Privacy Policy

ApproveThat is a web application that lets teams send documents and other work for sign-off, and lets the people they name approve or reject that work from any device.

This policy applies to two groups of people: account holders (the teams and workspaces who use ApproveThat) and approval recipients (the people a team sends a request to). Approval recipients do not need an account, but we still hold a small amount of data about them in order to deliver the request and record their decision. That is described below.

Account information. When you create an account we store your email address, a password credential, and, if you sign in with Google, the name, email address and profile photo Google shares with us. We store the name you give us so your team and approvers can see who sent a request.

Workspace information. The name of each workspace you create, which people belong to it, and each person’s role (Owner, Admin or Member).

Approval requests. The title you enter, any notes you write, the recipient email address, and the recipient mobile number if you choose to add one for a text message notification. Files you attach are stored so the recipient can preview them.

Approval activity. When a recipient opens a request and clicks Approve or Reject, we record the decision, any note they added, the date and time, the email address they acted as, the device/browser string their browser sent, and their IP address. This is the audit trail our customers rely on to prove a decision was made.

Payment information. If you subscribe to a paid plan, Stripe processes the payment. We store the subscription status, the plan, the billing period dates, and Stripe customer and subscription identifiers. We do not see or store your full card number, expiry date or security code — Stripe handles that directly.

Usage data. Standard server logs such as request timestamps and error information, used to keep the service running and to diagnose problems.

• To deliver approval requests to the email address or mobile number a team supplies, and to let the named recipient view and respond to that one request.
• To produce the audit trail: a timestamped record of who was asked, who opened it, and what they decided.
• To operate your account: authentication, workspace membership, roles, and billing.
• To send transactional messages you or your team have triggered, such as a request notification, a workspace invitation, or a password reset.
• To keep the service secure: detecting abuse, fraud and malicious traffic.
• To comply with legal obligations and to respond to lawful requests.

We do not sell personal data. We do not use customer documents to train AI models. We do not send marketing text messages.

When a team adds a recipient mobile number to a request, we send that number a text message containing a link to the request. To do this we use Twilio, a messaging provider. Twilio receives the phone number, the message content, and the delivery result. We store the phone number against the request, and we store the delivery outcome, so the sender knows whether the text went out.

Text messages are sent only in response to an action an ApproveThat user has taken (creating a request, or inviting a teammate). Recipients can stop text notifications by asking the sender to remove their number, or by replying STOP to a message, which is honoured by our messaging provider.

We share data only with the service providers we need to run ApproveThat, and only for the purpose described here:

• Hosting and database — Lovable, which hosts the application and stores the data described above.
• Text messaging — Twilio, to deliver SMS notifications.
• Payments — Stripe, to process subscriptions and to provide the customer billing portal.
• Email delivery — the transactional email service that sends request notifications, invitations and password resets.

We may also disclose data if we are required to by law, or to protect the rights, safety or property of ApproveThat, our users, or the public. We do not share data with advertisers or data brokers.

We keep account, workspace, request and audit-trail data for as long as the workspace exists. Approval recipients’ email addresses, mobile numbers and decision records are kept for the same period, because the audit trail is the core product our customers pay for.

When a workspace is deleted, or an account holder asks us to remove a person or a request, we delete that data from our live systems within 30 days, except where we must retain it for legal, tax or accounting reasons. Payment records are retained as required by tax law.

Access to data is restricted to what a person’s role requires. Uploaded files are held in private storage that is not publicly listable, and each approval request is reachable only through a long, randomly generated link that a recipient must have in order to view that one request. Connections are encrypted in transit. No system is perfectly secure, so we also limit what any single compromised credential can reach.

If you hold an ApproveThat account, you can access and correct your profile information, manage your workspace members, and export or delete your workspace from inside the app. You can cancel a subscription at any time from the billing portal.

If you received an approval request and do not have an account, you can ask the sender to delete the request, or contact us directly at the address in section 10 to ask what data we hold about you or to ask us to remove it. We will respond within 30 days.

Depending on where you live, you may have additional rights, such as the right to request a copy of your data, to ask that it be deleted, to object to certain processing, or to lodge a complaint with a supervisory authority. We honour those requests regardless of where they come from.

ApproveThat is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, contact us and we will remove it.

Questions, correction requests and deletion requests about this policy or about your data can be sent to contact@approvethat.com. Please include enough detail for us to find the record you mean.

If we make a material change to this policy we will update the effective date at the top of this page and, where the change affects how customer data is used, notify account holders by email. Continued use of ApproveThat after a change takes effect means the updated policy applies.