Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

When you register for or use the Service, we may collect:

• Account and contact information, including name, email address, phone number, job title, and company name.
• Billing and payment information, processed securely through our payment processor. We do not store full payment card details.
• Contract and document content uploaded to the Platform, including templates, completed contracts, compliance records, and associated metadata.
• Communications you send to us, including support requests, feedback, and correspondence.

1.2 Information Collected Automatically

When you use the Service, we automatically collect certain technical and usage information, including:

• Log data such as IP addresses, browser type, operating system, referring URLs, and pages visited.
• Usage data describing how you interact with the Platform, including features accessed, actions taken, and time spent.
• Device identifiers and session information.
• Cookies and similar tracking technologies as described in Section 6 below.

1.3 Information from Third Parties

We may receive information about you from third-party integrations you authorize, such as identity verification services, single sign-on (SSO) providers, or integration partners connected to your account. We handle such information in accordance with this Privacy Policy.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing and operating the Service, including processing contracts, managing workflows, and enabling compliance tracking.
• Account management, authentication, and customer support.
• Improving and developing the Platform, including analyzing usage patterns and diagnosing technical issues.
• Training and improving artificial intelligence and machine learning features, subject to the limitations described in Section 3 below.
• Communicating with you about your account, updates, and Service-related notices.
• Enforcing our Terms of Service and other agreements.
• Complying with applicable legal obligations and responding to lawful requests from government authorities.
• Protecting the rights, property, and safety of ContractsConnected, our customers, and others.

We do not sell your personal information to third parties.

3. Artificial Intelligence and Machine Learning

ContractsConnected uses artificial intelligence and machine learning technologies to power features within the Platform, including document analysis, compliance automation, and workflow recommendations.

Customer Content and Usage Data may be used to develop, train, or improve these AI/ML features. Where Customer Content is used for such purposes:

• Data is aggregated and de-identified using commercially reasonable, industry-standard methods before use in model training.
• We do not use identifiable Customer Content to train models that are shared with or accessible by other customers.
• AI-generated outputs are provided for informational purposes and may be inaccurate. They are not a substitute for human review and professional judgment.
• Customers may contact us to inquire about AI data handling practices applicable to their account.

4. How We Share Your Information

4.1 Service Providers

We share information with trusted third-party vendors and service providers who assist us in operating the Platform and delivering our services. These include:

• Cloud infrastructure and hosting providers.
• Payment processors.
• Customer support and communication tools.
• Analytics and performance monitoring services.
• Security and fraud prevention providers.

All service providers are contractually required to handle information only as directed by us and in accordance with applicable privacy laws.

4.2 Business Transfers

If ContractsConnected is involved in a merger, acquisition, financing, reorganization, or sale of all or substantially all of its assets, your information may be transferred as part of that transaction. We will notify affected customers via email or a prominent notice on our website prior to any such transfer.

4.3 Legal Requirements

We may disclose information when required to do so by law or in response to valid legal process, including subpoenas, court orders, or government requests. Where permitted, we will notify you of such requests in advance.

4.4 Protection of Rights

We may disclose information when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of ContractsConnected, our customers, or the public; to detect or prevent fraud; or to enforce our agreements.

4.5 With Your Consent

We may share your information for other purposes with your explicit consent.

5. Data Retention

We retain personal information for as long as necessary to provide the Service, fulfill the purposes described in this Privacy Policy, and comply with our legal obligations.

• Account information is retained for the duration of the customer relationship and for a reasonable period thereafter to fulfill legal and contractual obligations.
• Customer Content is retained during the Subscription Period. Upon termination or expiration of a Customer’s agreement, we will delete Customer Content within 60 days upon written request.
• Usage and log data is typically retained for up to 12 months unless a longer retention period is required by law.
• Backup copies of data may be retained for up to 90 days following deletion from active systems.

6. Cookies and Tracking Technologies

We use cookies and similar technologies (such as web beacons and local storage) to operate and improve the Platform. Cookies help us:

• Authenticate users and maintain session state.
• Remember your preferences and settings.
• Analyze usage patterns and measure the effectiveness of our Service.
• Detect and prevent security threats.

You may configure your browser to refuse cookies or alert you when cookies are being sent. Note that disabling cookies may affect the functionality of certain parts of the Service.

7. Data Security

ContractsConnected implements administrative, technical, and physical safeguards designed to protect the information we collect against unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption of data in transit using TLS and at rest using industry-standard encryption.
• Access controls limiting employee access to personal information on a need-to-know basis.
• Regular security assessments and vulnerability monitoring.
• Incident response procedures to address potential data breaches promptly.

No security system is impenetrable. While we take reasonable measures to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your information, we will notify you in accordance with applicable law.

8. Data Subject Rights

Depending on your location and applicable law, you or your authorized Users may have the following rights with respect to personal information we hold:

• Access – The right to request a copy of personal information we hold about you.
• Correction – The right to request correction of inaccurate or incomplete information.
• Deletion – The right to request deletion of your personal information, subject to legal retention obligations.
• Portability – The right to receive your personal information in a structured, machine-readable format.
• Objection – The right to object to certain processing activities, including direct marketing.
• Restriction – The right to request that we restrict processing of your information in certain circumstances.

To exercise any of these rights, please contact us at the address listed in Section 11. We will respond to verified requests within the timeframe required by applicable law. Note that certain rights may be limited where we have a legal basis for retaining or processing your information.

9. International Data Transfers

ContractsConnected is based in the United States. If you are located outside the United States, please be aware that information we collect may be transferred to, processed, and stored in the United States and other countries, which may have different data protection laws than your country of residence.

Where required by applicable law, we will implement appropriate safeguards for international transfers, such as standard contractual clauses or other legally recognized transfer mechanisms.

10. GDPR and California Privacy Rights

10.1 GDPR (EEA and UK Users)

If you are located in the European Economic Area or the United Kingdom, ContractsConnected acts as a data processor with respect to Customer Content and as a data controller with respect to certain account and usage data. Our legal bases for processing include:

• Performance of a contract (to provide the Service).
• Legitimate interests (to improve the Service, ensure security, and prevent fraud).
• Compliance with legal obligations.
• Consent, where explicitly obtained.

Customers that submit personal data governed by GDPR must execute a Data Processing Agreement (DPA) with ContractsConnected prior to submitting such data to the Platform.

10.2 California (CCPA/CPRA)

California residents may have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt out of the sale or sharing of personal information. ContractsConnected does not sell or share personal information as defined by California law.