Document Automation
Gavel Workflows
By practice area
By company size
AI Contract Review
Resources
LearN
Case Studies
Pricing
Updated: August 19, 2025
Documate, Inc. d/b/a Gavel ("Gavel"). (“Gavel”, “we”, “us” and “our”) is committed to protecting the privacy of our website visitors, customers, business partners, and end users through our compliance with this “Privacy Policy.” Throughout this Privacy Policy, we refer to any person accessing or using this Website as “you,” or the “User.”
This Privacy Policy describes the types of information we may collect from you or that you may provide when you visit the website www.gavel.io (our "Website") and our practices for collecting, using, maintaining, protecting and disclosing that information.
This Privacy Policy applies to information we collect:
It does not apply to information collected by:
Please read this Privacy Policy carefully to understand our policies and practices regarding your “Personal Information” (as defined below in “What Information Do We Collect About You?”) and how we will treat it. If you do not agree with our policies and practices, your only choice is not to use our Website. By accessing or using this Website, you agree to this Privacy Policy. This Privacy Policy may change from time to time. Your continued use of this Website after we make changes is deemed to be your acceptance of those changes, so please check the Privacy Policy periodically for updates.
The information we obtain generally consists of information (1) you give us about yourself, (2) you give us about others, (3) automatically collected about your interactions with the Website and our content or ads on third-party websites, apps or other media, and (4) we get from other sources.
When you visit our Website. We may collect information about you, either directly or by third party service providers, when you visit our Website, or about third parties, as follows:
Some information is provided by you, such as:
When you visit our Website, we may also automatically collect information about your device or usage, such as:
We receive information about you from other sources and it may be combined with other information about you. For example, we may obtain data from:
You may give us information about other people when you use our Website. Do not give us information about others unless you are authorized or have their consent to do so. We will use their information for the purposes described in this Privacy Policy.
We do not access any information entered into Gavel workflows, questionnaires, or generated documents except upon your explicit request or disclosure.
You are responsible for the content you provide through the Services. We do not knowingly collect, store, or use protected health information (PHI) as defined under applicable privacy laws, payment card information (though it may be collected by our PCI-compliant payment processor, Stripe), government-issued identification numbers, biometric identifiers, financial account credentials, personal data about individuals under the age of 13, or other categories of sensitive personal data as defined under applicable law.
The technologies we use for automatic data collection on this Website may include the following technologies:
Cookies are small files that a site transfers to your computer’s hard drive through your web browser that enables it to recognize your browser and capture and remember certain information. A cookie cannot read data off of your hard drive or read cookie files created by other sites. Cookies may do things like allow you to navigate faster through the site, remember your preferences, passwords, and generally improve the user experience. You can turn off the ability to receive cookies by adjusting your browser settings — please note that if you do so, this may affect the functionality of the website and the information you can access through it. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Website. Gavel uses cookies to compile aggregate data about Website traffic and interaction so that we can offer better site experiences and content in the future. We use third-party companies, such as Google Analytics, to assist us in understanding our site visitors. We do not share with these third parties any information that would readily identify you (such as email address); however, these third parties may have access to information about your device (such as IP or MAC address). We do not have access to, or control over, the technologies that these third parties may use to collect information about your interests, and the information practices of these third parties are not covered by this Privacy Policy. Other than as discussed in this document, we have no control over these third parties.
Certain features of our Website may use local stored objects (or Flash cookies) to collect and store information about your preferences and navigation to, from and on our Website. Flash cookies are not managed by the same browser settings as are used for browser cookies.
Pages of the Website, and our emails, may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit Gavel to, for example, count users who have visited those pages, or opened an email, and for other related Website statistics (for example, recording the popularity of certain Website content and verifying system and server integrity).
“Do Not Track” is a preference you can set in your browser to let websites you visit know that you do not want them collecting certain information about you. We do not currently respond to, or honor, Do Not Track signals or requests from your browser.
We may use information collected when you visit our Website for the following business purposes:
We may share Personal Information about you with third parties in the following circumstances.
We may provide your information to our channel partners, such as distributors and resellers, to fulfill product and information requests, to effectively deliver unified support, and to provide customers and prospective customers with information about Gavel and its products and services. Such partners are bound by contractual obligations to keep Personal Information confidential and use it only for the purposes for which we disclose it to them.
From time to time, Gavel may engage in joint sales or product promotions with selected business partners. If you purchase or specifically express interest in a jointly-offered product, promotion or service, we may share relevant Personal Information with those partners pursuant to a joint marketing agreement. Please be advised that any such business partners are not considered agents or authorized representatives of Gavel, unless otherwise communicated to you in writing.
We may share your information with third parties, such as vendors, consultants, agents, and other service providers who work on our behalf. Examples include vendors and service providers who provide assistance with marketing, billing, processing credit card payments, data analysis and insight, technical support and customer service. Unless described in this Privacy Policy, we do not share, sell, rent, or trade any of your Personal Information with third parties for their own promotional purposes.
Compliance with laws or any competent law enforcement body, regulatory body, government agency, court or third party: we may disclose information where we believe disclosure is necessary or required (i) by law or regulation, in order to comply with legal process or government requests (including in response to public authorities to meet national security or law enforcement requirements); or (ii) to exercise, establish or defend our legal rights, including but not limited to for the purposes of debt collection or in the course of receiving legal advising.
To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of Gavel’s assets, whether as a going concern or as part of bankruptcy, liquidation or similar proceeding, in which Personal Information held by Gavel about our Website users is among the assets transferred. You acknowledge that such transfers may occur, and that any parties who acquire us may continue to use your Personal Information according to this Privacy Policy.
We may share your Personal Information when it is necessary for other legitimate purposes such as protecting Gavel's confidential and proprietary information or where necessary to support, respond to, and to provide our products and services to our customers. This includes disclosing your Personal Information for any purpose for which you have provided consent. We may disclose aggregated, anonymized, statistical data and/or non-identifying information about our users without restriction.
Gavel maintains (and requires its service providers to maintain) appropriate organizational and technical measures designed to protect secure your information and to protect it against unauthorized or unlawful use and accidental loss or destruction, including:
- Employing physical access controls, encryption, Internet firewalls, intrusion detection and network monitoring depending on the nature of the information and the scope of processing.
- Providing access to your information to the minimum extent necessary, subject to confidentiality restrictions where appropriate, and on an anonymized basis wherever possible.
- Requiring our employees to keep all Personal Information confidential. For more information, please visit https://www.gavel.io/security.
- Any payment transactions will be encrypted using SSL technology. We use Stripe (PCI-DSS compliant) as our payment processor.
- The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Website, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.
The transmission of information via the Internet is not completely secure. Although we do our best to protect your Personal Information, we cannot guarantee the security of your Personal Information transmitted to our Website. Any transmission of Personal Information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Website.
If you would like to update Personal Information that you have provided to us, please log on to https://www.gavel.io and update your profile or send an email to hello@gavel.io.
You can opt-out of receiving marketing communications from Gavel by clicking “unsubscribe” in any marketing email communications we send you, or by sending an email to hello@gavel.io. This opt out does not apply to contact information provided to Gavel as a result of a product or service purchase, or other transactions.
Some content or applications, including payment processing through Stripe, on the Website are served by third-parties. These third parties may use cookies (alone or in conjunction with web beacons or other tracking technologies) to collect information about you when you use our Website. The information they collect may be associated with your Personal Information, or they may collect information, including Personal Information, about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content. We do not control third parties' collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt out of receiving targeted ads from members of the Network Advertising Initiative ("NAI") on the NAI's website. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly. If you are unsure of the responsible provider, please send an email to hello@gavel.io and we will direct you to the responsible provider.
California Civil Code section 1798.83 requires us to disclose to our California customers, upon request, the identity of any third parties to whom we have disclosed Personal Information within the previous calendar year, along with the type of Personal Information disclosed, for the third parties' direct marketing purposes. Please note that under California law, we are only required to respond to a customer request once during any calendar year.
If you are a California resident and would like to make the type of request described above, please contact us at hello@gavel.io.
We comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data transferred from the European Union and the United Kingdom (and Gibraltar, as applicable) to the United States.
Gavel has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. DPF Principles. If there is any conflict between this privacy policy and the DPF Principles, the DPF Principles will govern. To learn more about the DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
Your Rights Under the DPF
Individuals from the EU and the UK have the right to access personal data we hold about them and to request corrections, amendments, or deletion of inaccurate information. To make such requests, please email security@gavel.io. Individuals have the right to opt out of: the disclosure of their personal data to third parties not acting as our agents or uses of their personal data for purposes materially different from those for which it was collected or subsequently authorized, neither of which occurs in the context of the use of Gavel software.
Onward Transfers
Gavel remains responsible under the DPF Principles if third-party agents process personal data in a manner inconsistent with the DPF Principles, unless we prove we are not responsible for the event giving rise to the damage.
Dispute Resolution
In compliance with the EU-U.S. DPF Principles, Gavel commits to resolve complaints about our collection or use of your personal data. EU and UK individuals with inquiries or complaints should first contact Gavel at:
security@gavel.io
Documate, Inc. d/b/a Gavel
453 S. Spring Street, Suite 400-1630
Los Angeles, CA 90013
United States
We retain Personal Information and account data for as long as your account is active or as needed to provide you with our services. When your account is canceled or terminated, we retain your account data for seven (7) days solely to allow for account reactivation. After this period, your account data will be permanently deleted, except where a longer retention period is required by law or necessary for legitimate business purposes such as maintaining backups, complying with audits, or resolving disputes.
Gavel has entered into Zero Data Retention Agreements with AI models we use, including OpenAI. That means none of your data is stored or used to train their AI models. Your information is processed only for your request and then deleted. You and your clients stay in full control of your information.
Our Websites, products, and services are not directed to individuals under the age of 18, or the age of majority wherever a User may be located (collectively, “Minors”). We do not knowingly collect Personal Information from Minors. If you are a Minor, do not use or provide any information on this Website, or on or through any of its features/functionality, make any purchases through the Website, use any of the interactive or public comment features that may be available on this Website, or provide any information about yourself to us, including your name, address, telephone number, or email address. If you become aware that a Minor has provided us with any information, please contact us at hello@gavel.io. If we become aware that a minor has provided us with information through the Website, we will take steps to delete such information.
In order to address our legal obligations in Europe (including the UK), Gavel provides the following additional information for Europe-based visitors to Gavel’s Website.
Depending on your user role, Gavel may be considered either a Data Controller or the Data Processor. If you are a law firm or other professional using Gavel for your commercial use, Gavel may be either or both the Data Controller and the Data Processor, depending on the data being collected and the purpose of collection. However, if you are using Gavel at the request of your legal counsel or another professional, then your legal counsel or respective professional is the Data Controller and Gavel is the Data Processor. The contact details for Gavel are provided in the “How to contact us” section below; please contact us if you have any questions.
We process personal information for different purposes, on the following legal bases:
We and our service providers process your information to perform our contractual obligations to you when we use your information to provide you with the Website and related content, products, or services and to communicate with you. For example:
When you purchase a subscription from us, we process your payment and contact information as necessary to confirm the subscription, and we process your contact information and other details to provide you with services/products/support you request. We also send you informational communications on this basis, including to confirm a subscription or to notify you of a change to the Website. Failure to provide requested information could prevent or delay the fulfillment of our contractual obligations.
We process your information to meet our legitimate interests when we use your information to provide you with the Website and related content, products or services, to communicate with you and for our advertising and marketing purposes. For example, our legitimate interests include making improvements to, customizing, and understanding how you interact with the Website and related content, products or services, and sending you communications about products and services we think may be of interest to you. To accomplish our legitimate interests, we may share your information with our affiliates and subsidiaries, service providers and business partners (including for our advertising and marketing purposes) and in the context of a corporate transaction. We maintain safeguards to protect the information we process to pursue our legitimate interests.
We process and share your information as necessary to comply with our legal obligations or as necessary to protect our rights. For example, we are required to collect certain information from you when processing payments for tax or financial reporting reasons.
We obtain your consent to process your information when we are required to do so by law. If consent is the legal basis on which we process your personal information, you can withdraw your consent at any time by contacting us using the information provided in the “Contact Information” section above.
Type of Data Collected
Possible Source(s) of Data
Basis/Bases for Processing
Who We Share This Data With
Personal contact information, such as your name, postal address, email address, phone number.
Directly from you; from cookies and similar automatic technologies; from third-party sites or apps, content distribution channels and platforms; from third-party business partners; and from social media platforms and similar services.
To perform our contractual obligations to you; to pursue our legitimate interests; to comply with our legal obligations; with your consent.
With service providers and/or business partners; with professional advisors or legal counsel; with government authorities as required by law or as necessary to protect our rights.
Demographic information.
Directly from you; from cookies and similar automatic technologies; from third-party sites or apps, content distribution channels and platforms; from third-party business partners; and from social media platforms and similar services.
To perform our contractual obligations to you; to pursue our legitimate interests; to comply with our legal obligations; with your consent.
With service providers and/or business partners; with advertising and marketing service providers and partners; with content measurement companies; with professional advisors or legal counsel; with government authorities as required by law or as necessary to protect our rights.
Comments, photos, videos, and other user-generated content.
Directly from you.
To perform our contractual obligations to you; to pursue our legitimate interests; to comply with our legal obligations; with your consent.
With service providers and/or business partners; with professional advisors or legal counsel; with government authorities as required by law or as necessary to protect our rights.
Information you provide when you choose to participate in surveys, polls, sweepstakes, contests, or promotions.
Directly from you.
To perform our contractual obligations to you; to pursue our legitimate interests; to comply with our legal obligations; with your consent.
With service providers and/or business partners and partners; with advertising and marketing service providers and partners; with content measurement companies; with social media platforms; with professional advisors or legal counsel; with government authorities as required by law or as necessary to protect our rights.
Transactional and commercial activity information, such as requests, searches, or purchases.
Directly from you; from cookies and similar automatic technologies; from third-party sites or apps, content distribution channels and platforms; and from social media platforms and similar services.
To perform our contractual obligations to you; to pursue our legitimate interests; to comply with our legal obligations; with your consent.
With service providers and/or business partners; with advertising and marketing service providers and partners; with professional advisors or legal counsel; with government authorities as required by law or as necessary to protect our rights.
Event names, browsing activities and clickstream data that reflect the content you have accessed, clicked on, or viewed, or error states.
From cookies and similar automatic technologies.
To perform our contractual obligations to you; to pursue our legitimate interests; to comply with our legal obligations.
With service providers and/or business partners; with advertising and marketing service providers and partners; with content measurement companies; with professional advisors or legal counsel; with government authorities as required by law or as necessary to protect our rights.
Internet protocol (IP) address, tenant URL, and geolocation information.
Directly from you; and from cookies and similar automatic technologies.
To perform our contractual obligations to you; to pursue our legitimate interests; to comply with our legal obligations; with your consent.
With service providers and/or business partners; with advertising and marketing service providers and partners; with content measurement companies; with professional advisors or legal counsel; with government authorities as required by law or as necessary to protect our rights.
Device identifiers and other information about your computer, device, browser and operating system.
From cookies and similar automatic technologies.
To pursue our legitimate interests (such as to ensure that an account is not being used by more than one individual without authorization, or to create new products).
With service providers and/or business partners; with professional advisors or legal counsel; with government authorities as required by law or as necessary to protect our rights.
User role, as either a workflow builder or end-user/client of a workflow builder.
From cookies and similar automatic technologies.
To perform our contractual obligations to you; to pursue our legitimate interests; to comply with our legal obligations.
With service providers and/or business partners; with professional advisors or legal counsel; with government authorities as required by law or as necessary to protect our rights.
Information about your interactions with email messages and other communications.
From cookies and similar automatic technologies.
To perform our contractual obligations to you; to pursue our legitimate interests; to comply with our legal obligations.
With service providers and/or business partners; with advertising and marketing service providers and partners; with content measurement companies; with professional advisors or legal counsel; with government authorities as required by law or as necessary to protect our rights.
Payment information for subscriptions or purchases, such as payment card number, expiration date, and billing information.
From third-party sites or apps, content distribution channels and platforms.
To perform our contractual obligations to you; to pursue our legitimate interests; to comply with our legal obligations; with your consent.
With service providers and/or business partners; with government authorities as required by law or as necessary to protect our rights.
You have the right to be informed about what data is being collected about you and how it will be used. This Privacy Policy serves as our method of informing you about our data collection practices.
You have the right to submit a “data subject access request” or “DSAR” to us in the event that you would like to review the data we hold about you. To do so, please email hello@gavel.io and include your name, email address, and postal address. In most cases, we are required to provide a verified data subject with a copy of their data in an accessible and intelligible format within one (1) month of the request and without charge. If we are able to verify that you are, in fact, a data subject (meaning that we have processed your data), we will also supply information in relation to how your data is processed, who we are sharing your data with, how long you will keep it, and what other rights you may exercise in regard to the data.
You have the right to request correction of inaccurate or incomplete information we hold about you. To do so, please log into your account profile on the Website and navigate to the appropriate settings page to make corrections yourself, or email hello@gavel.io and include your name, email address, and postal address. We will take commercially reasonable efforts to correct inaccurate or incomplete information in response to verified requests. We will respond within one (1) month of receiving your request. Please note: we may not be able to correct some of your data except by deleting your User account.
In some circumstances, you may ask us to erase your data. To do so, please email hello@gavel.io and include your name, email address, and postal address. Please note that we have the right to refuse a request if the information you request to delete is reasonably necessary to help to ensure security and integrity of our Website, to the extent the use of the personal information is reasonably necessary and proportionate for those purposes, or for any other reason allowable under applicable law. In any case, we will respond within one (1) month of receiving your request. Please note: we may not be able to erase some of your data except by also deleting your User account.
In some circumstances, you may ask us to restrict our processing of your data. To do so, please email hello@gavel.io and include your name, email address, and postal address. If exercised, we may store your data, but not process it. Please note that we have the right to refuse a request if, for example, a request is manifestly unfounded or excessive. There may also be other exemptions allowable under applicable law and dependent on the circumstances. In any case, we will respond within one (1) month of receiving your request.
You have the right to request that the Data Controller provide you with your data in a structured, commonly used and machine-readable format, or to have your data transferred to another Data Controller. Please note that this right only applies to personal data that you have provided to us under the legal basis of consent and where our processing is automated. To exercise this right, please see Section 11(A) of this privacy policy. If Gavel is your Data Controller, please email hello@gavel.io and include your name, email address, and postal address. We will respond within one (1) month of receiving your request.
You have the right to object to the processing of your data. Please note that we have the right to refuse a request if we can demonstrate that we have legitimate grounds for continuing the processing. If the processing is necessary to support a legal claim, we may also refuse to honor this right. To exercise this right, please email hello@gavel.io and include your name, email address, postal address, and the specific reasons for the objection. Your request must list specific reasons for the objection, or we will not be required to stop processing your data. In any case, we will respond within one (1) month of receiving your request.
Lastly, you have rights related to automated decision making, including profiling; however, we do not utilize automated decision making at this time.
If you would like to discuss or exercise any of the rights described above, please contact us at hello@gavel.io. We will contact you if we need additional information from you in order to honor your requests.
We only collect information that we absolutely need to carry out the functions described in this Privacy Policy. We will keep your personal information for as long as we have a relationship with you. Once our relationship with you has come to an end, we will retain your personal information for a period of time that enables us to:
We will delete your personal information when it is no longer required for these purposes. If there is any information that we are unable, for technical reasons, to delete from our systems, we will put in place appropriate measures to prevent any further processing or use of the data.
Personal Information, including Personal Information collected in the European Economic Area (“EEA”), Switzerland, and the United Kingdom, may be transferred to, stored, and processed in the United States and other countries whose data protection laws may differ from those of your home country.
When we transfer Personal Information originating from the EEA, Switzerland, or the United Kingdom to third parties, we ensure appropriate safeguards are in place to protect that information, consistent with applicable data protection laws. These safeguards may include:
We acknowledge our responsibility for Personal Information that we transfer to third parties and remain liable under the DPF Principles if those third parties process such information in a manner inconsistent with those Principles, unless we prove we are not responsible for the event giving rise to the damage.
Gavel also commits to cooperate with EEA, Swiss, and UK data protection authorities (DPAs) and comply with their guidance in relation to data transferred in the context of employment or other relevant relationships.
We are committed to working with you to obtain a fair resolution in the event you have a complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to a data protection authority.
Should you wish to report a complaint or if you feel that Gavel has not addressed your concerns in a satisfactory manner, you may contact your region’s Data Protection Authority.
Gavel will review and update this Privacy Policy periodically in response to changing legal, technical and business developments. When we update this Privacy Policy we will note the date of its most recent revision above. If we make material changes to this Privacy Policy, we will take appropriate measures to inform you in a manner that is consistent with the significance of the changes we make and is in accordance with applicable law, either by posting on the homepage or sending an email to the email address on file for registered users. We encourage you to review this Privacy Policy frequently to be informed of how Gavel is protecting your information.
If you have any questions or concerns regarding this Privacy Policy, you may write to us at hello@gavel.io.
