Privacy policy
Terms is operated by [legal entity name] (“we”). You can reach us at [contact email].
What we collect
- Account information. When you create an account we receive your email address and name from our authentication provider. If you sign in with Google, we receive the basic profile information that Google returns. We never receive your password.
- Documents you write. The full text of every contract you draft, its title, and its revision state.
- Counterparty details. The name and email address you enter for each signer.
- Signing and audit records. For each view, comment, access-code verification, and signature, we record a timestamp, the IP address, and the browser user-agent string of the person who performed it, along with a SHA-256 hash of the document text at the moment of signature. This is what makes a certificate of completion meaningful, and it applies to signers as well as account holders.
- Comments. The text of inline comments and the passage each one is anchored to.
Who we share it with
We do not sell your data and we do not use your contracts to train machine-learning models. We rely on the following processors:
- Vercel — application hosting and request logs.
- Neon — the Postgres database where all content is stored.
- Clerk — account creation, sign-in, and session management.
- Google — only if you choose to sign in with Google.
- Anthropic — only when you use the AI drafting panel. The text you send to that panel, and the document it is editing, are transmitted to Anthropic’s API to generate a response. If you do not use the AI panel, no document content is sent there.
Signing links
Each signer receives a unique link containing a secret token. Anyone holding that link can view and sign the document, so treat it like a password. Links do not currently expire. We send no email ourselves — you distribute the links yourself.
How long we keep it
Documents, signatures, and audit records are retained for as long as your account exists, because an executed agreement’s audit trail is the evidence that it was executed. Deleting a draft removes it and its associated records. To delete your account and everything in it, contact us at [contact email].
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. Contact us and we will respond. If you are a signer rather than an account holder, the account holder who sent you a document controls it, and we will direct your request to them where appropriate.
Security
Content is encrypted in transit. Each account’s documents are isolated from every other account’s at the data-access layer. That said, Terms is not SOC 2 certified and has not undergone a third-party security audit. Weigh that before using it for sensitive agreements.