Privacy Policy

1. Introduction

This Privacy Policy describes how ContractExtract ("we," "us," or "our") collects, uses, and protects your information when you use our website and services. By using ContractExtract, you agree to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide

• Documents you upload for analysis (contracts, agreements, etc.)
• Payment information processed through our third-party payment provider (Stripe)
• Any communications you send to us

2.2 Information Collected Automatically

• Request metadata processed by our hosting provider, such as request path, status, IP address, and user agent
• A signed free-tier cookie that contains a random token and month, but no contract or account data

3. How We Use Your Information

• To provide and improve our contract analysis service
• To process payments and manage your account
• To communicate with you about your account or our services
• To ensure the security and integrity of our platform
• To comply with legal obligations

4. Document Handling and AI Processing

We are committed to full transparency about how your uploaded documents are handled. Please read this section carefully.

4.1 How Documents Are Processed

When you upload a contract or document for analysis, the content of that document is transmitted to Anthropic's Claude API for AI-powered analysis. This is the core mechanism that powers our service. Without sending the document to Claude, we cannot generate an analysis.

4.2 Anthropic Does Not Use API Data for Training

Anthropic states that inputs and outputs from its commercial API are not used to train its generative models by default. Its current standard retention period is up to 30 days, with exceptions for legal obligations, policy enforcement, or a different contractual arrangement. You can review Anthropic's privacy commitments at anthropic.com/privacy.

4.3 ContractExtract Storage

ContractExtract does not intentionally write uploaded documents or analysis results to its own database. The server processes the file in memory, transmits it to Anthropic, and returns the result to your browser. Your browser stores the returned result in sessionStorage for the results page. Anthropic and Vercel process data under their own infrastructure and retention terms, so we do not promise zero retention or immediate deletion by every service provider.

4.4 Encrypted Transmission

All data , including your uploaded documents , is transmitted exclusively over encrypted HTTPS connections. Data in transit between your browser and our servers, and between our servers and Anthropic's API, is protected by TLS encryption. We do not transmit document content over unencrypted connections under any circumstances.

5. Third-Party Services

We use the following third-party services:

• Anthropic (Claude AI) , Document content is sent to Anthropic's API for AI analysis. Anthropic does not use API data for model training. See Anthropic's Privacy Policy.
• Stripe , for secure payment processing. Stripe's privacy policy governs payment data handling. We never see or store your full payment card details.
• Vercel , for hosting and infrastructure. Vercel may process request logs including IP addresses per their privacy policy.
• Upstash , for privacy-preserving rate limits and anonymous entitlement counters. Keys are pseudonymous hashes and do not contain document content.

6. Data Security

We implement appropriate technical and organizational measures to protect your information, including TLS encryption for all data in transit, access controls on our infrastructure, and serverless architecture that minimizes data retention. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Data portability
• Withdraw consent at any time

ContractExtract does not intentionally maintain a database copy of uploaded documents or analysis results. Service providers may have limited records under their own retention terms.

8. Cookies and Advertising

We use Secure, HttpOnly cookies for paid, subscription, and free-tier entitlements. The free-tier cookie contains only a signed random token and month. ContractExtract does not currently load third-party analytics or advertising scripts.

The free tier is enforced without an account by combining this cookie with a coarse monthly network limit. Clearing cookies or changing devices can make a visitor appear new, while shared networks can cause unrelated visitors to reach the network limit. This is an intentional privacy tradeoff that avoids collecting identity or contract data.

Advertising will not be enabled unless ContractExtract is approved for an advertising program and an appropriate consent system is in place.

9. Children's Privacy

Our service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you specific rights regarding your personal information. These rights are effective as of January 1, 2026.

Information We Collect

In the past 12 months we have collected the following categories of personal information:

• Identifiers and network data: IP address and request metadata processed for hosting, security, and rate limiting.
• Commercial information: Stripe transaction and subscription identifiers used to verify paid access.
• Document content: Contract content submitted for analysis and transmitted to Anthropic solely to produce the requested result.

Sensitive Personal Information

As of January 1, 2026, California law defines an expanded category of sensitive personal information. Contracts you upload may contain sensitive personal information belonging to third parties (e.g., names, financial terms, health-related clauses). ContractExtract processes this data solely to perform the requested extraction. We do not intentionally save it in our own database, analyze it for advertising, or sell it. Anthropic and Vercel process data under their own retention terms.

Data Minimization

We collect only the minimum personal information necessary to operate this service. Contract documents are processed in memory and are not intentionally persisted to a ContractExtract database. Provider retention is described above.

How We Use Your Information

• To perform contract key-term extraction using AI processing
• To maintain site security, prevent fraud, and enforce rate limits

We do not sell your personal information. We do not use contract content for advertising targeting.

Your Rights as a California Resident

• Right to Know: Request disclosure of personal information collected in the past 12 months.
• Right to Delete: Request deletion of personal information that we are legally required and technically able to delete.
• Right to Correct: Request correction of inaccurate personal information such as account details.
• Right to Opt-Out: Opt out of sharing personal information for advertising. We honor Global Privacy Control (GPC) signals automatically.
• Right to Limit Use of Sensitive Information: Direct us to limit use of sensitive personal information to necessary service functions.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

Do Not Sell or Share My Personal Information

We do not sell personal information. To opt out of sharing for advertising purposes, use a Global Privacy Control (GPC)-enabled browser, or contact us via the Contact page.

How to Submit a Request

Contact us via the Contact page. Response timing depends on the request and applicable law. Identity verification may be required.

Data Retention

ContractExtract does not intentionally store contract documents or analysis results in its own database. Anthropic states that standard API inputs and outputs are generally deleted within 30 days, subject to documented exceptions. Vercel runtime-log availability varies by plan; our application logs only non-sensitive security event names and never document contents, encoded file data, or model output.

12. Google AdSense & Advertising

Google AdSense is not currently enabled on ContractExtract. The publisher ownership metadata may remain present for site verification, but the advertising script is not loaded and ads are not served.

13. Document Privacy

Documents are transmitted to Anthropic solely to generate your analysis. They are not sold or shared for advertising, and ContractExtract does not intentionally save documents or results in its own database. Our application never writes document content, encoded file data, or model output to logs.

14. Maryland Online Data Privacy Act (MODPA)

If the Maryland Online Data Privacy Act applies to your use of ContractExtract, this section describes how to exercise applicable rights.

Your Rights Under MODPA

If you are a resident of Maryland, MODPA grants you the following rights regarding your personal data:

• Right to Know: Request disclosure of what personal data we collect, use, and disclose about you.
• Right to Delete: Request deletion of personal data we have collected.
• Right to Correct: Request correction of inaccurate personal data.
• Right to Data Portability: Receive your personal data in a portable format to transmit to another entity.
• Right to Opt-Out: Direct us not to collect, use, or disclose personal data for purposes of targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects.

How We Honor Global Privacy Control (GPC)

ContractExtract does not currently load advertising or behavioral analytics scripts for any visitor, regardless of GPC status. We also do not sell personal information or use contract content for targeted advertising.

To learn about GPC, visit globalprivacycontrol.org.

Response Timeline

We will respond to verifiable consumer requests within 45 days as required by MODPA. If we cannot fully comply, we will provide a written explanation of the basis for the limitation.

How to Submit a Request

To exercise any of these rights, please contact us via the Contact page. We will verify your identity before processing your request.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us through our website.