Faximus Privacy and Cookie Policy

Version: 2026.11.04-r1

Public URL: https://faximus.io/legal/privacy

This Privacy and Cookie Policy explains how Faximus LLC, a South Carolina limited liability company (Faximus, we, us, or our), collects, uses, discloses, and protects personal information in connection with faximus.io, the Faximus customer portal, APIs, support, sales, billing, and related services (the Services).

It also explains the choices and privacy rights available to individuals.

1. Scope and our roles

1.1 Information covered by this policy

This policy covers personal information about:

• website visitors;
• individual consumer account holders and household users;
• Customer account administrators and users;
• developers and integration personnel;
• billing, sales, and support contacts;
• job applicants and business contacts; and
• other people who communicate directly with Faximus.

1.2 Customer Content

When a Customer uses Faximus to send, receive, store, or route a fax, the Customer generally decides why and how the fax content and recipient information are processed. For that data, Customer is generally the controller or business, and Faximus acts as Customer's processor, service provider, or contractor. The Data Processing Addendum governs that processing.

If the content is PHI and a signed Business Associate Agreement applies to the specific HIPAA-enabled account, the BAA and HIPAA govern Faximus's handling of that PHI. This policy is not a healthcare provider's Notice of Privacy Practices.

1.3 Our independent role

Faximus acts as an independent controller or business for information we use for our own account administration, billing, security, legal compliance, product management, website operation, subscription management, and direct relationship with a Customer, including a Consumer account holder.

2. Personal information we collect

2.1 Information you provide

We may collect:

• Account and contact information: name, optional business name and job title where relevant, email address, telephone number, mailing or service address, and account identifiers.
• Authentication and security information: identity-provider identifiers, login events, multi-factor authentication events, password reset information, API key labels, permissions, and security preferences. Authentication credentials may be handled by our identity provider; Faximus does not need to receive a usable copy of your password.
• Billing information: billing contact, billing address, tax information, subscription, invoices, payment status, and limited payment-method details such as brand, expiration date, and last four digits. The payment processor may collect the full card or bank details.
• Compliance information: acceptance and recurring-subscription consent records, identity or business-verification information, sender identity, consent attestations, suppression or opt-out records, BAA status, and use-case information.
• Communications: sales inquiries, support requests, feedback, survey responses, meeting notes, and other messages sent to us.
• Fax and integration data: documents, recipient and sender numbers, cover-sheet information, filenames, page count, instructions, API parameters, webhook configuration, and Customer-defined metadata.
• Job-application information: resume, employment history, qualifications, references, and information voluntarily submitted during recruiting.

2.2 Information collected automatically

We may automatically collect:

• IP address and approximate location derived from it;
• browser, device, operating system, language, and time zone;
• pages or screens viewed, referring page, links clicked, and session activity;
• login time, authentication result, security events, and account actions;
• API endpoint, request time, response code, latency, request identifier, source address, and usage measurements;
• fax transmission metadata, including sender number, recipient number, direction, page count, status, timestamps, attempt history, route, and error category;
• webhook event, delivery attempt, destination host, response code, and timing;
• service performance, crash, diagnostic, fraud, and abuse signals; and
• cookies, local storage, and similar technologies described below.

We design operational logs to avoid document content where practical, but limited content may be processed when needed to render or transmit a fax, provide Customer-authorized support, investigate a security event, or comply with law.

2.3 Information from other sources

We may receive information from:

• Customer's account administrator or another authorized user;
• identity providers used for sign-in;
• payment processors and fraud-prevention providers;
• telecommunications carriers and numbering providers;
• cloud, content-delivery, security, email, support, and analytics providers;
• public records, business registries, sanctions lists, and other verification sources;
• recipients or senders reporting abuse, wrong-number traffic, or a privacy concern; and
• transaction parties in a merger, financing, acquisition, or asset sale.

3. How we use personal information

We use personal information to:

• create, administer, authenticate, and secure accounts;
• provide, route, render, store, deliver, and troubleshoot fax services;
• provide API, webhook, email, number, portal, and reporting features;
• meter usage, issue invoices, process payments, collect amounts due, and manage taxes;
• verify individuals or businesses, number ownership, porting authority, and permitted use cases;
• provide support and respond to requests;
• send transactional, security, billing, legal, and service communications;
• detect, prevent, and investigate fraud, abuse, unlawful faxing, security incidents, and violations of our policies;
• maintain audit records, enforce agreements, and respond to legal process;
• improve reliability, usability, and product performance using aggregated, statistical, or de-identified information;
• plan and develop features without using Customer Content to train a general-purpose AI model unless Customer expressly agrees;
• market Faximus to individuals or business contacts where permitted, subject to consent and opt-out rights; and
• evaluate candidates and manage recruiting.

We do not use fax content for cross-context behavioral advertising.

4. Legal bases for EEA, UK, and similar laws

Where a law requires a legal basis, we rely on one or more of the following:

Where we rely on legitimate interests, we consider the impact on individuals and use reasonable safeguards. You may object where applicable.

5. How we disclose personal information

5.1 Service providers and subprocessors

We disclose information to providers that help us operate the Services, subject to appropriate contractual restrictions. These may include:

• Amazon Web Services for cloud hosting, storage, databases, identity, messaging, logging, and security;
• Cloudflare for DNS and bot verification (Turnstile);
• Google for business email, including our support and compliance mailboxes, and for Google sign-in if you use it. Do not email protected health information to support@faximus.io or compliance@faximus.io;
• telecommunications and numbering providers, including Telnyx and/or Flowroute when used for the relevant route or number;
• the payment processor shown at checkout, which may include Stripe;
• email, support, monitoring, error-tracking, analytics, signing, and business-operations providers; and
• professional advisers, auditors, insurers, and contractors with a legitimate need for access.

The current subprocessor list is published at faximus.io/legal/subprocessors. A provider may process information in the United States or another location described in that list. Email privacy@faximus.io with the subject line "Subprocessor notices" to subscribe to changes.

5.2 At Customer's direction

We disclose Customer Content and related information to the fax number, carrier, webhook endpoint, email address, integration, user, or other destination selected by Customer. We are not responsible for the recipient's independent handling of information.

5.3 Legal, safety, and enforcement reasons

We may disclose information when we reasonably believe it is necessary to:

• comply with law, regulation, subpoena, court order, or other valid legal process;
• protect the rights, safety, data, property, or systems of Faximus, Customers, recipients, or others;
• investigate fraud, abuse, security incidents, or unlawful communications;
• enforce the Agreement; or
• respond to an emergency involving risk of serious harm.

Where permitted, we will direct a request for Customer Content to Customer, narrow the request, and notify Customer before disclosure.

5.4 Corporate transactions

Information may be transferred in a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the business. The recipient must honor this policy for information collected under it unless individuals receive notice of a change.

5.5 Aggregated and de-identified information

We may use and disclose information that is aggregated or de-identified so that it cannot reasonably be linked to an individual. We will not attempt to re-identify information that we maintain as de-identified, except to test our de-identification process or as permitted by law.

6. No sale, sharing, or targeted advertising

Faximus does not sell personal information for money or other valuable consideration. Faximus does not share personal information for cross-context behavioral advertising and does not process it for targeted advertising as those terms are used in U.S. state privacy laws.

We do not use third-party advertising cookies in the Services. If our practices change, we will update this policy, provide legally required notices and choices, and honor applicable opt-out preference signals.

7. Customer Content and fax recipients

7.1 Contact the Customer first

If your information appears in a fax sent or received by a Faximus Customer, that Customer normally controls the information. Direct access, correction, deletion, restriction, or other requests to the Customer that sent or received the fax. We will assist the Customer as required by the DPA, BAA, or law.

7.2 Wrong-number and abuse reports

You may report an unwanted or misdirected fax to report-abuse@faximus.io. Include only the information needed to identify the transmission. We may provide the report to the Customer and may retain evidence needed to investigate, suppress further traffic, enforce our policies, or comply with law.

7.3 PHI

PHI processed under a BAA is handled under that BAA. Some HIPAA-regulated information may be excluded from particular state privacy laws, while other information about the same individual or organization may remain covered. Faximus will apply the law that governs the specific data and role.

8. Data retention

We retain information only as long as reasonably needed for the purposes described in this policy, including to provide the Services, follow Customer configuration, maintain security and audit records, comply with law, resolve disputes, and enforce agreements.

The Data Retention and Deletion Schedule describes current default periods. In general:

• free or test fax documents may be retained for a short period such as 7 days;
• paid fax documents are generally subject to a default period such as 90 days, with other options where the plan supports them;
• webhook delivery history is generally retained for a shorter operational period;
• security and audit logs may be retained for one year, or longer only as stated in a signed order form or BAA;
• billing and tax records may be retained for seven years; and
• backup copies expire on the normal backup rotation.

We may keep information longer for a legal hold, security investigation, unresolved dispute, fraud prevention, suppression request, or legal requirement. Customer is responsible for choosing an appropriate retention setting and exporting records it must keep.

9. Security

Faximus uses administrative, technical, and physical safeguards designed to protect personal information. Depending on the system and data, safeguards may include:

• encryption in transit using TLS for the web portal and API, and encryption at rest for stored fax documents and production databases;
• identity and access controls, including role-based access, administrative access limited to a small number of named staff, and optional authenticator-app (TOTP) two-step verification for portal user accounts;
• tenant separation in the application, and a dedicated production cloud account;
• application and operational logging;
• secure development and change controls;
• patch, incident-handling, and vendor-selection practices;
• backups and recovery procedures; and
• confidentiality obligations for anyone with access to personal information.

Ordinary fax transmission can traverse public or carrier telephone networks and is not represented as end-to-end encrypted between Faximus and the recipient's fax device. Customer must decide whether fax is an appropriate channel for the information and use case.

No system is perfectly secure. Customer must protect its users, credentials, endpoints, documents, and local copies. Contact security@faximus.io promptly if you suspect an incident involving Faximus.

10. Your privacy rights

Depending on where you live and how we process your information, you may have the right to:

• know or access the personal information we process;
• receive information about categories, sources, purposes, and disclosures;
• correct inaccurate personal information;
• delete personal information, subject to exceptions;
• receive a portable copy;
• restrict or object to processing;
• withdraw consent without affecting earlier lawful processing;
• opt out of sale, sharing, or targeted advertising;
• limit certain uses of sensitive personal information;
• opt out of qualifying profiling or automated decisions;
• appeal a denied request; and
• receive equal service and price when exercising a privacy right.

Faximus does not currently make decisions that produce legal or similarly significant effects about individuals solely through automated processing.

10.1 Submit a request

Submit a request to privacy@faximus.io. Describe the request and identify your relationship to Faximus. We may ask for information reasonably needed to verify identity, authority, account, and jurisdiction. We will not require more information than reasonably necessary.

If Faximus processes the information only for a Customer, we may direct the request to that Customer.

10.2 Authorized agents

An authorized agent may submit a request where law permits. We may verify the agent's authority and, where allowed, ask the individual to confirm the request directly.

10.3 Appeals

If we deny a request, you may appeal by replying to the decision or emailing privacy@faximus.io with the subject line "Privacy Appeal." We will respond within the time required by applicable law.

10.4 Complaints

Individuals in the EEA or UK may complain to their local data-protection authority. You may also contact us first so we can try to resolve the concern.

11. California notice at collection

For California residents, Faximus may collect the following categories of personal information described by the California Consumer Privacy Act, depending on the relationship and use:

• identifiers and contact information;
• customer-record information, including billing and service address;
• commercial information, including subscriptions, invoices, and service usage;
• internet or electronic network activity;
• approximate geolocation derived from IP address;
• professional or employment information;
• audio or visual information if a support call or meeting is recorded with notice;
• inferences used for security, fraud, or abuse risk; and
• sensitive personal information, such as account credentials and the content of communications, where applicable.

We collect these categories from the sources described in Section 2 and use them for the purposes in Section 3. We disclose them to the categories of recipients in Section 5. We do not sell or share them for cross-context behavioral advertising.

Faximus uses sensitive personal information only for permitted purposes such as authentication, security, providing requested Services, processing Customer-directed communications, and legal compliance. We do not use it to infer characteristics about an individual for advertising.

12. Global Privacy Control and browser signals

Where required by law, Faximus honors a recognized opt-out preference signal such as Global Privacy Control as a request to opt out of sale or sharing. Because Faximus does not currently sell or share personal information for cross-context behavioral advertising, the signal does not normally change our processing.

We do not respond to the older "Do Not Track" signal because no uniform legal or technical standard applies to it.

13. International transfers

Faximus is based in the United States and the Services are primarily hosted and operated in the United States. Information may be transferred to and processed in the United States and other places where our providers operate.

Where required for a restricted transfer from the EEA, UK, or Switzerland, Faximus will use an approved transfer mechanism, such as the European Commission's 2021 Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures and transfer assessments where required. The Data Processing Addendum contains the contractual details.

14. Children

The Services are not directed to children and may not be used to create an account by anyone under 18. We do not knowingly collect personal information directly from a child under 13 through account registration or business marketing.

A Customer may transmit information about a minor when lawfully performing its own business or healthcare functions. In that situation, Customer controls the content and is responsible for all required authority, notice, consent, and protection.

15. Marketing choices

You may opt out of Faximus marketing email by using the unsubscribe link or contacting privacy@faximus.io. We may continue to send account, billing, security, support, and legal notices that are necessary for the Services.

16. Cookie and similar technology notice

16.1 What these technologies are

Cookies are small text files stored by a browser. Similar technologies include local storage, session storage, pixels, tags, and software-development-kit identifiers. They can remember a session, secure a request, save a preference, measure performance, or help us understand use.

16.2 Categories we use

The authenticated customer portal uses cookies and local storage primarily to provide and secure the Service. We do not use advertising cookies for cross-context behavioral advertising.

16.3 Providers

Cookies may be set by Faximus or by providers used for security, identity, payment, content delivery, or optional analytics. These may include Cloudflare, the identity provider used for sign-in, and the payment processor used at checkout. The cookie preference tool, when displayed, provides the current list for the device and region.

Starting November 4, 2026, with your permission, we use Google Analytics on faximus.io to measure visits to public marketing pages. You can change your choice at any time using Privacy settings on the site.

16.4 Your choices

You can:

• use the cookie preference tool where available;
• block or delete cookies in your browser;
• use private-browsing controls;
• disable optional analytics where offered; and
• send a recognized opt-out preference signal where applicable.

Blocking necessary cookies may prevent sign-in, checkout, security controls, or other features from working. Browser settings must be managed separately on each device and browser.

16.5 Retention

Session cookies normally expire when the browser session ends. Persistent cookies expire on the date set in the cookie or when deleted. We periodically review cookie duration and aim to use the shortest period reasonably necessary.

17. Third-party websites and services

The Services may link to or integrate with third-party websites and products. Their privacy practices are governed by their own notices. Customer is responsible for evaluating integrations it enables.

18. Changes to this policy

We may update this policy as the Services, providers, or laws change. We will post the new version and effective date. If a material change affects how we use information already collected, we will provide additional notice when required, such as by email or in-product notice.

19. Contact

Faximus LLC
Spartanburg County, South Carolina, United States
Privacy: privacy@faximus.io
Security: security@faximus.io
HIPAA and compliance: compliance@faximus.io
Abuse and unwanted faxes: report-abuse@faximus.io