Privacy Policy & Zero Data Retention Guarantee
Effective Date: October 16, 2026 • Last Reviewed: October 2026
The Core Commitment: We Never Store Your Contracts
ClauseFlaw was founded on a strict non-negotiable premise: your commercial agreements, intellectual property assignments, NDAs, and customer contracts belong solely to you. We do not store contract text on disk, do not index your business terms, and categorically never feed uploaded documents into public or private AI training datasets.
1. Architecture of Zero Data Retention (ZDR)
Traditional cloud software persists uploaded documents to relational databases or cloud object stores (e.g., AWS S3). ClauseFlaw utilizes a hardened RAM-Only Volatile Processing Pipeline:
- In-Memory Parsing: When you submit a PDF, DOCX, or text snippet for audit, the file stream is accepted directly into temporary process memory (Node.js buffer).
- Zero Disk I/O: At no point during file extraction or rule-based pattern matching is the document written to a physical hard drive or non-volatile storage volume.
- Deterministic Garbage Collection: Immediately following report delivery and Track-Changes generation, buffer references are dereferenced and purged from memory.
2. Information We Collect and Process
We minimize data collection to the absolute technical minimum required to operate the service and process transactions:
What We Process Ephemerally
Contract text, clause excerpts, uploaded filenames (sanitized of directory traversal characters), and risk parameters during active audit execution. Erased upon completion.
What We Record for Orders
Order identifier, customer billing email (for receipt dispatch and subscription entitlement verification), transaction amounts, and cryptographic session tokens.
3. Artificial Intelligence & Third-Party LLM Policy
When enhanced neural synthesis is invoked for custom negotiation rephrasing, ClauseFlaw executes requests strictly through enterprise-tier zero-data retention endpoints (API level). Under our enterprise API agreements:
- Uploaded prompts and contract fragments are never used to train base models (e.g., GPT-4o or future iterations).
- Inputs are not retained for server-side evaluation or model fine-tuning.
- Data is processed in transient memory subject to strict contractual zero-retention mandates.
4. Edge Security & Cloudflare Protection
All incoming traffic is encrypted end-to-end via Transport Layer Security (TLS 1.2 and TLS 1.3). We utilize Cloudflare Edge Enterprise infrastructure to mitigate distributed denial of service (DDoS) attacks, filter malicious SQL injection/XSS probes, and enforce HTTP Strict Transport Security (HSTS).
5. GDPR, CCPA, and International Rights
Because ClauseFlaw does not retain user contracts or profile document history, there is no persistent document dossier to access, rectify, or delete under GDPR Article 17 (Right to Erasure). For billing records or transactional email records, you may request deletion at any time by contacting our data protection officer at [email protected].
6. Contact Information
If you have any questions or security audits regarding our privacy architecture, please submit an inquiry to: