127 Foundry LLC operates Quilli. This explains what we collect, why, and who else touches it. If a section is vague, that is a bug — tell us and we will rewrite it.
Last updated 21 August 2026.
Account details (name, work email, company name), billing details handled by Stripe, and the documents you upload along with any field values you or your recipients enter. We do not read your documents except as needed to operate the service, and we do not use them to train anything.
When someone signs, we record their name and email as you supplied them, the values they entered, their IP address, timestamps, and basic device information. This is the audit trail. It exists to evidence the signing and is attached to the sealed document you receive.
Standard server and delivery logs — request times, error traces, email delivery and open events. We use these to keep the service running and to diagnose failures.
Vercel (application hosting), Supabase (database and authentication), Cloudflare (DNS, CDN and file storage), Stripe (payments), and Resend with Amazon SES (transactional email). Each processes data only to provide its part of the service.
Documents and their audit trails are retained for as long as your account is open, because a sealed record you cannot retrieve is not a record. After an account closes you have 30 days to export, then we delete. Billing records are kept as long as tax and accounting rules require.
You can access, correct, export or delete your account data by asking us at privacy@quilli.io. Deleting a sealed document removes our copy; it does not reach copies already delivered to your counterparties, and we cannot retrieve those.
Quilli holds no third-party privacy or security certification, and cannot sign a HIPAA business associate agreement. Do not send protected health information through it. We are a US company and process data in the United States; we make no GDPR adequacy or eIDAS conformity claim.
Transport is encrypted, files are stored in access-controlled object storage, and signing links are single-purpose tokens. We have not published a penetration test. If you find a vulnerability, write to security@quilli.io and we will respond.
Material changes are posted here with a new date. Questions go to privacy@quilli.io.
This page was drafted against what the product actually does, not from a template — but it has not been reviewed by counsel. Have a lawyer read it before it governs a paying customer.