1. Who we are
Frelantra is operated by Baltimore Bros LLC, Humble, Texas, USA. This policy explains what personal information we handle when you use Frelantra, why, who else processes it, and what you can ask us to do about it.
It applies to frelantra.com, the signed-in application, and the client portal. It sits alongside our Terms of Service.
2. Two different people are described here
Frelantra is used by a business to serve its own clients, so two groups of people appear in this policy and they are not in the same position:
- Customers — the freelancers and studios who hold a Frelantra account. For their account information we are the controller: we decide what we collect and why, and this policy is our commitment to them.
- Customers’ clients — the people a customer sends contracts to. We hold their details because our customer put them there. For that information the customer is the controller and we are a processor acting on their instructions. If you are one of these clients, the business that sent you the contract is the right first point of contact for a question about your data — though you can always write to us and we will help route it.
3. What we collect, and why
We collect what the product needs to work. We do not buy personal information, and we do not collect data for advertising.
| Category | What it includes | Why we hold it |
|---|---|---|
| Account | Your name, email address, organization name, a password hash (we never see the password itself), and the date and version of the legal documents you accepted at signup. | To create and secure your account, to prove which version of these documents you agreed to, and to contact you about the service. |
| Billing | Customer and subscription identifiers issued by our payment processor, subscription status, trial and billing period dates. Card numbers are entered on the processor’s own pages and never reach our servers. | To run your subscription, control access to the workspace, and email you about payment problems and trial expiry. |
| Workspace content | Everything you enter: client names, emails, phone numbers, notes and tags; project titles, dates, venues and fees; contract text, field placements, versions, and any change request a client writes. | This is the product. We store it so you can use it, and process it to render, send, and sign your documents. |
| Signing records | The signature image drawn by the signer, the consent text shown, the time of signing, the signer's name and email, the document version signed, and the IP address and browser user agent of the signing session. | An electronic signature is only as good as its evidence. These details are the record that a specific person signed a specific version at a specific moment. |
| Client portal links | The random token, which client and project it grants access to, when it expires, and whether it has been revoked. | To let your client open their contracts without creating an account, and to let you cut off access. |
| Technical and log data | IP address, user agent, request paths, timestamps and error details, generated by our hosting and database providers in the ordinary course. | To keep the service running, diagnose faults, and detect abuse. |
We do not ask for and do not want special-category information (health, biometrics, political or religious views, and so on). A drawn signature is held as an image for the purpose of executing a document; we do not derive biometric identifiers from it.
4. Legal bases (EEA and UK)
If the GDPR or UK GDPR applies to you, we rely on these bases:
- Performance of a contract — running your account, your workspace, your subscription, and the signing flow.
- Legitimate interests — keeping the service secure, preventing abuse, diagnosing faults, and telling you about changes that affect you. We weigh these against your rights.
- Legal obligation — tax, accounting, and responding to lawful requests.
- Consent — where we ask for it explicitly, such as your acceptance of these documents at signup and a signer’s consent to sign electronically. You may withdraw consent, though doing so does not unwind a document already executed.
5. Who else processes your data
We use a small number of providers to run Frelantra. This is the complete list — there is no analytics vendor, advertising network, data broker, or CRM in it.
| Function | What it does for us | What it processes |
|---|---|---|
| Managed database and authentication provider | Hosted relational database and user authentication | Account records, workspace content (clients, projects, contracts, tasks), portal tokens, signing records, password hashes |
| Application hosting provider | Application hosting and server-side rendering | HTTP request data in transit, including IP address and request logs |
| Payment processor | Payment processing and the billing portal | Billing name and email, subscription and payment records, and card details entered directly on the processor's own pages — card numbers never reach our servers |
| Cloud infrastructure provider | Compute and object storage inside an account we control | Contract documents and signature artifacts held in our own private storage bucket, and the container that renders and signs documents |
| E-signature engine (self-hosted) | Document rendering and signature capture, operated by us on our own infrastructure — not a hosted third-party service | Contract documents, signature images, and signing audit records. These stay inside infrastructure we operate; they are not sent to an outside e-signature company |
| Transactional email provider | Delivery of service email | Recipient email address and message contents (contract invitations, portal links, verification and billing notices) |
| Image content delivery network | Serving decorative photography on our public marketing and login pages | Your browser's IP address and user agent when it loads those images. No Frelantra account data is sent, and no such image is loaded inside the signed-in app |
One point worth drawing out: our e-signature engine is self-hosted on infrastructure we control rather than bought as a hosted service, and executed documents are stored in private storage we control. Your contracts are not handed to a third-party signature company.
We describe these providers by function rather than by name, because publishing a detailed inventory of our infrastructure would weaken its security. If you want the specific providers identified, write to us at the address in section 14 and we will tell you.
We may also disclose information where the law requires it, to enforce our Terms, or to a successor entity in a merger or acquisition — in which case this policy continues to apply until replaced with notice to you.
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
6. The client portal and magic links
Your clients never create an account with us. Instead, a customer issues a private link — a long random token in the URL — that opens a portal scoped to that one client, and optionally to a single project.
This has real consequences worth stating plainly:
- The link is a bearer credential. Anyone who has it can see what it grants access to, so it should be treated like a password and not forwarded.
- Links expire — 30 days by default — and can be revoked by the customer who issued them at any time.
- A link only ever reaches one client’s own contracts and projects. It cannot be widened to the rest of the customer’s workspace.
- Because there is no client account, we hold no client password and no client login history — only what the customer entered about them and what happened to their contracts.
If you received a portal link and want your details removed, contact the business that sent it to you; they control that record. You can also write to admin@frelantra.com and we will pass the request on.
8. How long we keep things
We keep workspace content for as long as your account is active, because it is the account. Beyond that:
- Executed contracts and their signing records are retained as an immutable history for as long as the account exists. A signed document is evidence, so we do not overwrite or silently discard one — including earlier versions of a contract that was later revised.
- Portal tokens expire after 30 days by default and can be revoked sooner.
- Billing records are kept for as long as tax and accounting law requires, typically several years, and are also held by our payment processor under its own retention rules.
- Server logs are kept for a short operational period by our hosting and database providers.
- Closed accounts — we delete or de-identify content in the ordinary course after closure, except records we must keep by law. Ask us and we will confirm what remains.
Because we cannot restore a document we have deleted, export anything that matters to you before closing your account.
9. Security
Traffic is encrypted in transit with TLS, and data at rest is encrypted by our database and storage providers. Passwords are hashed by our authentication provider and never stored or seen by us in plain form.
Workspace data is isolated per organization by database-level row-security policies rather than only by application code, so one customer’s query cannot reach another’s records. Portal access is authorised strictly by the token’s own scope. Access to stored contract documents uses a dedicated least-privilege credential limited to reading that one bucket.
No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by applicable law and without undue delay.
10. Your rights
Depending on where you live, you may have the right to access a copy of your personal information, correct it, delete it, receive it in a portable format, object to or restrict certain processing, and withdraw consent.
If you are a California resident, you also have the right to know what we collect and disclose, to request deletion or correction, to limit the use of sensitive personal information, and not to be discriminated against for exercising those rights. As stated above, we do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of.
Write to admin@frelantra.com to make a request. We will verify who you are — usually by confirming control of the account email — and respond within the period the applicable law allows, normally 30 days. You may use an authorised agent where the law permits.
If you are one of our customers’ clients, we will route your request to that customer, who controls the record. If you are in the EEA or UK you also have the right to complain to your local data protection authority; we would appreciate the chance to resolve it with you first.
11. Children
Frelantra is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, write to admin@frelantra.com and we will delete it.
12. International transfers
Our providers operate infrastructure in the United States and in other countries. If you or your clients are outside those countries — including in the EEA or the UK — using Frelantra involves transferring personal information across borders.
Where such a transfer requires a safeguard, we rely on the European Commission’s Standard Contractual Clauses (and the UK addendum) or another lawful mechanism in our agreements with those providers. Write to admin@frelantra.com for details of the mechanism applying to a specific provider.
13. Changes to this policy
We update this policy when our data practices change — in particular whenever a provider is added to or removed from the list above. New versions are published here with a new version string and effective date, and we give account owners reasonable notice of material changes by email or in the app. The version you are reading is 2026-09-19.
14. Contact
Privacy questions and requests:
Baltimore Bros LLC
Humble, Texas, USA
admin@frelantra.com
Full registered address available on written request to the legal notices address below.
For legal notices unrelated to privacy, see the Terms of Service.
