This Privacy Policy describes how Contracts.ai (āContracts.aiā, āweā, āourā, or āusā) collects, uses, and discloses information when you use our website, platform, and services (the āServicesā). We are committed to transparency and to handling personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR).
By using our Services, you agree to the practices described in this Privacy Policy.
1. Who We Are
Contracts.ai is an enterprise software company providing AI-powered contract intelligence solutions.
Roles under applicable law:
- For personal data collected directly (e.g., account registration, website usage), Contracts.ai acts as a data controller (or business under U.S. law).
- For personal data contained in customer-provided content ("Customer Contract Data"), Contracts.ai acts as a data processor (or service provider/processor under U.S. law) on behalf of its customers.
2. Categories of Personal Data We Collect
We collect the following categories of personal data:
A. Identifiers
- Name, email address, phone number
- Account credentials
B. Professional Information
- Company name, title, role
C. Internet or Network Activity
- IP address, device information
- Log data, usage data, interactions with the Services
D. Customer Contract Data
- Contracts and related documents uploaded by customers, which may include names, signatures, and other personal data
E. Inferences
- Insights derived from contract analysis (e.g., risk flags, summaries)
Sources of Data
- Directly from users
- From customer systems and integrations
- Automatically through use of the Services
ā
3. How We Use Personal Data
We use personal data for the following purposes:
- Providing and operating the Services
- Authentication and access control
- Product improvement and analytics
- Customer support and communications
- Security, fraud prevention, and monitoring
- Legal compliance
We do not use Customer Contract Data for advertising or unrelated purposes.
Where required, we rely on lawful bases under GDPR, including contract necessity, legitimate interests, legal obligations, and consent.
4. AI and Automated Processing
We use artificial intelligence and machine learning technologies to analyze contract content and generate outputs such as summaries and risk insights.
- Processing is limited to providing the Services
- Customer Contract Data is not used to train generalized models unless explicitly agreed
- Outputs are intended to support human decision-making
- We do not engage in solely automated decision-making that produces legal or similarly significant effects
5. How We Share Personal Data
We may disclose personal data to the following categories of recipients:
- Cloud hosting and infrastructure providers
- Analytics and monitoring providers
- Customer support tools
- Integration partners authorized by customers
- Legal authorities where required
- Transaction counterparties (e.g., mergers or acquisitions)
We do not sell or share personal data for cross-context behavioral advertising.
6. International Data Transfers
We may transfer personal data outside the EEA. Where we do so, we implement appropriate safeguards, including:
- Standard Contractual Clauses (Module 2 and Module 3)
- Technical safeguards such as encryption and access controls
We use EU-approved Standard Contractual Clauses (SCCs) to ensure that personal data transferred outside the EU is legally protected. These clauses define responsibilities depending on whether the data is transferred directly to a service provider or to a subprocessor.
7. Data Retention
We retain personal data as follows:
- Account data: duration of relationship + up to 3 years
- Usage data: up to 12 months unless required for security
- Customer Contract Data: per customer instructions and agreements
We may retain data longer where required by law or for legal claims.
8. Data Security
We implement appropriate safeguards, including encryption, access controls, and monitoring.
9. Your Privacy Rights (GDPR)
Individuals in the EEA have the right to:
- Access personal data
- Correct inaccurate data
- Delete personal data
- Restrict processing
- Data portability
- Object to processing based on legitimate interests
- Withdraw consent
You also have the right to lodge a complaint with a supervisory authority.
We respond within one (1) month of verified requests.
10. U.S. Privacy Rights (California and Other States)
Depending on your state of residence, you may have the following rights:
- Right to know the categories and specific pieces of personal data collected
- Right to delete personal data
- Right to correct inaccurate personal data
- Right to opt out of the sale or sharing of personal data
- Right to limit the use of sensitive personal information
- Right to non-discrimination for exercising rights
Contracts.ai does not sell or share personal data as defined under California law.
To exercise your rights, contact: hello@contracts.ai
11. Cookies and Tracking
We use cookies and similar technologies. Where required, we obtain consent for non-essential cookies.
12. Childrenās Privacy
Our Services are not directed to individuals under 16.
13. Changes to This Policy
We may update this Privacy Policy from time to time.
14. Contact Us
For questions or requests: hello@contracts.ai
EU Representative / DPO: hello@contracts.ai
