Your contract, handled with care.
Last updated: 11 July 2026
Who we are
Clause is operated by Automated Ltd, a company registered in England and Wales. We are the data controller for the personal information described in this policy. For any privacy question or request, email privacy@clause.work. Once we are registered with the ICO as a data controller, we will add our registration number here.
What we collect
We collect three things. First, your email address, when you analyse a contract or sign up for early access. Second, the contract text you submit and the analysis Clause produces, which we store encrypted; the next sections explain why, for how long, and how to delete them. Third, basic technical data: your IP address, timestamps, and rate-limit counters, used to keep the service secure and available.
What we store, and why
When you analyse a contract, we store the contract text and its analysis, encrypted, on our server. We store them for one reason: so your risk map is still there when you come back. Your results email includes a private link that reopens your analysis; without storage, that link could not work. Both are encrypted at rest, and the contract text is never written to our logs.
How long we keep it
Your contract and analysis are deleted automatically 90 days after they were created, or sooner if you delete them yourself. Your email address we keep until you unsubscribe or ask us to remove it. Security and rate-limit data is short-lived and kept only as long as needed to protect the service.
Deleting your analysis
You can delete your contract and its analysis at any time, with one click. There is a delete button on your results page, and a delete link in your results email. Deletion is immediate and permanent: we remove the record from our server and the private link stops working.
How we use your data
We rely on different lawful bases under UK GDPR for different purposes. Analysing your contract, storing it so you can return to it, and emailing you the result are all steps in providing the service you asked for (the contract basis). Sending you later product updates or early-access news relies on your consent, which you can withdraw at any time. Keeping basic security and rate-limit data relies on our legitimate interest in running the service safely.
Our AI provider and sub-processors
To produce your analysis, your contract is sent to our AI provider; it is not used to train their models. We work with OpenAI and Anthropic as processors for this step. We also use an email provider to send your results and updates, and SiteGround for hosting. Each provider processes data on our instructions under its own data-protection terms, and we will keep this list current as our providers change.
International transfers
Some of our providers, including our AI provider, may process data outside the UK. Where that happens, we rely on the safeguards those providers put in place for international transfers, such as standard contractual clauses.
Your rights
Under UK GDPR you have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to how we use it, and to data portability. Where we rely on consent, you can withdraw it at any time. To exercise any of these, email privacy@clause.work, or use the one-click delete for your analysis. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Security
Your contract and analysis are encrypted at rest. The site runs over HTTPS end to end, the contract text is never written to our logs, the analysis endpoint is rate-limited, and our AI provider keys are scoped to only what they need. No system is perfectly secure, but encryption plus a hard 90-day lifetime keeps your exposure small and short.
Cookies
Clause uses only the cookies it needs to work, such as remembering whether you prefer the light or dark theme. If we ever add analytics, we'll ask first and let you decline anything non-essential.
Other people's data
A contract you submit may contain other people's personal information, such as names or contact details. Please only submit contracts you have the right to, and don't include other people's sensitive personal data unless you have a basis to. Whatever you submit is stored encrypted, used solely to provide your analysis, and deleted when you delete it or after 90 days.
Changes to this policy
If we change this policy, we'll update the date at the top and, for significant changes, tell you by email where we can. Questions or requests: privacy@clause.work.