Privacy Policy

Last updated: March 17, 2026

1. Information We Collect

1.1 Account Information

When you create an account, we collect: your email address, your name (optional), and your password (stored as a hashed value — we never store plaintext passwords). If you sign up via Google OAuth, we receive your name and email from Google. We do not receive or store your Google password.

1.2 Payment Information

When you make a purchase, payment is processed by Stripe, Inc. We receive and store: your Stripe customer ID, the transaction amount, date, and product type. We do NOT receive or store your credit card number, expiration date, or CVV. This information is held exclusively by Stripe in accordance with PCI-DSS standards. For Stripe's privacy practices, see stripe.com/privacy.

1.3 Documents You Upload

When you upload a contract for analysis, we receive the document file (PDF, image, or text). We extract text from the document for AI processing. We store the original document in encrypted cloud storage for up to 30 days (see Section 4 on Retention). We store the analysis results (the plain-English breakdown, flags, and suggestions) in your account.

We understand that contracts contain highly sensitive information — salary figures, personal details, proprietary business terms, and more. We treat uploaded documents with the highest level of care.

1.4 Usage Data

We automatically collect: pages visited, features used, analysis completion rates, device type and browser, IP address (used for security and approximate location for analytics), and referring URL. This data is collected through server logs and privacy-respecting analytics. We do not use invasive third-party tracking pixels or sell usage data to advertisers.

1.5 Waitlist Information

If you join our waitlist, we collect your email address solely to notify you when the Service launches. We do not share waitlist emails with third parties.

2. How We Use Your Information

We use the information we collect to:

Provide the Service: Process your uploaded documents, generate AI analyses, and deliver results to you. Process payments: Complete purchases and manage subscriptions through Stripe. Improve the Service: Analyze aggregate usage patterns (not individual documents) to improve the analysis quality and user experience. Communicate with you: Send account-related emails (receipts, subscription changes, security alerts) and, if you opt in, product updates. Maintain security: Detect and prevent fraud, abuse, and unauthorized access. Comply with law: Respond to lawful requests from government authorities when required.

3. How We Process Your Documents

This section describes exactly what happens to your documents when you upload them. We believe in full transparency about our data pipeline.

3.1 Upload and Storage

Your document is transmitted via HTTPS (TLS 1.2+) and stored in Supabase Storage with encryption at rest. Access to stored documents is restricted by Row Level Security (RLS) policies — only your authenticated account can access your documents.

3.2 Text Extraction

Text is extracted from your document on our server using pdf-parse (for digital PDFs) or Claude Vision / Tesseract OCR (for scanned documents and photos). The extracted text is stored alongside the original document in your account.

3.3 AI Analysis

The extracted text is sent to the Anthropic API (Claude) for analysis. We want to be transparent about this: your document text is sent to a third-party AI provider for processing. Anthropic's API data policy states that data sent through the API is not used to train their AI models. We use the standard Anthropic API, not the consumer Claude.ai product. For Anthropic's full API data policy, visit anthropic.com/policies.

3.4 Results Storage

The structured analysis output (clause breakdown, flags, negotiation suggestions) is stored in our Supabase database, associated with your account. This data persists for as long as your account is active.

4. Data Retention and Deletion

4.1 Document Auto-Deletion

Original uploaded documents (PDFs, images, extracted text) are automatically and permanently deleted from our storage 30 days after upload. This deletion is irreversible. We do not retain copies, backups, or archives of deleted documents.

4.2 Analysis Retention

Analysis results (the plain-English breakdown, flags, and suggestions — without the original document text) are retained in your account for as long as your account is active. You may delete individual analyses at any time through your dashboard.

4.3 Account Deletion

You may request complete account deletion at any time by emailing support@clauseboard.ai. Upon account deletion, we will permanently delete: your account profile, all uploaded documents (if any remain within the 30-day window), all analysis results, and all associated metadata. We will process deletion requests within 48 hours. Certain information may be retained as required by law (e.g., payment records for tax compliance) for up to 7 years.

4.4 Immediate Deletion

You may request immediate deletion of any specific document or analysis before the 30-day auto-deletion window by contacting support@clauseboard.ai.

5. Third-Party Services

We use the following third-party services to operate ClauseBoard.ai:

We do not sell, rent, or share your personal information or document content with advertisers, data brokers, or any parties not listed above. The third-party services listed are used solely to operate ClauseBoard.ai.

6. Data Security

We implement the following security measures to protect your data:

All data transmitted between your browser and our servers is encrypted via HTTPS (TLS 1.2+). Uploaded documents are encrypted at rest in Supabase Storage. Database access is protected by Row Level Security (RLS) policies ensuring users can only access their own data. Passwords are hashed using bcrypt — we never store plaintext passwords. API keys and secrets are stored in Vercel environment variables, never in source code. Our codebase is maintained in a private GitHub repository.

While we take extensive measures to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

7. Your Rights

7.1 California Residents (CCPA)

If you are a California resident, you have the right to: know what personal information we collect about you and how it is used, request deletion of your personal information, opt out of the sale of your personal information (we do not sell personal information), and not be discriminated against for exercising your privacy rights. To exercise these rights, email support@clauseboard.ai with the subject line "CCPA Request."

7.2 European Residents (GDPR)

If you are located in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR), including: the right to access your personal data, the right to rectification of inaccurate data, the right to erasure ("right to be forgotten"), the right to restrict processing, the right to data portability, and the right to object to processing. Our lawful basis for processing is: consent (when you create an account and upload documents), contract performance (to provide the Service you requested), and legitimate interests (to improve and secure the Service). To exercise your GDPR rights, email support@clauseboard.ai with the subject line "GDPR Request."

7.3 All Users

Regardless of your location, you may: access and download your analysis results at any time through your dashboard, request deletion of your account and all associated data, opt out of marketing communications by clicking the unsubscribe link in any email, and update your account information through your dashboard.

8. Cookies

ClauseBoard.ai uses essential cookies only: an authentication session cookie (required to keep you logged in) and a locale preference cookie (if applicable for language selection). We do not use advertising cookies, tracking cookies, or third-party analytics cookies that identify individual users. We may use privacy-respecting analytics (such as server-side analytics or Plausible) that do not use cookies or track individual users.

9. Children's Privacy

ClauseBoard.ai is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, please contact support@clauseboard.ai.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if you have an account) and update the "Last updated" date at the top of this page. Your continued use of the Service after changes are posted constitutes acceptance of the revised Privacy Policy.

11. Contact

If you have questions about this Privacy Policy or your personal data, contact us at:

Digital Holdings LLC
Inglewood, CA
Email: support@clauseboard.ai
Privacy inquiries: privacy@clauseboard.ai