$ cat 01_WHAT_WE_COLLECT.txt

Account data: Email address, username, bcrypt-hashed password. Required for authentication.

Contract uploads: The text/content of contracts you upload for analysis. Processed in memory, never used for model training.

Metadata: File size, SHA-256 hash (for duplicate detection), upload timestamp. No file names with sensitive info are logged.

Security data: SHA-256 hashed IP address, user agent string (truncated), request timestamps. Used for rate limiting and abuse detection.

$ cat 02_WHAT_WE_DO_NOT_COLLECT.txt

• NO real names (username is pseudonymous)
• NO phone numbers, addresses, or government IDs
• NO payment information (this is a free demo)
• NO third-party tracking cookies or analytics
• NO social media logins or OAuth

$ cat 03_HOW_WE_PROTECT.txt

Encryption in transit: TLS 1.3 via Cloudflare + Caddy.

Password storage: bcrypt with cost factor 12.

Token security: 15-minute access tokens (memory-only), 7-day refresh tokens (HttpOnly, Secure, SameSite=Strict cookies).

Network isolation: Internal VMs communicate over isolated VLAN (172.16.0.x). Only Caddy reverse proxy touches the public internet.

Audit logging: Every auth event logged with SHA-256 hashed identifiers. No raw emails or IPs in logs.

$ cat 04_DATA_RETENTION.txt

Raw contracts: 30 days from upload, then permanently deleted.

Analysis results: 1 year (for your reference and audit trail).

Audit logs: 1 year (security and compliance requirement).

Account data: Until you delete your account.

Right to deletion: Delete your account → cascade delete all projects, contracts, and analysis results within 7 days.

$ cat 05_NO_TRAINING.txt

YOUR CONTRACTS ARE NEVER USED TO TRAIN AI MODELS.

The LLMs running on this platform are static weights (downloaded once, never updated with user data). Your contract text is processed in volatile memory and discarded immediately after analysis. There is no "learning" from your data. There is no shared data pool. There is no cross-user exposure.

$ cat 06_THIRD_PARTIES.txt

We do NOT share your data with:

• OpenAI, Anthropic, Google, or any cloud AI provider
• Advertising networks or data brokers
• Analytics companies (no Google Analytics, no Mixpanel)
• Law enforcement except when required by valid court order

The only third-party service involved is Cloudflare (DNS + DDoS protection + Tunnel). Cloudflare processes HTTPS traffic but does not retain contract content.

$ cat 07_YOUR_RIGHTS.txt

• Right to access: Export all your data anytime
• Right to correction: Update your email/username
• Right to deletion: Delete account → all data removed within 7 days
• Right to restrict: Pause account processing
• Right to object: Opt out of any non-essential processing

$ cat 08_CONTACT.txt

Data controller: Tyran Tran

Contact:

Location: Dallas-Fort Worth, TX, USA