Privacy Policy

HelpMeFax is an online fax service operated by HelpMeFax LLC, a North Carolina limited liability company at 110 S Massey St, Suite #204, Selma, NC 27576. When this policy says “we”, “us” or “HelpMeFax”, it means that company. Our servers are located in the United States.

This policy covers the helpmefax.com website, including the public pages you can read without an account, and the HelpMeFax service itself: sending faxes, receiving faxes on a dedicated number, your account, business accounts, billing and support.

For most of what is described here we are the party that decides why and how your information is handled — in UK and EU terms, the controller. There is one important exception. When you send us a document to fax, we handle that document on your instructions and for your purposes: you decide what is in it and who it goes to, and we transmit it. Where that document contains protected health information and you have an executed Business Associate Agreement with us, we handle it as a business associate under HIPAA and that agreement governs. Section 12 explains how the two documents fit together.

A word about information you give us about other people. Your address book, the fax numbers you send to, the email address of someone you invite through the referral program and, above all, the contents of the documents you fax are usually information about someone who has never dealt with HelpMeFax. We handle that information for you, on your instructions, and we rely on you having the right to give it to us.

We collect what is needed to run an account, move a fax, take a payment and keep the service from being abused. We share it with four kinds of supplier, plus two more that your browser contacts directly — all six are described in section 6 — and with nobody else except where the law requires it. If you are in a business account, the other people in your business also see its faxes and support tickets, as section 6 explains. We keep documents for 365 days and then delete them automatically. We do not advertise, we run no analytics or tracking on this site, we do not sell personal information, and we do not share it for cross-context behavioral advertising.

What follows is the long version. It is long because it is complete, not because anything in it is unusual.

Account details

Your name, email address, and a password that we store only as a hash and never in readable form. Optionally a phone number. We also record when your email address was verified, when you last signed in and from which IP address, and the state of your account — active or suspended, and whether two-factor authentication is switched on.

Documents you send, and the record of sending them

The file you upload, and for each fax: the sender name, email and phone you put on it, the recipient name, organization and fax number, the original filename, the file size, the page count, any cover message, when it was scheduled or sent, its status, how many attempts it took, any error the carrier returned, and what it cost. We keep this so your fax history, delivery confirmation and receipts all work.

If you bring a number from another provider

To move a number, your current provider needs to match the request to your account, so we collect: the numbers you want to move, the name on that account, the person authorizing the transfer and their title, the account’s service address and main (billing) number, the account number, the PIN or passcode if there is one, the name of your current provider, and a recent bill. You sign a letter of authorization on screen; we keep the signature with the time, IP address and browser it was signed from. The account number, PIN and signature are stored encrypted, and so are the letter and the bill.

Documents you receive

If you have a dedicated fax number, we store each received fax, the sending fax number, the page count, when it arrived, and whether and when you viewed or downloaded it. The sending number is information about whoever faxed you; we hold it because it is on the fax.

Dedicated fax numbers

The number itself, the carrier identifiers behind it, the name you give it, when it was provisioned, its monthly cost, a running count of faxes and pages received, and the date it was released if you release it.

Payment information

This is the part people most want to be precise about, so: your card number never reaches HelpMeFax. Card details are entered on a page hosted by a PCI-compliant payment processor, not on our servers. What we hold is the record of the transaction — amount, currency, date, what it was for, its status, an identifier from the processor and the processor’s response — plus your account balance and credit history.

If you choose to save a card for automatic top-up, the card itself is held by the processor. We keep an opaque reference to it plus the card brand, the last four digits and the expiry date, so you can recognize which card is on file. Removing the card under Settings › Billing clears our copy and instructs the processor to delete the stored card.

Your address book

Contacts you save: name, organization, fax number, phone, email, any note you write, and how often you have faxed them. Also any contact groups you build. This is information about other people that you have chosen to store with us.

Support tickets

Your name, email, any phone number you give, the subject, and everything you or we write in the ticket and its replies. A ticket can be opened without an account. Please note that a support ticket is a plain message channel and is not the right place to paste protected health information — if a document is involved, tell us the fax reference instead of the contents.

Business Associate Agreement records

If you request a BAA we record your entity’s legal name and type, its postal address, the signer’s name, title and email, the exact version of the agreement you were shown, an image of the signature you draw or type, the wording you consented to, the IP address and browser identification at the moment of signing, the timestamps, cryptographic checksums of the document and the signature, and the signed PDF itself. This is signature evidence: it exists so that the agreement can be proved years later.

Business accounts

If your organization has a business account, we hold its profile — its legal and display names, the kind of organization, its postal address, phone number and website, the number of people it expected to add, and any notes in its application — together with who applied, who approved it and when. For each person in it we record their role, who invited them and when they joined. For each invitation we record the email address invited, which may belong to someone who has not yet dealt with us, the role offered, who sent it, and whether it was accepted, cancelled or left to expire. Every charge and top-up on the business balance records which person in the business made it.

Reviews

If you submit a review, we collect the name, role and organization you give, your email address, your rating and the text. If a review is approved, the name, role and organization you supplied are published on the public reviews page. Your email address is not published.

IP addresses, browser identification and devices

We record the IP address and browser identification for sign-ins and failed sign-ins, two-factor challenges, uploads, administrator actions, review submissions, BAA signing, and each active session. We also derive an approximate city and region from the IP address so that a sign-in alert can say where it came from and so your list of active sessions is readable. If you tick “trust this device” during a two-factor challenge, we store a hash of the device token, a device name taken from your browser identification, the IP address and an expiry date.

The web server also records the IP address, browser identification, page and timestamp of every request, including requests from visitors who never create an account.

Upload records

For every file uploaded we record the account, the original and stored filenames, the size, the file type, the result of the malware scan, the IP address and the browser identification. This record is also what proves which account owns which file, and it is the reason one customer cannot reach another customer’s document.

How you found us

When you first arrive on the site, before you have an account, we note in your session the page you landed on, the site or search that referred you, and any campaign tags in the link. If you go on to register, that is saved with your account, along with the answer you give to “how did you hear about us” and who referred you if you came through the referral program. We use it to understand which pages bring people to the service. It is not used to build a profile of you and it is not shared.

Referrals

If you invite someone, we store the invitation, the code, and the email address you entered, which belongs to a person who has not yet dealt with us.

Cookies and site preferences

Five cookies, described in full in section 13, and one browser-storage flag. No analytics, no advertising, no tag manager and no cross-site tracking.

Aggregate traffic counts

We keep a daily count of how many visits each page received from each kind of source — a search crawler, an AI assistant, a referring site. These counts contain no IP address and no browser identification.

Purpose by purpose, and nothing beyond these:

• To transmit your faxes. Your document and the destination number go to the carrier that dials the call, delivery is attempted and retried, and the outcome is recorded.
• To deliver faxes to you. Storing a received fax on your dedicated number and telling you it arrived.
• To run your account. Signing you in, verifying your email address, resetting a password, two-factor authentication, showing you your history.
• To take payment. Charging for a fax, a top-up, a subscription or a dedicated number; applying account credit; issuing receipts; processing a refund; defending a card dispute.
• To tell you what happened. Delivery and failure notices, low-balance warnings, card-expiry warnings, sign-in alerts, renewal notices, and the outcome of an automatic top-up.
• To run a business account. Showing everyone in a business its faxes, its inbox and its support tickets; showing its owner and managers its people, its balance and its audit log; and sending business notices to the people they concern.
• To answer support requests and, where you ask for one, to prepare and countersign a Business Associate Agreement.
• To keep the service safe. Scanning uploads for malware, blocking further sign-in attempts after five failures for the same email address from the same internet address within 15 minutes, blocking automated form submissions, enforcing page and size limits, refusing destination numbers that are blocked, and keeping enough of a log to investigate when something goes wrong.
• To hold ourselves accountable. Recording administrator actions, including every occasion an administrator accesses a customer account.
• To understand which pages bring people to the service, using the aggregate counts and signup attribution described above.
• To meet legal obligations, including retaining an executed BAA for six years.

We do not use your documents, your fax history, your contacts or your support tickets to train machine-learning models, to build advertising profiles, or for any purpose other than running the service you are paying for.

Administrator access to your account

You should know this, so it is stated in its own paragraph rather than buried. A HelpMeFax administrator can sign in to a customer account in order to reproduce a problem or fix something — while doing so they see what you see. Every time that access starts and stops it is written to an audit record that identifies the administrator, the account, the time and the IP address, and that record is permanent. Administrators cannot access another administrator’s account this way.

If you are in the United Kingdom or the European Economic Area, the law requires us to name a legal basis for each purpose. Ours are:

• Performance of a contract — your account, sending and receiving faxes, billing, and the service emails that tell you what happened to a fax or a payment. Providing this information is a requirement of using the service: without an email address and a payment we cannot open an account or send a fax.
• Legal obligation — retaining an executed Business Associate Agreement for six years, and responding to a valid legal request.
• Legitimate interests — security and abuse-prevention logging, malware scanning, sign-in alerts, administrator audit records, fraud and chargeback defense, and the aggregate measurement of which pages bring people to the service. Our interest is in keeping the service working and not being defrauded; we have weighed that against your interests and limited each of these to what the purpose needs.
• Consent — saving a card for automatic top-up, and marking a device as trusted. Both are off unless you switch them on, and you can withdraw either at any time, which does not affect anything done before you withdrew it.

We do not claim consent for the marketing-class emails described in section 14, because we would not be entitled to. New accounts are created with the marketing toggle already switched on, and a pre-ticked default is not consent under UK or EU law. We rely on legitimate interests for those emails instead — our interest being to ask customers who use the service how it is working, and to tell paying customers about automatic top-up, within the limits set out in section 14 — and you have an unqualified right to object, which you exercise by switching the toggle off at Settings › Notifications or by telling us. We would rather name the basis we are actually relying on than describe a default as a choice you made.

We share personal information with four categories of supplier, and we tell you exactly what each one receives. We do not name our suppliers on this page; if you need the names for a vendor review, email [email protected] and we will give them to you.

• A PCI-compliant payment processor. Receives your email address, an internal reference to your account, and the card details you type on its own hosted page. It also receives the description of the charge, and for a fax charge that description includes the destination fax number and the page count — so the processor can see who you faxed, though not what you faxed. For an automatic top-up it receives the amount and a reference that prevents the same charge being taken twice.
• Our telecommunications carrier partner. Receives the destination fax number, the number the fax is sent from, and the document itself, which it fetches over HTTPS from a cryptographically signed link on our server that stops working 30 minutes after we create it. To be accurate about that link: it is short-lived, but it is not single-use. Anyone holding it could fetch the document again within those 30 minutes, after which it is refused. The carrier necessarily keeps call records for every attempt. For an incoming fax, it sends us the sender’s fax number, the page count and the received document. When you bring a number from another provider, the carrier receives the transfer details listed in section 3, the signed letter and the bill, and passes what is needed to the provider you are moving from, which checks them against its records before it releases the number.
• Our email delivery provider. Receives every message we send you in full: the address, the subject and the body. Depending on the message that body may contain a fax status and destination number, a page count, an amount or balance, the IP address and city of a sign-in, the text of a support ticket, or a BAA as an attachment.
• An IP-address lookup service. Receives an IP address on its own, with no name or account attached, and returns an approximate city and region. We use this to make sign-in alerts and your list of active sessions readable. The result is cached on our servers for 30 days. The request is made over HTTPS, and nothing else — no name, no account, no document — is in it.

Two further suppliers touch your browser rather than our database. The typefaces on this site are loaded from a third-party font service, which means your IP address, browser identification and the page you are on reach that service on every page load, including on this page and before you have interacted with anything. A bot-mitigation provider is active on our public forms — sign-in, registration, the contact form and review submission. Its challenge widget loads in your browser on those pages, which means the provider receives your IP address, your browser identification and the page you are on as soon as the form is displayed, before you submit anything; when you do submit, we send the provider the challenge token it issued along with your IP address so it can tell us whether the submission looks automated. We do not send it your name, your email address or anything you typed into the form.

Inside a business account. If you belong to a business account, the other people in that business are not suppliers, but they do see your activity there, and you should know exactly what. Everyone in the business can see the faxes you send for it, including the documents, can read the faxes received on its numbers, and can read and reply to its support tickets. Its owner and managers can also see who is in the business and their roles, the business balance and who spent it, and the business audit log, which lists sign-ins with their IP addresses and account and security changes for everyone in the business. Faxes you sent or received on your own account before you joined are not shared with the business.

Two things that might be expected here do not apply. Malware scanning runs on our own server and nothing leaves it. We use no third-party analytics, error-tracking or application-monitoring service. An external uptime monitor does request our home page from outside on a schedule; it receives a status code and no personal information.

We may also disclose information:

• When the law requires it — in response to a subpoena, court order or other valid legal process, or where disclosure is necessary to protect the rights, property or safety of HelpMeFax, our customers or the public. Where we are permitted to tell you about such a request, we will.
• In a business transfer — if HelpMeFax LLC is merged, acquired or sells its assets, customer information would transfer as part of that transaction, and this policy would continue to apply to it until you are told otherwise.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We have not done so in the preceding twelve months. There is no advertising network, data broker or ad-tech supplier involved in this service in any way.

The numbers below are the ones the system actually enforces, and they match the retention clause in the Terms of Service. Where nothing is deleted on a schedule today, the table says so rather than quoting a comfortable number we do not keep to.

Deleting your account is the main lever you have here. It is available at Settings › Account, it needs your password, and it takes effect immediately: you are signed out and the account stops working. For 30 days it can be brought back — trying to register again with the same email address sends a restore link to that address. After 30 days the account, its fax records, its received faxes, its payment records, its dedicated numbers, its contacts, its referral invitations, its upload records, its transmission logs and every stored document file are permanently deleted.

Six things deliberately outlive a deleted account, and the table above says so row by row: the minimal record of the deletion itself; any executed Business Associate Agreement, which HIPAA requires us to retain; any signed letter of authorization for a number transfer, which is the record that you authorized it; your support tickets, which we do not delete automatically; any review you submitted, which was never attached to the account; and the security and audit records, which survive with the link to your account removed. If you want any of the deletable ones gone sooner, or the tickets and reviews gone at all, email [email protected] and we will do it by hand.

Business accounts work differently. The faxes, received faxes, fax numbers, payments and support tickets of a business belong to the business rather than to the person who created them, so they are not deleted when that person leaves the business or their login is deleted: they stay with the business, and if the login is deleted they pass to the business’s owner. A login in a business account cannot be deleted by its holder at Settings › Account; the owner or a manager removes it. When a business account is closed, its records are kept as the business’s records, and the document files in them are still deleted when their retention period ends. The owner can ask us at [email protected] to delete a closed business’s records, apart from anything the law requires us to keep.

One thing deletion does not do on its own: if you still have a dedicated fax number, releasing it is a separate step at Inbox › your number. Release it before you delete the account so that billing and the number itself are cleanly ended.

And one limit worth saying plainly: you cannot delete an individual fax you have already sent before its 365 days are up. You can cancel a fax that has not gone out yet, and you can delete a received fax at any time. If you need a sent document removed sooner, email [email protected] and we will do it by hand.

Documents you send and receive are stored encrypted at rest with AES-256 (AES-256-GCM), under a key held separately from the database, and are access-controlled so that a file can only be reached by the account that owns it. At-rest encryption was switched on for this service on 20 August 2026. Everything uploaded since then is stored encrypted.

We should be precise about the part that is not finished, because a blanket claim here would be wrong. When we converted the documents that were already on disk when encryption was turned on, the conversion job walked the primary document of each fax and missed the additional attachments on faxes that were sent with more than one file. A small number of those older attachments are therefore still stored unencrypted, and we are converting them. They are still access-controlled and still behind the same account checks as everything else, and no document uploaded after 20 August 2026 is affected. If you want to know whether a specific fax of yours is one of them, email [email protected] and we will tell you.

Traffic between your browser and HelpMeFax, and between HelpMeFax and the carrier that transmits your fax, is encrypted with TLS 1.2 or better. The IP-address lookup described in section 6 is made over HTTPS too. Every transmission is logged: who sent what, when, where it went and whether it landed, kept in your fax history for every fax.

Alongside that: passwords are stored only as hashes; optional two-factor authentication; further sign-in attempts are blocked after five failed attempts for the same email address from the same internet address within 15 minutes, for 15 minutes; every upload is scanned for malware; every upload is tied to the account that made it, which is what stops one customer reaching another’s file; and administrator actions are recorded permanently.

Two honest limits. The final leg of any fax is the public telephone network, which is not encrypted — that is true of every fax service and of every fax machine, and it is why a fax is only as private as the machine at the other end. And no system is perfectly secure: we cannot guarantee that the service will never be compromised, only that we have built it carefully and will tell you quickly if something goes wrong.

Most of what people want is a button in the product rather than a letter to us. Here is what you can do yourself, today:

• See your data. Fax history and each sent document, your received faxes, your credit and payment history, your sign-in activity with IP and approximate location, your active sessions, your trusted devices and your support tickets are all visible in the product.
• Correct it. Name, email address and phone number at Settings › Profile; changing your email needs your current password and re-verification, and we notify the old address. Contacts are fully editable.
• Delete it. Your account at Settings › Account, as described in section 7, unless it is a login in a business account, which the business’s owner or a manager removes. Any received fax from your inbox; in a business account, its owner and managers delete the business’s received faxes. Any contact. Any support ticket, by asking us.
• Withdraw consent, or object. Remove your saved card at Settings › Billing, which also switches off automatic top-up, and remove a trusted device at Settings › Security — those two are consent. Turning off marketing email at Settings › Notifications is an objection rather than a withdrawal of consent, for the reason section 5 gives; it has the same effect. You can also switch it off from the one-click unsubscribe link in our notification emails.
• Cut off access. End any session, sign out every other device, remove a trusted device, change your password, or switch two-factor authentication on or off.

These need an email to [email protected], because there is no button for them yet:

• A copy of your data in a portable format. There is no export feature in the product today. Ask and we will assemble a machine-readable copy of your account data and fax records by hand.
• Objecting to or restricting a particular use, including our security and attribution logging.
• Deleting a sent fax before its retention period ends, or deleting a support ticket.
• Anything submitted by an authorized agent on your behalf, or an appeal if we refuse a request.

How we handle a request. Write to [email protected] from the email address on the account, or tell us enough to identify the account; if we cannot reasonably verify that the request is yours, we will ask for more information and, failing that, we will refuse it rather than risk giving your data to someone else. We acknowledge requests promptly and will complete them within 45 days — or within one month if UK or EU law applies — and we will tell you before the deadline if a request is complex enough to need longer. There is no charge, and we will never give you a worse price, a worse service or a worse product because you exercised a privacy right.

Where we have to say no, we will say why. The main case is a record the law requires us to keep, such as an executed Business Associate Agreement.

This section is for California residents and uses the vocabulary of the California Consumer Privacy Act as amended. It describes the same practices as the rest of this policy.

Categories of personal information we have collected in the past twelve months: identifiers (name, email address, phone number, account identifier, IP address); customer records and commercial information (payment and transaction records, account balance, what you purchased); internet and network activity (sign-in records, pages requested, upload records, browser identification); approximate geolocation derived from an IP address at city level; professional information where you give it (entity name, job title on a BAA or a review, and your organization’s details and your role in a business account); audio, electronic or similar information in the form of the documents you send and receive and the signature image on a BAA; and inferences, only in the limited sense of which marketing source a signup came from.

Sources: you, directly; your device and browser as you use the site; our payment processor and our carrier, which return transaction and delivery outcomes; for a received fax, the person who faxed you; and, for a business account, the business that invited you, which gives us your email address.

Business purposes: those listed in section 4 — providing the service, transmitting faxes, billing, notifications, support, security and fraud prevention, accountability and legal compliance.

Categories disclosed for a business purpose in the past twelve months: identifiers and commercial information to the payment processor; identifiers and the documents themselves to the carrier; identifiers and message content to the email delivery provider; IP address alone to the IP-address lookup service; and, from your browser rather than from our servers, IP address and browser identification to the font service on every page load and to the bot-mitigation provider on our public forms. Each is described in section 6.

Sensitive personal information. Account credentials and the contents of documents you fax can constitute sensitive personal information, and a faxed document may contain health information. We use it only to provide the service you asked for, to secure it and as otherwise permitted without a right to limit under the statute. We do not use or disclose sensitive personal information to infer characteristics about you.

Do not sell or share my personal information. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing for you to opt out of. We have not sold or shared personal information, including the personal information of anyone under 16, in the preceding twelve months.

Your rights to know, to access, to delete, to correct, to limit the use of sensitive personal information and to be free from retaliation are exercised as described in section 9. An authorized agent may submit a request on your behalf by writing to [email protected] with written permission signed by you; we may still contact you to confirm it. You may also reach us by post or telephone using the details in section 19.

If you are in the United Kingdom or the European Economic Area, you have the right to ask for access to your personal data, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where consent is the basis. Section 9 says how to do each, and section 5 lists the legal basis for each purpose.

International transfer. HelpMeFax LLC is a United States company and the service runs on servers in the United States, so using it means your personal data is transferred to and stored in the United States. Our suppliers are described in section 6. Where personal data is transferred out of the United Kingdom or the European Economic Area to us or to a supplier on our behalf, that transfer is made under the European Commission’s Standard Contractual Clauses and, for the UK, the UK International Data Transfer Addendum, unless another lawful mechanism applies. Ask us and we will describe the mechanism in force for a particular transfer.

Complaints. If you think we have handled your data badly, please tell us first at [email protected] — most problems are a misunderstanding and we would rather fix it. You also have the right to lodge a complaint with your national data protection authority, or with the Information Commissioner’s Office in the United Kingdom, and you do not have to come to us first.

Faxing is still how a great deal of healthcare information moves, so this needs to be exact.

When a HIPAA covered entity or business associate uses HelpMeFax to transmit protected health information, HelpMeFax LLC acts as a business associate of that customer. That status follows from what we are doing with the information — under 45 C.F.R. § 160.103 it attaches to the function, not to the paperwork — so we do not claim that the absence of a signed agreement leaves us without obligations. What the written Business Associate Agreement does is set the terms of that relationship: permitted uses and disclosures, safeguards, subcontractors, breach reporting, your right to an accounting, and what happens to PHI when the agreement ends. HIPAA requires it to be in place before PHI is disclosed to us, and we require it too.

Do not send protected health information through HelpMeFax until a Business Associate Agreement between you and HelpMeFax LLC has been executed.

Getting one costs nothing and does not require a sales call. Go to the BAA page, verify your email address, read the agreement, sign it online, and a person at HelpMeFax countersigns it. You receive the signed PDF by email. We countersign by hand deliberately — it is a contract, and a human should look at it — so we do not promise a turnaround time.

Where an executed BAA exists, it governs protected health information and takes precedence over this Privacy Policy to the extent the two differ. In particular the BAA sets our obligations on permitted uses and disclosures, safeguards, subcontractors, breach reporting, and what happens to PHI when the agreement ends. Nothing in this policy limits a right you have under the BAA, and nothing in this policy should be read as permission to use PHI for a purpose the BAA does not allow.

Two practical notes. An executed BAA is retained for at least six years, as section 7 explains, and cannot be deleted on request. And a personal account is one login with one audit trail, so if several people at your practice send or receive faxes, use a business account: each person signs in with their own login, every fax records who sent it, the owner and managers see the business audit log, and one BAA, signed by the owner or a manager, covers everyone in the business.

There is no analytics product, no tag manager and no advertising pixel anywhere on this site, so there is nothing here that follows you to another site. That is also why you are not being asked to dismiss a consent banner. Five cookies exist, all set by helpmefax.com itself:

• The session cookie. Keeps you signed in. It expires after 120 minutes of inactivity, cannot be read by page scripts, and is limited to this site. Strictly necessary.
• XSRF-TOKEN. A security token that stops another site submitting a form as you. Strictly necessary.
• remember_web. Set only if you tick “keep me signed in on this device” when you sign in, and it is what signs you back in automatically after the 120-minute session cookie has expired. It holds a random token tied to your account, not your password, and it lasts 400 days — far longer than the session cookie, which is the point of it. Leave the box unticked and it is never set. Signing out deletes it and invalidates the token, and changing your password invalidates it on every device.
• tz. Holds your browser’s timezone name, for example America/New_York, so that we can show times in your own timezone instead of UTC. It lasts 365 days, it is set on every visit including anonymous visits to public pages like this one, and the value is never stored on our servers.
• trusted_device. Set only if you tick “trust this device” during a two-factor challenge, so you are not challenged again on that device. It lasts 30 days and you can revoke it at Settings › Security.

Your browser also holds one small flag, used once, so the page does not reload itself repeatedly while working out your timezone. We use no other browser storage.

You can block or delete any of these in your browser. Blocking the first two will stop you signing in; blocking the other three only means you are signed out again after 120 minutes, times display in UTC, and you are asked for a two-factor code every time.

One thing to be aware of even though it is not a cookie: the typefaces on this site are loaded from a third-party font service, so your IP address and browser identification reach that service on every page load, before you click anything.

Almost everything we send is transactional — it tells you something happened. Delivery and failure notices, scheduled and still-trying notices, received-fax alerts, low-balance and card-expiry warnings, automatic top-up outcomes, receipts and refunds, dedicated-number renewal and cancellation notices, sign-in alerts, verification and password emails, two-factor codes, support ticket replies, and BAA correspondence.

A business account adds business notices: an invitation to join, someone joining or being removed, new-fax alerts for the business’s numbers, whose recipients the owner and managers choose, and, for owners and managers, the business’s balance, its number renewals and replies on its support tickets.

Six of these can be switched off at Settings › Notifications: fax sent, fax delivered, fax failed, low balance, sign-in alerts, and marketing. The rest cannot be switched off, because they concern your money, your security or a contract: verification, password changes, two-factor codes, email-address changes, refunds, overdue-balance notices, automatic top-up outcomes, dedicated-number renewal and cancellation, and support and BAA messages.

Three emails are marketing-class rather than transactional, and we would rather list all three than round down. There is no newsletter.

• A request to leave a review. It is sent once after your first delivered fax, and after that at most once every three months, only if you have sent a fax since the last request, and never once you have left a review. It is controlled by the marketing toggle at Settings › Notifications and is not sent if you have switched it off.
• An invitation to turn on automatic top-up. A paying customer who has used the service in the last twelve months may receive it at most three times, at least two months apart, and not until seven days after their first payment. It stops as soon as automatic top-up is on, it is not sent to people in a business account, and it is not sent if you have switched the marketing toggle off. The review request and this invitation are never sent within seven days of each other.
• A message after your first successful fax. It confirms the fax was delivered, which is why it was built as a transactional notice — but it also suggests saving contacts, buying a subscription and adding a dedicated number, which makes it promotional, so we count it here. It is sent once per account, and not at all if you have switched the marketing toggle off. The delivery itself is still confirmed by the ordinary delivery notice.

Be aware that new accounts are created with the marketing toggle already switched on. You can switch it off at any time. Section 5 explains why we do not describe that default as your consent.

Our notification emails carry a one-click unsubscribe link. It switches off marketing-class email without your having to sign in. Emails about your own faxes, payments and account keep coming, because those are the ones you need. The individual switches are at Settings › Notifications, and if you would rather just tell us, email [email protected] and we will set it for you.

HelpMeFax is a service for adults and for businesses. It is not directed to children, and we do not knowingly collect personal information from anyone under 13. If you believe a child has given us personal information, email [email protected] and we will delete it. If you are in the United Kingdom or the European Economic Area, note that the age at which a child can consent on their own account is higher, between 13 and 16 depending on the country; we do not knowingly collect information from anyone below it.

If personal information in our care is subject to a breach of security, we will investigate it, take steps to contain it, and notify affected customers without unreasonable delay once we know enough for the notice to be useful, and in any event within the time the applicable law allows. The notice will say what happened, what information was involved, what we have done and what we suggest you do.

Where the information is protected health information and we are acting as your business associate, we will notify you rather than your patients, as HIPAA requires of a business associate (45 C.F.R. § 164.410), and no later than 60 days after discovery — sooner in practice, and on whatever shorter timetable your Business Associate Agreement sets. Where a state breach statute or UK or EU law applies, we will also make the notifications it requires, including to the relevant authority.

We do not profile you, we do not score you, and we make no automated decision that produces a legal effect or similarly significant effect on you.

The service does apply some fixed automatic rules, and you should know what they are: further sign-in attempts are refused for 15 minutes once five attempts have failed for the same email address from the same internet address within a rolling 15 minutes — the rule is keyed to the combination of the two, so someone else guessing at your email address from their own connection cannot lock you out of your own; an upload is refused if it is the wrong type, over 25 MB or over the page limit; a contact-form or review submission can be blocked by a spam filter; an incoming fax is refused if it is over 100 pages or your balance is too low to cover it; a destination number on our blocked list is refused; and an automatic top-up runs when your balance falls below the threshold you set. These are rules, not judgments about you, and a person will review any of them if you ask at [email protected].

We will update this policy when the service changes or when we find something in it that is not accurate. Every version carries a “Last updated” date at the top of the page, and a summary of what changed. If a change materially affects how we handle your personal information, we will tell account holders by email before it takes effect, or as soon as we reasonably can.

We will not apply a materially different use to information we already hold without telling you first. If you would like a copy of a previous version of this policy, ask us and we will send it.

A person reads all of these.

• Privacy questions and rights requests: [email protected]
• Everything else: [email protected], or the contact form
• Telephone: +1 252-432-3325, Monday to Friday, 9am to 5pm Eastern
• Post: HelpMeFax LLC, 110 S Massey St, Suite #204, Selma, NC 27576, United States

If you need this policy in an accessible format, or read out to you over the phone, say so and we will arrange it.