Privacy notice
Updated 2026-10-27 · privacy-20261027
This notice describes Contract Studio’s account, document and automated-assistance features. Feature availability depends on the deployed service; a description here does not mean a feature is enabled.
Information you provide
The service processes your account email, verification status, identity identifiers and basic profile attributes returned by your sign-in provider; workspace names, membership and invitations; and the contracts, uploads, instructions, answers and edits you submit. Account, consent, usage, billing-status and security records support operation of the service. Do not submit information you are not authorized to share.
Sign-in and Google data
When Google sign-in is available and you choose it, it is used to establish and link your account identity. Contract Studio requests basic identity scopes, not access to Gmail, Google Drive or Google Calendar content. Login providers operate under their own notices. Provider tokens used by the application are held server-side rather than exposed to browser scripts.
Automated assistance and connected services
When you request an enabled AI feature, relevant instructions and document content are sent to the selected configured model provider or your explicitly connected endpoint. Supported integrations include OpenAI and Anthropic. Their retention and data-use terms also apply; this notice does not promise that every provider offers zero retention or identical training restrictions. Review the provider and connection before sending confidential or sensitive material. Hosting, identity and payment services also process information needed for their respective functions; payments, when enabled, use Stripe.
Storage and security
The hosted architecture uses AWS for identity and application storage, and Vercel for the web application. Access is scoped to the signed-in account and workspace. The implementation uses encrypted storage and server-side session protections. These measures do not constitute a security certification or a guarantee against every incident. Operational and security logs may be used to investigate failures and misuse.
Retention and deletion
Documents and versions may be retained to provide history, recovery and exports. Account deletion, where enabled, is a controlled process rather than an instant removal of every copy. Versioned storage, backups, financial records, audit records and deletion safeguards can remain after a request. There is no blanket promise that all drafts, AI records or backups are erased after a fixed number of days. Do not rely on an export link remaining available indefinitely.
Cookies and browser storage
The service uses session and security cookies to keep you signed in and protect requests. Interface preferences, such as the selected theme, may be stored in your browser. A personal endpoint connection is an explicit choice, not permission for an endpoint to access unrelated accounts.
Your choices and requests
Use the available workspace, account, session and deletion controls to manage your information. For questions or requests that those controls do not resolve, use the support contact presented in the service’s sign-in consent screen or payment receipt. If you cannot sign in, use the sign-in provider’s recovery flow. This notice may be updated as the service changes; review the version presented when you provide consent.