Loading...
Loading...
Effective August 11, 2026
Your file is never written to disk. It is held in memory while we analyze it and sent to our AI provider over an encrypted connection. The extracted contract text and your review are kept for 24 hours so you can reopen the result, then deleted automatically. We do not train on your documents. Anthropic is the only provider your contract is sent to, and it states in its API terms that it does not train on API inputs. We describe their published terms rather than guarantee their behavior. The free tier does not require an account, so for most people we never learn who you are.
The file you upload is processed in memory and is never written to disk on our servers, and we do not keep the file itself. We do keep two things for 24 hours: the text we extract from that file, and the review we generate from it. Both have to exist for you to reopen a finished review or share it, and both are deleted automatically once the 24 hours are up. That is the same 24 hours described below, not a second retention period.
We do not sell your data, and we do not share it with anyone except the AI provider that performs the analysis, described below.
To analyze a contract we have to transmit its text to an AI provider. We use exactly one: Anthropic (Claude). Anthropic states in its API terms that it does not use API submissions to train its models.
There is no second provider.Until 2026-08-10 we kept one as an emergency fallback, and removed it. Its own privacy policy said it trains on submitted data and stores it in the People's Republic of China, and you had no way to tell from the outside which provider had answered your review. If Anthropic is unavailable, your review fails and you are not charged for it. We would rather return an error than quietly hand your contract to somewhere we would not want it.
We do not control Anthropic's systems, so we describe their published terms rather than guarantee their behavior.
We keep two things: the text extracted from your contract, and the review result. The review includes the analysis we generated plus short quoted phrases from clauses we flagged, so you can see which language we are referring to. Both are stored in Upstash Redis with a 24-hour expiry and are removed automatically after that. We do not extend it, and we cannot retrieve either one once it is gone. Keeping the extracted text is what lets you reopen a review, run it again without re-uploading, and share it; it is a deliberate trade, not an oversight, and 24 hours is the whole of it.
Files you export from a review, like the PDF report, are generated in your browser from the review result. Nothing extra is uploaded to us, and an exported file has no expiry, because it is simply a file on your computer.
One thing outlives the 24 hours, and only if you ask for it. If you set a deadline reminder, we keep three things until we send it: the email address you gave, the date, and the short name you typed. That is the entire record. It holds no part of your contract, no findings and no quoted clauses, so when the reminder arrives months later it can tell you the date and nothing about the document. We delete it as soon as it is sent, and every reminder email carries a link that deletes it sooner.
One exception worth naming: if an AI provider returns a malformed response, we log a short fragment of that response so we can diagnose the failure. That fragment can include analysis text. These operational logs sit with our hosting provider, are used only for debugging, and are never inspected as a matter of routine.
The free tier requires no sign-up. If you create an account, authentication is handled by Clerk, which stores your email address and login credentials. Payments are handled by Stripe. We never see or store your card details. We keep a record of your subscription status so we know which features to enable.
We use Vercel Analytics and PostHog to see how many people visit which pages and how the review flow is used, and PostHog also records application errors so we can fix them. Neither receives your contract text or your review findings. Session recording is disabled. We do not use advertising trackers and we do not build profiles of visitors.
What analytics records about a review is limited to counts and categories: whether a review started and finished, the detected contract category, and the page and word count. Contract text, document titles, and file names are never sent. Server-side product events pass through a filter that strips any field capable of carrying document or personal content before the event leaves; client-side traffic carries page URLs and UI interactions only, with review identifiers stripped from tracked URLs before they ship.
Reviews delete themselves after 24 hours, so in most cases there is nothing to request. If you have an account and want it removed, or you want a review deleted sooner, email privacy@straightterms.com and we will take care of it. Depending on where you live you may have additional rights over your personal data, including the right to access or delete it. Contact us at the same address and we will honor those requests.
If we change how we handle your data we will update this page and move the effective date above. Material changes will not be applied retroactively to data we have already collected.
Questions about any of this? Email privacy@straightterms.com.