Privacy Policy

Effective date: July 12, 2026 [PLACEHOLDER — set the actual effective date before publishing]

This Privacy Policy explains how Paragon Government Solutions DBA DebtDefense [ENTITY TYPE TO BE CONFIRMED BY COUNSEL] ("DebtDefense," "we," "us," or "our") collects, uses, and protects information when you use the website at debtdefense.app, our document preparation software, our educational articles, and any related services (together, the "Service").

The short version: we collect what we need to run the Service for you, we use your case information only to prepare your documents and reminders, we do not sell your personal information, and we do not share your case information with debt collectors, creditors, or anyone on the other side of your lawsuit — the only exceptions are the narrow, legally compelled disclosures described in Section 4. The details are below.

1. What We Collect

Account information. When you create an account, we collect your email address and name, and — because court documents require them — your phone number and mailing address if you provide them. Sign-in is passwordless: we email you a secure sign-in link, or you can sign in with your Google account — in which case Google sends us your name and email address. We never see or store a password.

Case information. To prepare documents for you, the Service asks you to enter details about your lawsuit. This can include the names of the parties, the court, case numbers, the amount claimed, relevant dates and deadlines, information about the debt, and your answers to questions the software asks. You may also upload copies of court documents and related papers, such as the lawsuit you were served with, account statements, or a credit card agreement.

Uploaded documents can contain highly sensitive information — Social Security numbers, financial account numbers, home addresses, dates of birth, and detailed financial history. We treat everything in an uploaded document as part of your confidential case information. A practical tip: where a document does not need it, you may black out (redact) your Social Security number or full account numbers before uploading — the Service usually needs only the case details, not those identifiers.

We know this is sensitive information. A lawsuit is a stressful, private matter, and the details of your case — including the fact that you have been sued at all — deserve careful handling. We treat case information as confidential: we use it only to provide the Service to you, as described in Section 2, and we protect it as described in Section 7. We do not use your case information for advertising, and we do not share it with the parties described in Section 4.

Payment information. Payments are processed by Intuit's QuickBooks Payments, a third-party payment processor. When you make a purchase, your card details are sent from your browser directly to Intuit and converted into a one-time token — your full card number never touches our servers, and we never store it. We keep only limited records of the transaction: that it succeeded, the amount, and which package it covered. [ENGINEERING/ATTORNEY: if an additional payment processor is enabled in the future, update this section before it takes payments.]

Usage information. Like most websites, we collect basic information about how the Service is used: pages visited, approximate location (at the city or region level, derived from IP address), browser and device type, and error reports. We use Vercel Analytics, a privacy-conscious, cookie-free analytics service, to understand how people use the Service and where it can be improved. We also keep our own first-party usage measurements — which pages are viewed and which buttons and links are used. For visitors who are not signed in, these measurements are tied only to a random anonymous identifier stored in your browser. When you are signed in to your account, we may associate these measurements with your account so our support team can see where you got stuck and help you — for example, noticing that you started uploading your court papers but didn't finish. These measurements never include your case details or the contents of your documents, and are never shared with any advertising or analytics company. [ATTORNEY: signed-in usage association added 2026-07-20 for support tooling — confirm this disclosure is sufficient.]

Emails and texts you send us. If you contact support, we keep the correspondence so we can help you and keep a record of the conversation. If you reply to a text message from us, we keep the reply (including STOP requests, which the law requires us to honor and record).

2. How We Use Your Information

We use the information described above to:

Provide the Service — create and maintain your account, let you log in, and save your work in progress;
Read your uploaded papers and analyze your case — using the automated processing described in Section 3;
Generate your documents — assemble the court forms and related documents you ask the software to prepare, using the case information you enter and the choices you make;
Send deadline reminders — if reminders are on, we email you (and, if you enable text reminders, text you) as your case dates approach. These reminders are part of the Service, not marketing. You can turn them off at any time in Settings;
Process payments and send receipts — through Intuit, as described above;
Respond to you — answer support requests and account questions;
Improve the product — understand, through usage information, which parts of the Service work well and which are confusing, and fix bugs;
Protect the Service — detect and prevent fraud, abuse, and security incidents;
Meet legal obligations — comply with applicable law and respond to valid legal process, as described in Section 4.

We do not use your case information to build marketing profiles or to make automated decisions about you that have legal effects. The automated document analysis described in Section 3 only assists you — its output is shown to you for your review, and you decide what to do with it.

3. Automated Processing and AI

This section describes something you should understand before uploading documents.

Your uploaded documents are processed by automated systems, including artificial-intelligence models. When you upload your court papers or a credit card agreement, software reads the document and extracts the case details from it (party names, court, amounts, dates) so you don't have to retype them, and flags items the software is programmed to look for. To do this, the document is transmitted to Anthropic, a third-party AI provider, whose Claude models perform the reading, via Anthropic's commercial API.

Your documents are not used to train AI models. We use Anthropic's commercial API, whose terms provide that customer content is not used to train Anthropic's models. We do not train models on your data ourselves, and we will not switch to any AI provider or configuration that trains on user content. [ATTORNEY: confirm the current Anthropic commercial terms citation before publishing.]
Automated reading is not guaranteed to be accurate. The extraction can misread a document, miss information, or flag items that do not apply to your situation. That is why the Service shows you everything it extracted and asks you to confirm or correct it — you are responsible for reviewing it, and nothing is filed or generated without your review and your choices.
What is sent is limited to what you upload plus the case fields needed for the analysis. Payment card data is never sent to an AI provider.

4. What We Do NOT Do

These commitments are the heart of this policy:

We do not sell your personal information. Not your email, not your name, not your case information, not your usage data. We have not sold personal information in the past and we do not sell it now, as "sell" is defined under the California Consumer Privacy Act and the Virginia Consumer Data Protection Act. We also do not share personal information for cross-context behavioral advertising.
We do not share your case information with debt collectors, creditors, debt buyers, their attorneys, or any opposing party. The information you enter about your lawsuit is used to prepare your documents and reminders — nothing else. The other side learns what is in your documents only if and when you choose to file or send them.
We do not disclose that you use the Service to the parties listed above.
We do not use your data to train AI models, as described in Section 3.

There are narrow exceptions where the law can require disclosure: we may disclose information if we are legally compelled to — for example, by a valid subpoena or court order — or where disclosure is necessary to protect the safety of a person, to enforce our Terms of Service, or in connection with a corporate transaction such as a merger or acquisition (in which case this policy would continue to apply to your information until you are notified otherwise). Where the law allows, we will attempt to notify you before disclosing your information in response to legal process. [ATTORNEY TO REVIEW: scope of the legal-process notification commitment.]

5. Service Providers (Subprocessors)

Like nearly every online service, we rely on a small number of companies to run our infrastructure. Each one processes information only to provide its service to us, under contracts that restrict how it can use the data:

Hosting and analytics — Vercel hosts the application, serves the website, and provides cookie-free usage analytics;
Database — Neon hosts our database, where account and case information is stored;
File storage — Vercel Blob stores documents you upload and documents we generate for you;
AI document analysis — Anthropic processes uploaded documents to extract case details, as described in Section 3 (not used for model training);
Payments — Intuit (QuickBooks Payments) processes payments, as described in Section 1;
Email — Resend delivers transactional emails such as sign-in links and deadline reminders;
Text messages — Twilio delivers text messages, if you enable text reminders;
Authentication — if you choose "Sign in with Google," Google processes that sign-in under its own privacy policy.

These providers may store data in the United States. If we add or replace a provider that handles personal information, we will update this policy.

6. Data Retention and Deletion

While your account is active, we keep your account and case information so you can return to your documents — many people work on their case over weeks or months, and deadlines can stretch across a court process.

You can have your account and case data deleted at any time by emailing support@debtdefense.app from the email address on your account with the subject line "Delete my account." [ENGINEERING TODO: add an in-app delete-account control; until it exists, this email mechanism is the deletion mechanism and must be honored promptly.] When your account is deleted:

Your account information and case information, including uploaded documents, are deleted from our active systems within [NUMBER TO BE CONFIRMED — e.g., 30] days;
Copies in encrypted backups are overwritten in the ordinary backup cycle within [NUMBER TO BE CONFIRMED — e.g., 90] days;
We may retain limited records where the law requires or permits it — for example, payment and tax records, and records needed to resolve disputes or enforce our Terms.

If your account is inactive for a long period, we may delete it after emailing you advance notice at the address on file. [RETENTION SCHEDULE TO BE CONFIRMED BY ATTORNEY.]

7. Security

No online service can promise perfect security, and we do not. But we take the sensitivity of case information seriously, and we use safeguards that include:

Encryption in transit — connections to the Service are encrypted using TLS (the standard technology behind the padlock in your browser);
Encryption at rest — data stored in our database and file storage is encrypted by our hosting providers;
Access controls — access to production data is limited to the small number of people who need it to operate the Service;
Passwordless sign-in — there is no password to steal; sign-in uses expiring emailed links or your Google account;
Payment isolation — card numbers are tokenized in your browser by Intuit and never stored on our systems.

If a breach affecting your personal information occurs, we will notify you and the appropriate regulators as required by applicable law.

8. Your Privacy Rights

Everyone can contact us with privacy questions or requests at support@debtdefense.app, regardless of where they live. State laws also give specific rights to residents of certain states.

Virginia residents (VCDPA)

The Virginia Consumer Data Protection Act gives Virginia residents the right to:

Confirm and access — know whether we process your personal data, and get access to it;
Correct — fix inaccuracies in your personal data;
Delete — have personal data you provided, or that we obtained about you, deleted;
Data portability — get a copy of personal data you provided to us in a portable and usable format;
Opt out — opt out of the processing of personal data for targeted advertising, for sale, or for profiling that produces legal or similarly significant effects. As stated in Section 4, we do not sell personal data or use it for targeted advertising or such profiling, so there is nothing to opt out of — but the right exists, and if our practices ever change, we will provide an opt-out mechanism first.

To exercise these rights, email support@debtdefense.app with the subject line "Privacy Request." We will respond within 45 days (extendable once by another 45 days where reasonably necessary, in which case we will tell you). If we decline a request, you may appeal by replying to our decision, and we will respond to the appeal within 60 days. If the appeal is denied, you may contact the Virginia Attorney General to submit a complaint.

California residents (CCPA/CPRA)

The California Consumer Privacy Act, as amended, gives California residents the right to:

Know — request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom it is disclosed;
Delete — request deletion of personal information we collected from you, subject to legal exceptions;
Correct — request correction of inaccurate personal information;
Opt out of sale or sharing — we do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of;
Limit use of sensitive personal information — we use sensitive information (such as case information) only to provide the Service you requested, which is within the uses California law permits without a separate limitation right;
Non-discrimination — we will not deny you the Service, charge you a different price, or provide a different level of service because you exercised any of these rights.

To exercise these rights, email support@debtdefense.app with the subject line "Privacy Request." We will verify your identity — usually by confirming control of the email address on your account — and respond within the time California law requires. You may also designate an authorized agent to make a request on your behalf.

Other states

Other states have enacted similar privacy laws. Residents of those states may have comparable rights of access, correction, deletion, and portability, and can make requests through the same email address. [ATTORNEY TO CONFIRM: whether the company meets the applicability thresholds of the VCDPA, CCPA, and other state privacy laws, and to conform this section to the states where thresholds are actually met.]

9. If We Contacted You Before You Signed Up

Some people first hear from DebtDefense by mail, email, or text after being sued. If that happened to you, here is where your information came from: debt-collection lawsuits are public court records, and we (like the debt buyers who file these cases) can see who has been sued. We obtain contact information associated with the public record from licensed data providers.

If you received such a message and want nothing further:

Every outreach email contains an unsubscribe link, and replying STOP to a text stops texts immediately;
You can also email support@debtdefense.app and ask us to delete your contact information from our outreach records, and we will.

We never use outreach data for anything except telling you the Service exists. It is kept separate from user accounts, and none of the commitments about case information above are affected by it — outreach records contain only what the public record and the data provider supplied, never anything you told us.

10. Children

The Service is not directed to anyone under 18, and our Terms of Service require users to be at least 18 years old. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from someone under 18, we will delete it. A parent or guardian who believes a minor has provided us information can contact us at support@debtdefense.app.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes — especially any change to the commitments in Sections 3 and 4 — we will post the updated policy on this page with a new effective date and notify you by email or by a notice in the Service before the change takes effect. Minor changes, such as clarifications or updated provider names, may be posted with an updated effective date alone.

12. Contact

Questions, concerns, or privacy requests can be sent to:

Email: support@debtdefense.app
Mail: Paragon Government Solutions DBA DebtDefense, 11166 Fairfax Blvd, Fairfax, VA 22030

A closing note on why this policy reads the way it does: DebtDefense exists to help people who have been sued respond to a lawsuit. The information users trust us with — the fact of the lawsuit, the parties, the amounts, the documents — is exactly the kind of information the other side of that lawsuit might want. Keeping it confidential is not a legal formality for us; it is the product working as intended.