Privacy Policy

1. Introduction

Mighty Process Server LLC (“we,” “us,” or “the Company”) operates the Mighty Process Server platform (“the Platform”), a software-as-a-service application accessible at mightyprocessserver.com and through associated mobile applications. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform. Please read this policy carefully. By using the Platform, you consent to the practices described herein.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, business name, mailing address, and profile photo when you create an account.
• Payment Information: Billing details processed through Stripe. We do not store complete credit card numbers on our servers.
• Legal Documents: Court documents, summonses, subpoenas, and related legal papers you upload for job creation and processing.
• Professional Information: Licensing details, certifications, affiliations, service areas, and years of experience for process server profiles.
• Communications: Messages sent through the Platform's messaging system, community posts, and support requests.
• AI Interactions: Questions and conversations with MightyAutomationAI, including feedback (thumbs up/down) on AI responses.

2.2 Information Collected Automatically

• Device Information: Browser type, operating system, device identifiers, and screen resolution.
• Usage Data: Pages visited, features used, timestamps, click patterns, and session duration.
• Location Data: Approximate location based on IP address. Precise GPS location only when you explicitly enable location services for field operations.
• Cookies & Similar Technologies: We use strictly necessary cookies for authentication and session management. With your consent we also use functional, analytics, and marketing cookies. See our Cookie Policy for the complete list and manage your choices through the cookie banner or the “Cookie Preferences” link in the footer.

2b. Legal Basis for Processing (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal information only when we have a valid legal basis under Article 6 of the GDPR:

• Contract (Art. 6(1)(b)): Processing necessary to provide the Platform to you under our Terms of Service — account creation, job dispatching, payments, messaging.
• Legitimate Interests (Art. 6(1)(f)): Securing the Platform, preventing fraud, improving features, and operating our business. We balance these interests against your rights.
• Consent (Art. 6(1)(a)): Optional processing such as non-essential cookies, marketing communications, and desktop push notifications. You can withdraw consent at any time.
• Legal Obligation (Art. 6(1)(c)): Tax reporting, responding to valid legal process, and complying with record-keeping laws.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Platform and its features
• Process your subscription payments and platform fees
• Facilitate job creation, dispatching, and process server matching
• Generate affidavits, field sheets, and proof-of-service documents
• Power MightyAutomationAI document extraction and chat features
• Send you transactional notifications (job updates, payment confirmations, bid requests)
• Display your process server profile in our public directory (if applicable)
• Improve the Platform through analytics and usage patterns
• Enforce our Terms of Service and protect against fraud or abuse
• Respond to your inquiries and provide customer support

4. AI & Document Processing

MightyAutomationAI uses third-party AI services (currently OpenAI) to analyze legal documents and provide chat-based assistance. When you upload documents or interact with the AI:

• Documents are sent to AI providers solely for the purpose of extracting case information for your use.
• We do not use your legal documents to train general-purpose AI models.
• AI chat conversations are stored in your account for your reference and may be used to improve the accuracy of our FAQ system.
• Flagged AI responses (via thumbs-down feedback) may be reviewed by administrators to improve response quality.
• The embeddable widget processes anonymous conversations; no personally identifiable information is collected from widget users.

5. Information Sharing & Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

• With Other Users: Your professional profile (name, company, city, state, rating, certifications) is visible to other Platform users and in the public directory. Legal document details are shared only with parties involved in a specific job (client, assigned process server, dispatching member).
• Service Providers: We use trusted third-party services for payment processing (Stripe), email delivery, AI processing (OpenAI), cloud hosting (Vercel, Supabase), and analytics. These providers are contractually obligated to protect your data.
• Legal Requirements: We may disclose information if required by law, court order, or government request, or if necessary to protect the rights, property, or safety of Mighty Process Server LLC, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

6. Data Retention

We retain your account information for as long as your account is active. Upon account deletion, we retain your data for 30 days to allow for recovery, after which it is permanently deleted. Legal documents and job records may be retained for a longer period as required by applicable record-keeping laws. Anonymous analytics data and aggregated usage statistics may be retained indefinitely.

7. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption in transit (TLS/SSL) and at rest
• Row-level security (RLS) ensuring users can only access their own data
• Secure authentication via Supabase Auth with email verification
• Regular security audits and monitoring
• Stripe PCI-compliant payment processing (we never store full card numbers)

While we strive to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

8. Your Rights & Choices

Depending on where you live, you may have the following rights. We honor these requests regardless of jurisdiction where we can:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion / Erasure: Request deletion of your personal information, subject to legal retention obligations.
• Data Portability: Request your data in a structured, commonly used, machine-readable format.
• Restriction of Processing: Ask us to pause processing while a dispute is resolved.
• Object: Object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent: Withdraw any consent you've previously given (non-essential cookies, marketing email, push notifications) at any time — without affecting prior lawful processing.
• Opt-Out of Sale/Sharing: We do not sell personal information. If we ever share personal information for cross-context behavioral advertising, you can opt out at any time via the cookie banner or by submitting a request.
• Automated Decision-Making: We do not make solely automated decisions that produce legal or similarly significant effects on you. If that changes, we will disclose it here and offer human review.
• Appeal: If we decline a request, you may appeal that decision by replying to our response email.
• Lodge a Complaint: You have the right to complain to your local data protection authority (e.g., ICO in the UK, CNIL in France, your EU Member State supervisory authority) or to the California Privacy Protection Agency.

To exercise any of these rights, email privacy@mightyprocessserver.com or use the self-serve controls in your account settings. We will acknowledge your request within 10 business days and respond substantively within 30 days (45 days for CCPA/CPRA with a written extension notice where required). We will verify your identity before acting on access, deletion, or portability requests. Authorized agents acting on your behalf must provide written permission plus proof of identity.

9. US State Privacy Rights

Residents of states with comprehensive privacy laws — including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and others that have come into effect — have specific rights described in Section 8. We treat them as floor, not ceiling, and extend the same rights to all users where feasible.

Categories of personal information we collect (for CCPA/CPRA purposes): identifiers (name, email, phone, IP address); commercial information (subscription history, platform usage); internet activity (pages visited, clicks, feature usage); geolocation (approximate from IP, precise only when you enable it); professional information (licensing, affiliations, service areas); audio/ visual (profile photos, uploaded document scans); and inferences drawn from the above to serve the Platform. We collect these directly from you, automatically from your device, and from service providers who help us run the Platform.

Purposes: delivering the Platform, processing payments, matching process servers to jobs, generating documents, securing the service, analytics, and supporting you when you contact us.

Sale or sharing: We do not “sell” personal information for money, and we do not “share” personal information for cross-context behavioral advertising as those terms are defined under California law. We honor the Global Privacy Control signal as a valid opt-out request for any future use of that kind.

Retention: See Section 6. We do not retain personal information longer than necessary for the purposes described, except where law requires.

Non-discrimination: We will not deny service, charge a different price, or provide a different level of quality because you exercised any of your privacy rights.

9b. International Data Transfers

We are based in the United States. Our service providers (including Supabase, Vercel, Stripe, Postmark, and AI vendors) may process personal information in the US or other countries. When we transfer personal information out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and, where available, certification frameworks. You can request a copy of the safeguards in place for a specific transfer by emailing privacy@mightyprocessserver.com.

9c. Global Privacy Control

If your browser sends a valid Global Privacy Control (GPC) signal, we treat it as an opt-out of the sale and sharing of personal information under US state privacy laws. Because there is no consistent industry standard for the legacy “Do Not Track” header, we do not respond to it.

10. Children's Privacy

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will take steps to delete it promptly.

11. Third-Party Links & Services

The Platform may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through our Platform.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through a notice on the Platform. Your continued use of the Platform after changes constitutes acceptance of the updated policy. We encourage you to review this policy periodically.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how your information is handled, please contact us: