Privacy & Data Policy

What we collect

• Email address — used for account login and billing receipts.
• Billing information — handled entirely by Payfast. We never see or store your card details.
• Scan metadata — filename, risk score, risk level, and timestamp. This powers your scan history dashboard.

What we never collect

• Document content — the text of your contracts is never written to disk or stored in any database.
• Raw clause text — the report you receive contains AI-generated analysis, not the original contract text.
• Training data — your documents are never used to train AI models.

How processing works

When you upload a contract, here's exactly what happens:

1. 1Your file is received by our server and loaded into memory — it is never written to disk.
2. 2The text is extracted in memory and sent to the Anthropic Claude API for analysis.
3. 3Claude returns a structured risk report. The raw contract text is discarded immediately.
4. 4We store only the analysis result (risk score, identified issues, recommendations) linked to your account.
5. 5The analysis result does not contain your raw contract text — only the AI-generated findings.

Third parties

Data residency

By default, your account data is stored in the US(Supabase US region). EU data residency is available on request — contact us and we'll migrate your account to our EU instance. This is particularly relevant for GDPR compliance.

Data Processing Agreements

If your organisation requires a Data Processing Agreement (DPA) — for example, for GDPR or POPIA compliance — contact us at privacy@clauseguard.co.za. We will provide a signed DPA within 5 business days.