Privacy Notice: Your Data and Choices

How SettleBetween collects, uses and protects information when you browse, prepare a case, receive an invitation, take part in a discussion or join our referral program.

Contact SettleBetween

SettleBetween is operated by Hawkfish AS, with its legal address at Sondre Borgen 20, 1388 Asker, Norway. Hawkfish AS is the data controller responsible for the processing described in this notice. References to we, us and our mean Hawkfish AS.

For privacy requests, questions about these terms, billing help or a complaint, contact the SettleBetween team. Include a case reference if you have one, but do not email passwords, full card details or unnecessary evidence.

Hawkfish ASjonas.borchgrevink@settlebetween.comSondre Borgen 20, 1388 Asker, Norway

Information we collect and where it comes from

You provide account and contact details, your location, any business you represent, and information about your disagreement. Case information can include drafts, adviser messages, priorities, documents, statements, proposals, approvals, signatures and completion updates. Optional preparation notes can be edited or cleared while the case is open.

Another participant may provide your name, email or mailing address to invite you, or include information about you in a statement or document. Receiving an invitation does not mean you have agreed to participate. Contact us if you believe your information has been used improperly.

We receive payment and refund status from Stripe, signing records from DocuSeal, and delivery or failure information from our email and postal providers. Our hosting and authentication services process technical information such as IP addresses, browser information, access times and security events. We also record case activity and AI usage, including model, request and token counts.

An account and the information needed to check access are necessary to use a private workspace. Payment, signing and postal delivery require the information needed for those features. You choose whether to add optional notes, documents or a postal invitation. Without required information, we cannot provide the relevant feature.

What stays private and what becomes shared

Your private adviser conversation, unsubmitted preparation, saved priorities and unshared documents are not available to the other participant or the shared AI mediator. Your private adviser can use your own preparation and the shared case record.

Accepted participants can access submitted statements, deliberately shared files, proposals, mediation rounds and common agreement records. The shared mediator analyzes the approved shared material. Review and, where needed, redact a separate copy before sharing. Information someone has already read or downloaded cannot be recalled.

Private means restricted within the service. It does not mean that no service provider processes the information, that it is protected by attorney-client privilege, or that a court could never require disclosure. Each participant is responsible for how they use copies they receive.

Why we use information

We use information to provide accounts, check access and eligibility, prepare cases, deliver approved invitations, provide AI assistance, record participant decisions, arrange signatures, take agreed fees and respond to support requests. We also use relevant records to prevent misuse, investigate errors, reconcile payments and maintain the service.

Where European or UK data protection law applies, the bases for this processing depend on its purpose:

Providing the service you request and administering your payments or partner account: performance of our contract with you.
Inviting a non-user at a participant’s request, maintaining reliable shared records, protecting accounts, handling complaints and administering referrals: legitimate interests in operating a secure, voluntary resolution service, balanced against the affected person’s rights.
Keeping records required for tax, accounting or responding to a valid legal requirement: compliance with the applicable legal obligation.
A use for which we specifically ask permission: consent. You can withdraw that permission for future processing without affecting earlier lawful processing.

Sensitive information and other people’s data

Include only information necessary to explain an eligible disagreement. Do not upload passwords, full payment-card details, unrelated identity documents or unnecessary information about children, health, religion, sexuality or criminal allegations. Redact irrelevant personal details before sharing a document.

Where special-category information is necessary for establishing, exercising or defending legal claims, that legal-claims condition may apply in addition to a lawful basis. A general agreement to these terms is not explicit consent to every use of sensitive data. Contact us before submitting material that requires a different legal condition or special handling.

How AI processes case information

OpenAI processes the information supplied for the AI feature you use. A private adviser or document preparation request may include your messages, preparation, relevant documents or extracted text, and shared case information. A shared mediation request includes the approved shared record, without either participant’s private adviser conversation.

Our case AI requests disable storage of the response in the API request. This does not mean zero provider retention: provider security, abuse-monitoring and other applicable retention rules still apply. SettleBetween does not publish case material as a dataset or use it for unrelated model training.

AI suggests questions, summaries and possible terms. It does not make a binding decision about your dispute or decide whether you must settle. Participants review the information and choose whether to approve or sign. Contact us if an automated access or safety check appears to have blocked you incorrectly.

Service providers and other recipients

We send providers the information needed for the feature they supply. Providers may also process certain information for their own legal, security or payment obligations under their notices.

Google Firebase and Google Cloud: account authentication, case records, file storage and malware scanning. Uploaded files are checked by our private scanning service before sharing or document analysis.
Vercel: website and application hosting, request handling, operational logs and BotID protection against automated requests.
OpenAI: the AI processing described above, and research of public business sources for potential referral partners.
Stripe: checkout, payment authorization, charges, refunds and partner payouts. Payment-card details are entered through Stripe. Our application stores payment references and status, not full card numbers.
DocuSeal: the approved agreement, signer names and email addresses, signature events, signed documents and the signing audit record. Private adviser chats and unshared evidence are not sent for signing.
Twilio SendGrid: approved email invitations, service notifications and referral emails, including recipient addresses, email content and delivery status. Our email integration disables open and click tracking.
PostGrid and postal carriers: address validation, printing and mailing when a sender orders a physical invitation. The sender’s return address appears on the letter and envelope. Private adviser chats and unshared evidence are not included.

Support access, security and legal disclosure

We use authenticated access, participant permissions and private file storage to restrict case information. Operational administrators can see payment, delivery, support and job status, plus AI usage and estimated costs. The operational dashboard does not display private adviser chats. Authorized technical personnel may need access to relevant records to investigate a specific problem, maintain security or meet a legal obligation.

No online service can promise absolute security. Keep your sign-in details and invitation links secure, and tell us promptly about suspected unauthorized access.

We may disclose relevant information to professional advisers, competent authorities or another recipient when required by law or necessary to address fraud, protect safety or establish or defend legal rights. Any business transfer involving personal information must remain subject to applicable data protection requirements.

Where information is processed

Our case database and evidence storage are located in the United States. Hosting, AI, signing, payment and delivery providers may process information in the United States and other countries where they or their subprocessors operate. Choosing a country for pricing or eligibility does not keep your data in that country.

Cross-border transfers must meet the requirements that apply to the information concerned. Provider data protection terms describe their transfer arrangements, which may include approved contractual safeguards or an applicable adequacy framework. Contact us to ask which arrangements apply to your information and to request a copy of relevant safeguards. We do not treat your use of the website as a waiver of transfer protections.

How long information is kept

Case access duration and data retention are different. A workspace reaching its included duration does not automatically erase its records. Deletion requests are reviewed by a person; submitting a request does not immediately delete the account or case.

We assess retention by record type: whether the account or case is still active, whether a participant needs an accurate shared or signed record, whether a payment, delivery, complaint or legal claim remains unresolved, and whether a legal recordkeeping requirement applies. Private preparation that is no longer needed is considered separately from a signed agreement or another participant’s records.

Payment, refund, signature and audit records may need to remain after account closure for applicable accounting, fraud prevention or legal-claims purposes. We keep limited suppression information where needed to honor an email opt-out. We delete or anonymize a record when it is no longer needed for its purpose or a legal requirement. Provider backups and security logs follow their own applicable retention cycles.

Ask us about a particular record or deletion request and we will explain what can be removed, what needs to remain, and the reason. Keep your own copies of important signed documents; the service is not a permanent archive.

Cookies, browser storage and tracking

Firebase authentication uses browser storage to maintain sign-in. A pricing preference cookie, sb_pricing_country, remembers a country you select for up to one year. Opening a valid partner referral link sets sb_referral for up to 30 days so a subsequently created case can be attributed to that partner. Local development accounts use a one-day sb_session cookie; that development cookie is not the production sign-in method.

You can clear or block cookies and site storage using your browser settings. Doing so may sign you out or remove pricing preferences and future referral attribution. Clearing the cookie does not remove attribution already recorded for a case.

BotID uses browser and request signals to distinguish people from automated requests before AI features run. These signals are processed by Vercel for security and abuse prevention.

Our website does not currently load advertising pixels or cross-site audience analytics. We do not sell personal information or share it for cross-context behavioral advertising. We do not change the service in response to a Do Not Track header; the same practices apply with or without that signal. Payment and signing provider pages may use their own storage and security technologies as described in their notices.

Referral partners and business outreach

Partner applications include contact details, a name, business website, country and acceptance of the partner terms. Stripe may collect identity, bank and tax information for payouts. We record referral attribution, payment eligibility and commission status. A partner’s dashboard shows reward status, not participant names, private messages, evidence or agreement terms.

We may research publicly listed US business contact information for relevant partnership invitations. Records can include a business name, role-based email address, website, source page and reason the partnership may be relevant. AI may help find and assess those public sources. An administrator reviews outreach before sending. Partnership emails identify their purpose and include an opt-out link; the program does not send automated follow-ups.

You can unsubscribe using that link or contact us to object to business marketing. We retain enough information to avoid contacting you again. Case notifications and invitations are separate from marketing and depend on your participation and invitation choices.

Your choices and privacy rights

Use the workspace to export your own private and shared case records, download available documents, or request deletion. The case export is not a complete export of every operational, postal or partner record we hold. Contact us for a broader request, to correct account information, or if you do not have an account.

Depending on the law that applies, you may request access, correction, deletion, a portable copy or a restriction on processing. You may also withdraw consent where consent is the basis for a particular use. These rights have limits, including the rights of other people and valid legal recordkeeping requirements. We may ask for proportionate identity or authority verification before releasing or changing information.

We will respond within the deadline required by applicable law and explain any refusal or permitted extension. Where available, you can use an authorized agent or appeal a decision by contacting us. You will not be penalized for exercising a privacy right.

Object to processing or make a complaint

You can object to processing based on legitimate interests for reasons related to your circumstances. You can object to direct marketing at any time. Contact us using the details on this page and state which use you want us to stop.

You can raise a concern with us or complain to the privacy regulator where you live, work or believe a violation occurred. UK residents can contact the ICO; EEA residents can contact their national data protection authority. These options do not require you to complain to us first.

Children and changes to this notice

The service is intended for adults aged 18 or older. It is not directed to children. Contact us if a child has supplied personal information so we can assess and address it.

We update this page when our practices change and show the revision date above. For a material change affecting existing users, we will provide an appropriate additional notice, such as an account notice or email, and obtain consent where required. This notice explains processing; it is not a request to consent to every use of data.