Privacy Policy

1. The information we collect

Information you give us. When you create an account, we collect your name, email address and password. If you pay for the service, we collect billing details — but card numbers and bank details go directly to our payment processors, never to us. We receive confirmation of payment and basic transaction records only. You may also add optional details such as a company name or industry, and we keep records of any messages you send our support team.

The documents you upload. We receive the contract itself, information about the file (type, size, name, upload date), the analysis our system generates from it, and any notes or annotations you add.

Information collected automatically. Usage data (which features you use and how), technical data (IP address, browser, operating system, device identifiers), cookies (see section 8), and log files recording technical events. Analytics data is aggregated and anonymised — we can't identify you personally from it.

We don't collect sensitive information — such as health, political or religious information — except where it happens to appear inside a document you upload, and there it's processed only as part of the analysis you asked for.

2. Why we collect it

To provide the service. Analysing the documents you upload, saving your results so you can return to them, keeping your settings, and answering your support questions.

To improve the service. We analyse usage patterns to see what works and what confuses people, and we monitor performance to find and fix problems. We do not use your uploaded documents to train our AI models, and we do not permit our AI technology providers to use them for training either. Your contracts are processed to give you the analysis you asked for, and for nothing else.

To run the business. Processing payments, sending service communications (renewals, security alerts, billing), complying with legal obligations, and preventing fraud and abuse.

Marketing, only with your permission. If you've opted in, we may email you about new features or offers. Every marketing email has an unsubscribe link, and opting out never affects service communications.

3. Our commitments about your documents

We never use your documents to train our AI. Not to improve models, not in datasets, not in any form. Our AI technology providers are bound the same way: under our agreements with them, your documents cannot be used to train their models. Documents are processed in Australia, in the Sydney region.

We never sell or share your documents. The only circumstance in which a document leaves our systems is a valid legal requirement — a court order, subpoena or similar process.

We don't read your documents. They're processed by automated systems. Human access happens only when you ask for support on a specific document, during a security investigation, or where the law requires it.

Your documents are encrypted. In transit using TLS 1.3, at rest using AES-256.

People named in your documents. A contract usually contains personal information about people who aren't our customer — the other party, an employee named in an offer letter, the landlord on a lease. That information is processed only as part of analysing the document, protected under the same commitments as everything else in this policy, and never used for any other purpose. If your personal information appears in a document someone else uploaded, contact the person or business who holds the document first; you can also contact us at [email protected].

4. Business accounts

This section applies to Contractam for Business.

The account belongs to the business. Contracts uploaded to a business account belong to that account, not to the individual who uploaded them. When someone leaves the business, the contracts they uploaded stay in the account.

The business decides; we process. For documents in a business account, the business decides what's uploaded, who accesses it, and when it's deleted. We process those documents on the business's instructions to provide the service — we make no independent use of them. If you're an individual whose information appears in a business account's documents, the business is your first point of contact; we'll assist as the processor of that data.

Who can see what. Users on the same business account can see the contracts and analyses in that account, subject to any access controls the account offers. The account administrator manages who has access.

Your employees' personal information. Contracts you upload may contain personal information about your employees, contractors or counterparties. You're responsible for having the right to upload those documents.

5. Where your information is stored

All information — documents, account details, analysis results — is stored on secure servers in Australia, primarily in the Sydney region. Backups are encrypted and kept in Australian data centres.

Passwords are hashed and never stored in readable form. We run regular security audits and maintain strict internal access controls. We'll be honest with you: no online service can promise perfect security. What we promise is that we take every reasonable measure to protect your information, and that we'll tell you if something goes wrong (see section 10).

6. How long we keep it

We keep your information while your account is active. Deleted documents are removed from active systems within 30 days and from backups within 90 days.

When your account closes, we delete or anonymise your personal information within 30 days, except for transaction records we're legally required to keep. If you've enquired about Contractam but never created an account, we keep your contact details for no longer than 30 days before deleting them. Anonymised data may be kept indefinitely.

7. The limited ways we share information

Service providers. Payment processors, cloud hosting, AI processing, analytics and support tools — each bound by confidentiality and data protection agreements, and none with access to your document content beyond what their role requires.

Legal requirements. We may disclose information where the law requires it, or to protect rights, safety or property in response to valid legal process.

With your consent. If you enable a third-party integration, we share only what that integration needs, only because you switched it on.

If Contractam changes ownership. In a merger, acquisition or sale, your information may transfer to the new owner. We'll notify you first and give you the chance to delete your data before it transfers.

8. Cookies

Essential cookies keep you logged in and make the service work — disabling them breaks it. Preference cookies remember your settings. Analytics cookies give us aggregated usage insights. Marketing cookies run only with your consent. You can control cookies through your browser and your account settings.

9. Your rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles you can:

Access the personal information we hold about you — much of it directly in your account, the rest by asking us. Correct anything inaccurate. Delete specific documents or your whole account — we action deletion requests within 30 days, subject to legal retention requirements. Export your data in a machine-readable format. Object to marketing at any time.

To exercise any of these, use your account settings or email [email protected]. We may need to verify your identity, and we respond within 30 days.

10. Other things you should know

Links and integrations. Where Contractam links to other sites or connects to third-party services, their privacy policies apply on their side.

International transfers. We store data in Australia, but some service providers may operate elsewhere. Where data crosses borders we use recognised legal mechanisms, such as standard contractual clauses, to keep it protected.

Age. Contractam is for adults. We don't knowingly collect information from anyone under 18, and we delete it promptly if we learn we have.

AI processing. Our AI analyses your documents automatically to identify clauses, assess risk and generate explanations. The output is information, not a decision made about you — you stay in control of what happens next.

Data breaches. If a breach affects your personal information, we'll notify you and the regulator as the Privacy Act 1988 (Cth) requires, and tell you what happened, what was involved, and what we're doing about it.

11. Changes to this policy

We'll update this policy as the service and the law change, and the date at the top always reflects the latest version. Material changes are notified by email or a prominent notice. If you don't agree with a change, you can delete your account at any time.

12. Contact and complaints

Questions, requests or complaints: [email protected], or in writing to 477 Pitt St, Haymarket NSW 2000. We aim to respond within 30 days.

If we can't resolve your complaint, you can contact the Office of the Australian Information Commissioner: www.oaic.gov.au · 1300 363 992 · GPO Box 5218, Sydney NSW 2001.