Privacy Policy

This Privacy Policy explains how Contractive LLC ("Contractive," "we," "us," or "our") collects, uses, discloses, and protects information when you use our website at www.contractive.app, related account and download services, and the Contractive Core desktop application (collectively, the "Services"). It also explains important differences between information handled by our website and contract content processed locally by Core.

Information we collect

Account and identity information

When you sign in with Microsoft or Google, we receive information made available through the authentication flow, such as your name, email address, profile image, provider identifier, Contractive user identifier, and session or authentication information. We also maintain account status, access level, entitlement status, and entitlement expiration information.

Contact and business communications

If you submit a pilot request or contact form, we collect the name, email address, organization, and message you provide. Please do not paste contracts, privileged material, or sensitive personal information into website forms or ordinary email.

Billing information, where enabled

Stripe billing is not part of Core's local contract-processing workflow. If Contractive enables a Stripe checkout or otherwise uses Stripe for your purchase, Stripe collects payment-method and billing details. Contractive may receive your name, email, Stripe customer and subscription identifiers, transaction and subscription status, and access period, but does not receive your full payment-card number. Core does not send payment information to Stripe.

Website, device, and network information

Our hosting and security providers may process IP address, request headers, timestamps, requested pages, device and browser information, and diagnostic or security logs. Vercel Web Analytics provides aggregated website statistics such as page or route, referrer, approximate location, browser, operating system, device type, and timestamp. We do not use website analytics for cross-site tracking or targeted advertising.

Legal acceptance records

When you accept our legal terms, we record your Contractive user identifier, email address, the Terms and Privacy Policy versions, acceptance timestamp and method, and user-agent information. We may also record the IP address presented with the request. We use this information to document consent, administer access, enforce our agreements, and comply with law.

Information stored by Core on your device

Core stores analysis history, uploaded source documents, extracted text, clause chats, settings, rulebooks, authentication and entitlement state, model files, local logs, update files, and related application data on your device. The analysis database is encrypted, and database keys and persisted authentication data are protected using supported operating-system secure storage. Model files, logs, caches, and exported files may instead rely on your operating system, filesystem permissions, and device encryption.

How we use information

• Authenticate users, maintain sessions, and verify licenses and entitlements.
• Present current legal terms and record versioned acceptance or acknowledgement.
• Provide downloads, updates, support, pilots, subscriptions, and requested Services.
• Respond to inquiries and communicate about accounts, security, policies, and transactions.
• Operate, secure, troubleshoot, and improve our website and Services.
• Detect, prevent, and investigate fraud, abuse, unauthorized access, and security incidents.
• Enforce our agreements and comply with legal, tax, accounting, and regulatory obligations.

Legal bases for processing

Where applicable law requires a legal basis, we process personal information as necessary to perform a contract with you or take steps at your request; for our legitimate interests in providing, securing, and improving the Services; with your consent; and as necessary to comply with law. You may withdraw consent where processing depends on consent, without affecting earlier lawful processing.

How we disclose information

We may disclose relevant information to:

• Supabase for authentication, account records, entitlements, and protected model-download requests.
• Microsoft or Google when you choose the corresponding sign-in option.
• Vercel for website hosting, delivery, security, and aggregated web analytics.
• Resend for delivery of contact-form messages and related email.
• Stripe for billing and payment processing only where a Stripe-supported purchase is enabled.
• Cloud storage and download providers for signed model or application distribution.
• Professional advisers, auditors, insurers, and authorities where reasonably necessary or required by law.
• A buyer, successor, or participant in a merger, financing, reorganization, or sale of all or part of our business.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not use contract content to train cloud models or advertise to you.

Cookies and similar technologies

We use cookies or local browser storage that are necessary for authentication, session continuity, security, and user-interface preferences. Vercel Web Analytics is configured as a privacy-focused, aggregated analytics service and does not use third-party analytics cookies. Your browser may let you block or delete cookies, but doing so may prevent sign-in or other account functions from working.

Data retention and deletion

• Account, entitlement, support, and transaction records are retained for as long as reasonably necessary to provide the Services, administer our relationship, comply with law, resolve disputes, and enforce agreements.
• Legal acceptance records are retained as evidence of the agreement and for compliance, dispute, and enforcement purposes, including after account closure where reasonably necessary.
• Contact-form submissions and related correspondence are retained according to support, sales, security, and business-record needs.
• Core's contract content and analysis remain on your device until you delete individual reviews, use Settings to delete all application-managed local data, or remove the applicable data yourself. Ordinary uninstall may not remove all application data. Files you exported outside Core's data directory and administrator-managed policy files remain under your control.
• We may retain information longer when required by law, needed for security or fraud prevention, or preserved in restricted backups until those backups cycle out.

Security

We use administrative, technical, and organizational safeguards designed to protect information. Core's current design includes an encrypted local analysis database, operating-system protection for sensitive local keys and persisted authentication state, authenticated model access, integrity checks for model downloads, and HTTPS for external application connections. No transmission or storage method is completely secure, and we cannot guarantee absolute security. You are responsible for securing your device, account, local files, backups, and exported reports.

Your privacy rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a portable copy of personal information; to object to or restrict certain processing; to withdraw consent; and to appeal a refusal of a request. You may also have the right to use an authorized agent and to receive equal service without unlawful discrimination for exercising a privacy right.

We do not sell personal information or share it for cross-context behavioral advertising, so there is no sale or targeted-advertising opt-out needed for our current practices. To submit a request, contact us at the address below. We may need to verify your identity and may retain information permitted by law.

International processing

Contractive and our providers may process website, account, contact, and billing information in the United States and other countries where they operate. Those countries may have different data-protection laws. The transfer and processing are subject to applicable law and the contractual terms of the relevant provider.

Children

The Services are intended for business and professional users and are not directed to children under 18. We do not knowingly collect personal information from children. Contact us if you believe a child has provided personal information to us.

Changes to this policy

We may update this Privacy Policy to reflect changes to the Services, our practices, or applicable law. We will post the updated policy here and revise the date above. If changes are material, we may provide additional notice where appropriate or required.

Contact

To ask a privacy question or exercise a privacy right, email [email protected]. You may also contact us through the contact form on this website.