Privacy Policy

Last updated: August 20, 2026

1. Introduction

This Privacy Policy explains how IMFIT LET PTD ("we", "us", "our"), operating ContractMaker.ai ("the Service"), collects, uses, and protects your personal information. We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR).

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, and authentication credentials. If you sign up through a third-party provider (e.g., Google), we receive the profile information you authorize.

Contract Content

We store the contracts and documents you create, edit, and manage within the Service. This includes text content, revision history, and tracked changes.

Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, session duration, and device information (browser type, operating system, screen resolution).

Payment Information

Payment processing is handled by Clink. We do not directly collect or store your credit card numbers or banking details; Clink receives the payment information needed to process purchases, subscriptions, refunds, and related billing operations.

3. How We Use AI and Your Data

ContractMaker.ai uses artificial intelligence to generate and suggest contract content. When you use AI features:

  • Your prompts and relevant contract context are sent to third-party AI model providers (via OpenRouter) to generate responses
  • We do not use your contract content to train AI models
  • AI-generated suggestions are returned to you as tracked changes that you must explicitly accept or reject
  • We retain conversation history within the Service to provide contextual AI assistance during your editing sessions

Third-party AI providers process your data according to their own privacy policies and data processing agreements. We select providers that commit to not training on customer data.

4. How We Use Your Information

We use your information for the following purposes:

  • Service delivery: To provide, maintain, and improve the Service, including AI-powered contract generation
  • Order processing: To manage your subscription and coordinate with Clink for billing
  • Communication: To send you service-related updates, security alerts, and support messages
  • Fraud prevention: To detect, prevent, and address fraud, abuse, and security issues
  • Product improvement: To analyze usage patterns and improve the Service (using aggregated, anonymized data only)

5. Data Storage and Security

Your data is stored on secure servers provided by Supabase (hosted on AWS infrastructure). We implement industry-standard security measures including:

  • Encryption in transit (TLS/SSL) and at rest
  • Row-level security policies on all database tables
  • Regular security audits and monitoring
  • Secure authentication with multi-factor authentication support

6. Data Sharing

We do not sell your personal data. We share your information only with:

  • Clink: Our payment processor, for billing, checkout, subscription management, and refunds
  • AI model providers: To process your AI-assisted editing requests (contract text excerpts only, no personal account data)
  • Infrastructure providers: Supabase and Vercel for hosting and data storage
  • Analytics providers: Plausible for aggregate traffic measurement, and Microsoft Clarity for masked session interactions and heatmaps
  • Legal requirements: When required by law, court order, or government request

7. Your Rights (GDPR)

If you are in the European Economic Area (EEA), you have the following rights under the GDPR:

  • Access: Request a copy of the personal data we hold about you
  • Rectification: Request correction of inaccurate data
  • Erasure: Request deletion of your personal data ("right to be forgotten")
  • Portability: Receive your data in a structured, machine-readable format
  • Restriction: Request restriction of processing in certain circumstances
  • Objection: Object to processing based on legitimate interests

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. Data Retention

We retain your account data and contracts for as long as your account is active. After account deletion:

  • Personal account data is deleted within 30 days
  • Contract content is permanently deleted within 30 days
  • Anonymized usage analytics may be retained indefinitely
  • Billing records are retained as required by law (typically 7 years)

9. Cookies

We use essential cookies to:

  • Maintain your login session
  • Remember your preferences
  • Ensure security (CSRF protection)

We use Plausible for aggregate traffic measurement and Microsoft Clarity for masked session interactions and heatmaps. Clarity receives an opaque account ID and coarse account or subscription tags, but never your email, prompts, or contract content. Document, dashboard, and editor regions are explicitly masked before replay data is sent.

We do not use third-party advertising cookies. Google Analytics and Clarity may set analytics cookies only after you accept the cookie banner; if you decline, Clarity operates in cookieless no-consent mode with limited per-page tracking.

10. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service at least 30 days before they take effect. Your continued use of the Service after the effective date constitutes acceptance.

12. Contact

For privacy-related questions or requests, contact us at [email protected].