Privacy Policy

FILE BUTLER™ Data Security and Privacy Policy Effective date: October 7, 2026 Last updated: October 11, 2026 1. Who we are and what this policy covers FileButler is a secure client portal operated by Envisage Companies, LLC ("Envisage," "we," "us"). This policy describes the personal information we collect through the FileButler website at filebutler.io and the FileButler client portal (together, the "Services"), how we use and protect it, and the rights you have over it. We act in two different roles: For account, billing, and usage information about the people who sign up for and use FileButler, Envisage decides how the information is used. This policy governs that information. For Customer Content, meaning the files, folders, messages, forms, and signatures a subscribing organization and its clients place in the portal, the subscribing organization controls the content and Envisage acts only as its service provider. We use Customer Content only to provide the Services to that subscriber and as this policy describes. The Services are operated from the United States and are intended for business use by organizations located in the United States. 2. Personal information we collect, where it comes from, and why In the 12 months before the effective date, we collected the following categories of personal information. Passwords are never stored in readable form and are not a category we collect. Identifiers and contact details. Examples: Name, organization name, email address, telephone number, username. Source: You, or the subscribing organization that invites you. Purpose for collecting it: Create and manage accounts, send service messages, provide support. Billing information. Examples: Billing contact name, email address, billing address, card type, last four digits of the card, payment status. Source: You, through Stripe at checkout. Purpose for collecting it: Process subscription payments, send invoices, resolve payment disputes. Internet and device activity. Examples: Internet protocol address, device and browser type, sign-in activity, access logs, actions taken in the portal. Source: Collected automatically when you use the Services. Purpose for collecting it: Secure the Services, detect unauthorized access, keep audit records, support the subscriber's own compliance. Customer Content. Examples: Files, folder names, messages, forms, and signatures placed in the portal by a subscribing organization or its clients. Depending on what the subscriber uploads, this may include professional, employment, financial, or health information. Source: The subscribing organization and the clients it invites. Purpose for collecting it: Store, organize, deliver, and sign documents as the subscribing organization directs. Cookies and browser storage. Examples: Session identifiers, display preferences, cookie consent choices. Source: Collected automatically when you use the Services. Purpose for collecting it: Keep you signed in, secure your session, remember your settings. We collect personal information directly from you, from the subscribing organization that gives you access, automatically from your device when you use the Services, and from Stripe when you pay. We do not buy personal information from data brokers or other third parties. 3. How we disclose personal information We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the 12 months before the effective date, and we have no actual knowledge of selling or sharing the personal information of anyone under 16 years of age. We disclose personal information only for the business purposes below. Each service provider is bound by a written contract that limits its use of the information to the service it performs for us. Customer Content. Disclosed to: Backblaze, Inc. only (file storage). Business purpose: Store and deliver uploaded files and portal data. Identifiers, contact details, internet and device activity. Disclosed to: Backblaze, Inc. only (storage). Business purpose: Run the Services and keep security records. Billing information. Disclosed to: Stripe, Inc. (payment processing). Business purpose: Process payments and prevent fraud. Identifiers and Customer Content. Disclosed to: The subscribing organization that gave you access. Business purpose: Provide the Services to that organization. Any category, as required. Disclosed to: Professional advisers, law enforcement, courts, and regulators. Business purpose: Comply with law, respond to lawful requests, and protect our legal rights. Any category. Disclosed to: A successor in a merger, acquisition, or sale of the business. Business purpose: Continue the Services under the same commitments. We do not use or disclose sensitive personal information for any purpose other than providing the Services, preventing fraud and security incidents, and complying with the law. We do not disclose personal information to third parties for their own direct marketing purposes. No FileButler request sends Customer Content, tenant data, folder data, document data, or message content to any external artificial intelligence or model provider. 4. Cookies and online tracking The Services use only the cookies and browser storage needed to sign you in, keep your session secure, and store your display and consent preferences. A verification code is required at every sign-in; FileButler does not remember devices to skip it. We do not use advertising or behavioral tracking cookies, and analytics cookies are not active. Do Not Track. FileButler does not track your online activity over time or across other websites. The Services use no advertising or tracking cookies, and optional analytics stays off unless you switch it on in Cookie Settings, as our Cookie Policy explains. Third-party tracking. We do not allow third parties to collect information about your online activity over time and across different websites when you use the Services. During subscription checkout, Stripe may set its own cookies for payment processing, fraud prevention, and security, under Stripe's own privacy policy. You can change your cookie choices at any time through the Cookie Settings link on the website or through your browser settings. Blocking necessary cookies may prevent sign-in or checkout from working. 5. Your privacy rights You have the following rights over the personal information we hold about you, wherever you live. Right to know: request the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for collecting it, and the categories of third parties we disclosed it to. Right to delete: request that we delete personal information we collected from you, subject to the exceptions the law allows, such as information we must keep to complete a transaction, maintain security, or comply with a legal obligation. Right to correct: request that we correct inaccurate personal information. Right to opt out of sale or sharing: we do not sell or share personal information, so there is nothing to opt out of. Because we do not sell or share, an opt-out preference signal sent by your browser does not change how we handle your information. Right to limit use of sensitive personal information: we use sensitive personal information only for the purposes the law permits without a limit request, so this right does not apply. Right to non-discrimination: we will not deny you the Services, charge you a different price, or provide a different level of service because you exercised any of these rights. How to submit a request Email [email protected] with "Privacy Request" in the subject line, or call (954) 408-4253. Account holders can review and update their name, email address, telephone number, and other account details at any time in portal Settings. How we verify your request We verify requests to know, delete, or correct by matching the information you give us against the account records we hold, such as your name, the email address on the account, and the organization you belong to. For a signed-in account holder, we may confirm the request through the email address on the account. We will ask only for the information needed to verify you and will not use it for any other purpose. Authorized agents You may use an authorized agent to submit a request on your behalf. We will ask the agent for written permission signed by you, and we may also ask you to verify your identity directly with us. Response time We acknowledge requests within 5 business days and respond within 45 calendar days. If we need more time, we will tell you why and when to expect a response, up to an additional 45 days as the law allows. Requests about Customer Content If your request concerns Customer Content that a subscribing organization placed in the portal, that organization controls the content and decides how to respond. We will forward your request to the organization within 5 business days and tell you that we have done so. 6. How we protect your information We use security procedures and practices suited to the sensitivity of the information we hold, and we require every service provider that handles it to do the same. Encrypted transmission: all traffic between your browser and the Services is encrypted. Two-factor authentication: a second verification step protects sign-in. Role-based permissions: each person sees only what their role allows. Clients see only their own folders. Staff and administrator functions are checked on the server, not just hidden in the interface. Separation of each subscriber's data: every request is checked for both who you are and whether you may access the specific record requested. Audit logs: sign-ins, document access, uploads, downloads, signatures, and administrative changes are logged. Passwords: never stored in readable form and never visible to Envisage personnel. Signature records: each completed signature produces a certificate of completion that records the signer, method, internet protocol address, timestamp, and a cryptographic hash of the signed document. Storage location: uploaded files and portal data are stored with Backblaze, Inc. only, in the United States. Customer Content is not stored or processed outside the United States. Vendor contracts: each service provider that handles personal information is bound by contract to protect it. Written security program: we maintain written policies and conduct risk assessments of the Services. Protected health information: where a subscribing organization has signed a Business Associate Agreement with Envisage, protected health information in Customer Content is handled under that agreement. Backblaze, Inc. has signed a Business Associate Agreement with Envisage Companies, LLC (parent company to FileButler) covering file storage. 7. How long we keep information Identifiers and contact details. Retention period or criteria: For the life of the account, then as long as needed to resolve disputes and meet legal obligations. Billing information. Retention period or criteria: As long as tax and accounting law requires and as needed to resolve payment disputes and chargebacks. Internet and device activity, audit logs. Retention period or criteria: As long as needed for security, to investigate incidents, and to document account access and usage. Customer Content. Retention period or criteria: Under the control of the subscribing organization. Content stays until the subscriber deletes it; deleted items go to a Recycle Bin the subscriber controls. The FileButler Data Retention Policy and the subscriber's agreement govern what happens when a subscription ends. Cookies and browser storage. Retention period or criteria: Session cookies expire when you sign out or the session ends; preference and consent cookies stay until you clear them. When information is no longer needed for these purposes, we delete it or remove the details that identify a person. 8. Security incidents and breach notification If we discover or are notified of a breach of the security of personal information, we investigate, contain it, and preserve the records needed to determine what happened. If a breach affects personal information: Your account information: we notify you within 30 calendar days of discovering the breach, and we notify government authorities as the law requires. Customer Content: we notify the subscribing organization immediately after discovering the breach, so it can notify its own clients. We give the organization the facts it needs for its notice and, at its written request, send the notice on its behalf. Delay: notice may be delayed only when law enforcement asks us to wait, or for the time needed to find out what was affected and secure the system. Where a Business Associate Agreement applies, we also follow its notice terms. 9. Confidentiality for professional subscribers Attorneys, accountants, tax preparers, and other professionals have a duty to keep their clients' information confidential. When they use FileButler, we commit to the following so they can meet that duty: Confidential handling: we treat all Customer Content as confidential. We do not use or disclose it except to provide the Services, at the subscriber's direction, or when the law requires. No other use: we never use client information, including tax return information, for marketing or for any purpose other than providing the Services. No artificial intelligence providers: Customer Content is never sent to an outside artificial intelligence or model provider. United States only: Customer Content is stored and processed only in the United States. Return of client files: the subscriber can download any client's records at any time, including when a client asks for its file back. Retention under the subscriber's control: we do not delete active Customer Content on our own schedule, so the subscriber can keep records for as long as its professional rules require. Breach notice: we notify the subscriber immediately if a breach affects its Customer Content (section 8). Medical records: a Business Associate Agreement is available on request. 10. Children The Services are for business use and are not directed to anyone under 18 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it. 11. Changes to this policy When we change this policy, we post the revised version on the website with a new effective date and notify account holders with a notice in the portal telling them the policy has been updated. Contact us FileButler Email: [email protected] Envisage Companies, LLC Email: [email protected] Fort Lauderdale, Florida Phone: (954) 408-4253