Privacy Policy

1. Introduction

ContractLab ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our contract analysis platform.

2. Information We Collect

Personal Information

We collect the following personal information:

• Account Information: Name, email address, company name, job title
• Profile Data: Profile picture, bio, department, phone number
• Billing Information: Payment card details (processed securely through Stripe)
• Usage Data: IP address, browser type, device information, pages visited

Contract Data

We process contract documents you upload, including:

• Contract text and metadata
• Analysis results and risk assessments
• Review records, redline decisions, negotiation strategy, and approval history
• Comments, annotations, and collaboration data
• File attachments and supporting documents

Automatically Collected Information

We automatically collect certain information when you use our service:

• Log Data: API requests, timestamps, response codes
• Cookies: Session cookies, preference cookies, analytics cookies
• Analytics Data: Feature usage, performance metrics, error logs

3. Privileged and Confidential Review Content

If you mark a contract as a privileged matter, ContractLab treats the uploaded contract, review record, risks, redline decisions, negotiation strategy, comments, and approval history as potentially privileged legal work product. Access remains limited to authorised workspace users and assigned reviewers under the app's access controls.

AI processing of privileged matters is used only to provide the requested contract review features. Privileged content is not sold, not used for marketing, and is not exposed to unauthorised third parties or used for external model training.

4. How We Use Your Information

We use your information to:

• Provide Services: Process contracts, generate AI analysis, manage your account
• Improve Platform: Enhance AI models, fix bugs, develop new features
• Communications: Send service updates, security alerts, marketing (with consent)
• Security: Detect fraud, prevent abuse, ensure platform security
• Compliance: Meet legal obligations, respond to legal requests
• Analytics: Understand usage patterns, measure performance

5. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), we process your data based on:

• Contract Performance: To provide services you requested
• Legitimate Interests: To improve our platform, prevent fraud
• Legal Obligation: To comply with laws and regulations
• Consent: For marketing communications (you can withdraw anytime)

6. Data Sharing and Disclosure

We DO NOT Sell Your Data

We will never sell your personal information or contract data to third parties.

We Share Data With:

• Service Providers: Cloud hosting (Base44), payment processing (Stripe), email delivery
• AI Processing Providers: AI processing is used only to deliver requested contract analysis features and is not used for external model training
• Team Members: Other users in your organization (per access controls)
• Legal Requirements: Law enforcement, courts (only when legally required)
• Business Transfers: In case of merger, acquisition, or sale (users notified)

7. Data Security

We implement industry-standard security measures:

• Encryption: TLS/SSL for data in transit, encryption at rest
• Access Controls: Role-based permissions, two-factor authentication
• Monitoring: 24/7 security monitoring, intrusion detection
• Audits: Regular security audits, penetration testing
• Compliance: SOC 2 Type II, GDPR, CCPA compliant practices

8. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Specific retention periods:

• Account Data: Until account deletion + 30 days backup period
• Contract Data: Until you delete + 30 days backup period
• Audit Logs: 1 year for security/compliance
• Billing Records: 7 years (legal requirement)

9. Your Rights

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate information
• Deletion: Request deletion of your data ("right to be forgotten")
• Portability: Export your data in machine-readable format
• Restriction: Limit how we process your data
• Object: Object to processing for marketing/legitimate interests
• Withdraw Consent: For consent-based processing

To exercise these rights, go to Settings → Privacy → Data Management, or contact us at support@contractlab.dev

10. Cookies and Tracking

We use cookies for:

• Essential Cookies: Authentication, security (cannot be disabled)
• Functional Cookies: Remember preferences, language settings
• Analytics Cookies: Usage statistics, performance monitoring
• Marketing Cookies: Advertising (only with consent)

You can manage cookie preferences via our cookie consent banner or browser settings.

11. Children's Privacy

Our service is not intended for users under 18. We do not knowingly collect data from children. If we learn we have collected a child's data, we will delete it immediately.

12. International Data Transfers

Your data may be transferred to and processed in countries outside your residence. We ensure adequate protection through:

• Standard Contractual Clauses (EU-approved)
• Adequacy decisions by regulatory authorities
• Service providers certified under relevant frameworks

13. California Privacy Rights (CCPA)

California residents have additional rights:

• Know: What personal information we collect and why
• Delete: Request deletion of your information
• Opt-Out: From sale of personal information (we don't sell data)
• Non-Discrimination: Equal service regardless of privacy choices

14. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or platform notification at least 30 days before changes take effect.

15. Contact Us