Note: This is a draft policy pending attorney review before public launch. It reflects our current practices and commitments. A qualified privacy attorney will review it before we accept payments or process PHI at scale.
Privacy Policy
FightThis.ai LLC ("FightThis," "we," "us," or "our") provides a letter-drafting service at fightthis.ai. This policy explains what data we collect, how we use it, and what rights you have over it.
What we collect
- Documents you upload: PDFs, images, or text you submit for letter drafting. These may contain personal information (your name, address, account numbers) and potentially protected health information (PHI) if you upload insurance or medical documents.
- Form inputs: Answers to the questions we ask during the draft flow (names, dates, amounts, context).
- Email address: For account creation and letter delivery.
- Payment information: Handled entirely by Stripe. We never see or store your card number.
- Usage data: Page visits and funnel events (for example, "preview generated") counted by Plausible Analytics, which we host ourselves. Plausible sets no cookies and does not track you across sites. Page addresses that contain an order number are recorded with the number removed, and each event carries only the dispute type. We do not use Google Analytics or the Meta Pixel.
- Google Ads tag: Our public pages load Google's advertising tag, which sets Google advertising cookies and tells Google which of those pages you visit, so we can measure how our ads perform. It never loads on letter preview, unlock, account or sign-in pages. The page addresses it receives have order numbers removed, and keep only campaign tags and ad click identifiers from the query string. Google's handling of this data is governed by Google's privacy policy.
- Ad click information: If you arrive by clicking one of our ads, the link carries a click identifier (such as Google's gclid) and campaign tags. We store these with your order to measure which ads work. For orders that came from a Google ad, we send Google Ads only the click identifier, the time of purchase and the amount paid. We never send your name, email, documents, or anything about your dispute.
- Chats with Little Mac: If you use our chat assistant, your messages and its replies are sent to Anthropic to write the replies. We keep a copy for 30 days so we can review and improve its answers, then delete it. Before a chat is stored, email addresses, phone numbers, street addresses and long numbers (such as account or claim numbers) are masked. If you are signed in, or this browser created a draft, the assistant can read your own letters to answer your questions about them. It never sees anyone else's letters. If you ask it to pass something to our team, your email address and a summary of the chat are sent to support@fightthis.ai only when you click Send. The chat sets no cookies: the conversation stays in your browser's session storage and is cleared when you close the tab, and a random browser identifier is kept in local storage so a chat discount is offered only once.
- IP address: Stored in hashed form for rate limiting and fraud prevention. Not linked to your identity.
How we use your data
- To generate the letter you requested
- To deliver your letter by email and make it available for download
- To process payment via Stripe
- To maintain your account and letter history (if you create an account)
- To improve our service (aggregated, de-identified usage patterns only)
What we don't do
- We never train AI models on your data. Your documents and inputs are used solely to generate your letter and are never used to fine-tune, train, or evaluate AI models.
- We never sell your data to third parties, advertisers, or data brokers.
- We never share your data except with the subprocessors listed below, solely to deliver the service, and the ad click information described above.
- No document contents are shared with advertisers or analytics providers.
Auto-deletion
Documents you upload are automatically deleted 30 days after upload unless you request longer retention. Generated letters are retained for 90 days post-payment, then deleted unless you request retention. Chat transcripts are deleted 30 days after they are written. You can request deletion of any specific document at any time.
Subprocessors
- Stripe — payment processing. PCI-DSS compliant.
- Postmark — transactional email delivery.
- Cloudflare R2 — encrypted document storage.
- Anthropic — AI letter generation and the Little Mac chat assistant. Documents are processed per Anthropic's data processing agreement; they are not used for model training.
- Mistral AI — text extraction (OCR) from uploaded documents, used when a document is too large for Anthropic to read directly or Anthropic cannot read it.
- Lob (when you choose mailing service) — physical mail fulfillment.
Security
- All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
- Documents stored in Cloudflare R2 with per-object encryption
- Access controls limit which employees can access uploaded documents
- Annual security review planned
Your rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data (right to erasure)
- Export your data in a portable format
- Opt out of any sale of personal information (we don't sell data, but this right exists)
To exercise any of these rights: privacy@fightthis.ai
California residents (CCPA)
California residents have additional rights under the California Consumer Privacy Act. We do not sell personal information. You have the right to know what personal information we have collected and to request deletion. Contact us at the email above.
Children
FightThis is not intended for users under 18. We do not knowingly collect data from children.
Changes to this policy
We'll notify registered users of material changes by email before they take effect.
