Privacy Policy

• Account information: your name, email address, company name, and password (stored hashed).
• Payment information: handled by Stripe. We receive your name, email, billing country, the last four digits of your card, and transaction records. We never see or store your full card number.
• Documents and reports: the contracts and other documents you upload, and the analysis the Service generates from them.
• Usage and device data: log data such as IP address, browser type, pages viewed, actions taken in the dashboard, and timestamps, including the record of your acceptance of the dashboard acknowledgment.
• Support communications: anything you send us through the support link or by email.
• Cookies: we use session cookies needed to keep you signed in, and Google Analytics (and Google Ads conversion tracking) for attribution and measurement. Our attribution cookies are only set once you accept them via the on-site consent banner.

• To provide the Service: process your documents, generate and store your reports, run your account, and bill you.
• To support you and respond to your messages.
• To keep the Service secure, prevent abuse, and enforce our Terms of Service.
• To improve the Service using aggregated usage data that does not identify you or your documents.
• To send service notices (billing, security, changes to our terms). We send marketing email only if you opt in, and you can unsubscribe at any time.

To generate a report, the Service sends the text of your uploaded document to third-party AI providers through their business APIs. Paid analyses run on Anthropic Claude, with OpenAI GPT-4o as an automatic fallback if Claude is unavailable. The free, unauthenticated teaser scan runs on Anthropic Claude as well. We use those providers under terms that prohibit them from using your documents or our prompts to train their models, and we do not train models on your documents ourselves. Your documents and reports are stored with our hosting providers (Supabase and Railway) in data centers located in the United States.

Only automated systems read your documents. No PactSift AI person reads your contract or your report unless you ask us to for support and we confirm that with you first.

All uploads and dashboard traffic are encrypted in transit using TLS 1.2 or higher. Stored documents and reports are encrypted at rest using AES-256 in private, access-controlled storage that is not publicly addressable. Access to production systems is limited to the people who need it to run the Service. No system is perfectly secure, and we cannot promise that unauthorized access will never happen; if a breach affects your data, we will notify you as required by law.

• Service providers that help us run the Service: AI providers (Section 3), hosting and database providers, Stripe for payments, email delivery, and Google Analytics, each only for the purpose of providing their service to us.
• Law enforcement or others when required by law, subpoena, or court order, or to protect our rights, our users, or the public.
• A buyer or successor if we sell or transfer the business, in which case this policy continues to apply to your data.

We do not sell your personal information or your documents, and we do not share them for advertising.

• Documents and reports: until you delete them from your dashboard or close your account. Deletion from your dashboard is immediate; copies in encrypted backups are removed within [30] days.
• Account and billing records: for as long as your account is open and afterward as needed for tax, accounting, and legal purposes (generally [seven] years for billing records).
• Log data: [90] days unless needed to investigate a security incident.

• Delete any document and its report from your dashboard at any time, with one click and no waiting period.
• Update your account information in your dashboard, or ask us to close your account and delete your data by emailing [privacy@pactsiftai.com].
• Ask us what personal information we hold about you and request a copy, a correction, or deletion. We will respond within 45 days and will not treat you differently for asking. If your state privacy law gives you additional rights, we will honor them.
• Opt out of marketing email using the link in any message.

The Service is intended for business use by adults. We do not knowingly collect information from anyone under 18. Documents you upload may contain information about other people or companies. You are responsible for making sure you are allowed to share each document with us and with our providers, and for any notice or consent that your own contracts or laws require.

We may update this policy. If the change is material, we will email you at your account address at least 14 days before it takes effect and update the date at the top. Continued use after that date means you accept the updated policy.