime via the email link or info@singlefax.com. Unsubscribing does not stop transactional receipts.
- Analyze product usage so we can fix errors and improve SingleFax
- Meet legal, tax, accounting, and security obligations

## When we access or disclose your information

We access personal information to operate SingleFax, to support you, and to keep the service secure. We share it with the service providers listed below, with affiliated entities that help operate the service, with professional advisers under confidentiality, or when the law requires it.

**We do not sell personal information.** We do not share personal information for cross-context behavioral advertising as those terms are used in California law.

We also use telecommunications and conversion vendors as needed to transmit a fax. Those vendors receive destination numbers and document media required to complete the transmission. We do not list carrier names here.

## Service providers

| Provider | Role |
| --- | --- |
| Stripe | Payments, checkout, and related fraud checks |
| Cloudflare | CDN, security (including bot management), and email delivery for transactional and product-update mail |
| Google Workspace | Business email and support correspondence |
| Amazon Web Services (AWS) | United States application and database hosting |
| Hetzner | European Union application hosting |
| Rybbit | Product analytics |
| PostHog | Product analytics and error-style monitoring |
| Plaid | Optional bank account connection for the Form 5472 service, with your consent |

## Bank data via Plaid

If you use our Form 5472 filing service, you can choose to connect a business bank account through Plaid (Transactions product), with your consent. You can upload bank statements instead if you prefer. When you connect through Plaid, Plaid's own privacy policy also applies: https://plaid.com/legal/#end-user-privacy-policy

We read one tax year of transactions only to suggest reportable related-party transactions, which you review and confirm. We do not move money, make credit decisions, sell bank data, or use it for advertising.

Plaid access tokens are encrypted and kept only while your bank is connected. We revoke them through Plaid (/item/remove) and delete them when you disconnect, when you ask us to, when you close your account, or after 90 days without use.

Transactions and statements are deleted 90 days after your filing is delivered, unless you choose to keep them as records (for up to 7 years).

You can disconnect your bank or request deletion at any time. Email info@singlefax.com. We complete deletion requests within 30 days.

## Cookies and analytics

Essential cookies keep you signed in and protect the site (including Cloudflare security cookies). Blocking those can break sign-in.

**Rybbit** records product analytics (page views and product events, loaded from our own site). **PostHog** records product analytics, feature flags, and client error reports. PostHog may record page views, selected clicks, and technical exceptions. We configure it so form fields that can contain email addresses or fax numbers are not captured as typed values.

Product-update and marketing emails may include a small open-tracking image and click redirects. We do not currently show a separate cookie-consent banner.

## International transfers

Monocube LLC is established in the United States. Personal information may be processed in the United States and in the European Union. US application and database hosting runs on Amazon Web Services. EU application hosting runs on Hetzner. Some processors above may also process data in other countries where they operate.

When we transfer personal information from the EEA or the United Kingdom to the United States or another country that may not be treated as providing an equivalent level of protection, we rely on appropriate safeguards. Those typically include the European Commission Standard Contractual Clauses, and the UK International Data Transfer Addendum where UK law requires it, together with contractual and technical measures with our providers. We do not claim a specific adequacy certification in this policy.

## GDPR and UK GDPR

Legal bases:

- **Contract:** sending and receiving faxes, accounts, API and OAuth or MCP access, payments, and receipts.
- **Legitimate interests:** security, fraud prevention, debugging, product analytics (Rybbit and PostHog), and improving SingleFax. You can object.
- **Consent:** where the law requires it, for example some marketing email. You can withdraw consent at any time.
- **Legal obligation:** tax and accounting records, and lawful requests from authorities.

You may request access, correction, deletion, restriction, or portability, and you may object to processing based on legitimate interests. Email info@singlefax.com. We may need to verify your identity. We will respond within the time required by applicable law.

You can complain to a supervisory authority (the ICO in the United Kingdom, or your local data protection authority in the EEA). We hope you will write to us first.

## California notice at collection (CCPA/CPRA)

| Category | Examples | Sold / shared? |
| --- | --- | --- |
| Contact | Name, phone, email | No |
| Fax documents and metadata | Files, numbers, page counts, delivery status | No |
| Payment | Processed by Stripe; we do not store full card numbers | No |
| Service interaction | Support, surveys | No |
| Technical | Device, IP, usage, login, analytics events | No |
| Marketing engagement | Email opens, link clicks, unsubscribes | No |
| Optional | Profile details you volunteer | No |

Purposes: provide the service, communicate, analyze and improve, legal compliance, security and fraud prevention. Third-party disclosure: affiliated entities, service providers listed above, and legal purposes. See **What we collect and why** and **When we access or disclose your information**.

We do not sell or share personal information as defined by the CCPA, and we have not done so over the past 12 months from the effective date of this policy. If that changes, we will update this policy and provide a way to opt out.

We do not use or disclose sensitive personal information other than for business purposes for which you cannot opt out under the CCPA. If we ever offer financial incentives in exchange for personal information, we will explain them at that time.

## Your rights with respect to your information

Depending on where you live, you may have the right to know/access, delete, correct, opt out of sale or sharing (nothing to opt out of today, because we do not sell or share), limit use of sensitive personal information, and not be discriminated against for exercising a privacy right.

Email info@singlefax.com from the address on your account when you have one. We may need to verify your identity. An authorized agent may submit a request with signed permission or a power of attorney; we may still confirm the request with you. We will respond within the time required by applicable law.

## Shine the Light

We do not disclose your personal information to third parties for their own direct marketing purposes.

## Retention of your information

We keep personal information only as long as we need it to provide SingleFax, to meet legal or tax duties, or to resolve disputes. When we no longer need it, we delete it or anonymize it. Exact day counts vary by record type and are not all listed here.

- **Fax documents (standard service):** stored to complete delivery and so you can retrieve them. You can delete faxes. We also delete or anonymize when an account is closed and we no longer need the files.
- **Failed document processing:** if an uploaded document cannot be processed, we may retain a private copy for up to 30 days to investigate the failure. Access is restricted to authorized administrators and downloads are audited. The copy is then automatically deleted. This diagnostic retention also applies to failed uploads for HIPAA Secure and Enhanced Privacy.
- **Free 24-hour fax numbers:** recycled after a quiet recovery window (about three days after the 24-hour period ends). A later customer can receive a leftover fax. Do not use that SKU for PHI. See https://singlefax.com/free-fax-number.md
- **Marketing unsubscribes and hard bounces:** retained so we honor opt-outs.
- **Account data:** deleted or anonymized within 30 days after an account is closed, except records we must keep by law.
- **Payment records:** kept for 7 years for tax and accounting, then deleted or anonymized.
- **Bank data (Form 5472 service):** Plaid access tokens are deleted on disconnect, on request, at account closure, or after 90 days unused. Transactions and statements are deleted 90 days after the filing is delivered, unless you choose to keep them as records (up to 7 years).
- **HIPAA Secure and personal Enhanced Privacy:** document media is purged on a short operational window. BAA and required compliance records are kept for about six years. Details: https://singlefax.com/hipaa-compliance

## HIPAA and personal privacy

Individuals sending their own health records, or acting as an authorized personal representative, may use standard send without a HIPAA BAA. Enhanced Privacy is an optional paid upgrade: $6.50 for 1–10 billable pages or $10 for 11–100, plus any destination adjustment shown in the quote. It uses shorter document retention, privacy-safe notifications, and securely stored transmission receipts. A personal upgrade does not execute a BAA, make you a HIPAA covered entity, or bind the receiving clinic.

If you send patient information on behalf of a HIPAA covered provider or business associate, including as a sole proprietor, you must choose HIPAA Secure and have an authorized signer accept the BAA before uploading. The role you act in determines this requirement, not your account label or an automated document classification. Personal Enhanced Privacy does not substitute for the healthcare BAA.

For standard website uploads, we may extract text and use automated classification to show an advisory reminder that a document may contain health information. The check can miss or misclassify documents. It does not determine your legal role, automatically enable a premium option, change your price, or certify compliance. The hint stores a classification result rather than a retained OCR transcript. Secure sends skip this advisory classification. Any processing completed before you choose an upgrade remains subject to the policy that applied at that time; a later BAA does not retroactively cover earlier processing.

Neither option promises end-to-end encrypted fax transmission, delivery to the intended person, or control of the recipient’s handling of the fax. Verify the destination and your authority to send the document. Standard uploads also have transport and storage safeguards; the upgrade is not a claim that standard sending is unencrypted.


Standard SingleFax is not HIPAA mode. We are not "HIPAA certified." Covered Entities and Business Associates that need to transmit protected health information should use HIPAA Secure Mode on the website with an electronic BAA.

Do not use free or recycled fax numbers for PHI. Do not send PHI on MCP, MPP, or the public API.

- HIPAA compliance: https://singlefax.com/hipaa-compliance
- HIPAA fax: https://singlefax.com/hipaa-fax

This privacy policy is not a Notice of Privacy Practices and is not a BAA.

## Children

SingleFax is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, email info@singlefax.com and we will delete it.

## Security

We use encryption in transit (TLS) between your browser or client and our services, and we limit staff access to what is needed to operate and support SingleFax. No method of transmission or storage is completely secure.

## Changes

We may update this policy from time to time. When we do, we change the Last updated date at the top. If a change is material, we will take additional steps we think are reasonable, such as a notice to account holders.

## Contact

info@singlefax.com  
Monocube LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA