Privacy Policy

Last updated: 8 July 2026

Who we are

Explain My Contract is operated as a UK-based service. We are the data controller for the personal data described in this policy. Explain My Contract is operated by [Operator legal name — TO COMPLETE BEFORE PUBLISH].

Contact: support@explainmycontract.co.uk. Postal address: [Contact postal address — TO COMPLETE BEFORE PUBLISH].

Summary

We respect your privacy. We do not build profiles on you, sell your data, or use your information for marketing or advertising. Here's the key points:

  • Uploaded files are sent securely to our server for text extraction
  • Private details (names, contact details, addresses, IDs) are detected automatically and hidden by default before AI processing
  • Detection runs in your browser and, for names and organisations, transiently on our own detection service — never a third party, never stored
  • You review everything in place — and can hide more, unhide, or edit the text — before prepared text is sent to our AI provider
  • Names and identifiers are replaced with anonymous labels (like [PERSON_1]) before AI processing
  • Checkout may create a short-lived recovery draft for paid sessions
  • Browser session data can be cleared anytime
  • Session auto-clears after inactivity or when you close your browser

How your data is processed

Here's the step-by-step flow of how your contract is handled:

  1. 1

    Upload or paste

    You upload a file or paste contract text. If you upload a file, it is sent securely to our server so text can be extracted.

  2. 2

    Automatic privacy check

    We automatically detect private details — emails, phone numbers, addresses, bank details, ID numbers, names, and organisations. Pattern-based detection runs in your browser. To catch names and organisations in free text, your contract text may also be processed transiently by our own detection service — it is never stored or logged there, and never shared with a third party.

  3. 3

    Review in place

    Every detected detail is highlighted in your contract and hidden by default. You can search your contract, select any text to hide it, edit the text to fix extraction mistakes, unhide anything that isn't private, and see exactly what will be sent — before anything reaches the AI.

  4. 4

    Send to AI provider

    Your prepared text — with every hidden detail replaced by an anonymous label (e.g., [PERSON_1], [ORGANISATION_1]) — is sent securely over HTTPS to our AI provider.

  5. 5

    Explanation generated

    Our AI provider (Anthropic) processes the text and returns a plain-English explanation. Data submitted through Anthropic's API is not used to train its models.

  6. 6

    Results displayed

    The explanation is shown in your browser and can be cached in browser session storage. Anonymised names stay anonymised in the output.

Third-party processors

We use the following third-party services to provide this product:

Anthropic

AI text processing

Your prepared contract text (after the privacy check — with hidden details replaced by anonymous labels) is sent to generate the explanation.

Anthropic does not use data submitted through its API to train its models. We encourage you to review the privacy check before continuing so only what you're comfortable with is sent.

Stripe

Payment processing

Payment details are handled directly by Stripe. We do not receive or store your card information.

See Stripe's privacy policy for details on their data handling.

Vercel (hosting + Vercel Web Analytics)

Hosting, infrastructure, and cookieless usage analytics

Basic technical data (IP address, browser type) may be logged for operational and security purposes. Vercel Web Analytics collects aggregate, cookieless usage statistics.

Contract content is not logged or stored on our hosting infrastructure. Analytics does not use cookies and does not identify you personally.

Railway (hosting for our detection service)

Infrastructure for EMC's own private detection service

During the privacy check, your contract text may be processed transiently in memory by our own detection service, which runs on Railway infrastructure in the European Union (Netherlands). Nothing is stored or logged there.

Railway provides the server only — the detection software is ours and retains nothing. Processing stays in the EU, which the UK treats as adequate for data protection.

Upstash (Redis)

Short-lived checkout drafts, payment records, and abuse controls

A short-lived checkout draft (the prepared contract text, kept up to 24 hours), payment-session metadata (e.g. Stripe session ID, amount, tier), and rate-limit/usage counters keyed by session or IP address.

Used only to recover paid sessions, prevent abuse, and enforce per-purchase usage limits. Checkout drafts expire automatically.

Our lawful bases for processing

Under UK GDPR we must have a lawful basis for processing your personal data. Ours are:

Providing the explanation you paid for — Contract (Article 6(1)(b))

We process your contract text and payment to deliver the explanation you request and purchase.

Security, abuse prevention, and reliability — Legitimate interests (Article 6(1)(f))

We use IP-based rate limiting, per-purchase usage records, and operational logging to keep the service secure, prevent abuse, and recover paid sessions. We balance this against your rights and do not use it to build profiles.

Meeting legal and financial obligations — Legal obligation (Article 6(1)(c))

Our payment processor retains transaction records as required by tax and financial-compliance law.

Cookieless usage analytics — Legitimate interests (Article 6(1)(f))

We use aggregate, cookieless analytics to understand how the service is used and fix problems. This does not store information on your device or identify you, so no consent banner is required.

International data transfers

Some of our processors are located outside the UK (for example in the United States). Where personal data is transferred outside the UK, we rely on appropriate safeguards as required by UK data protection law — such as UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, as offered by each provider in their data processing terms.

  • Anthropic — AI processing (United States)
  • Stripe — payment processing (United States / global)
  • Vercel — hosting and analytics (United States)
  • Railway — hosting for our own detection service (European Union — Netherlands; the UK treats the EEA as adequate, so no additional safeguards are needed)
  • Upstash — Redis storage (region depends on configured database location)

Data retention

Explain My Contract servers

Uploaded files are processed to extract text, and the privacy check may process your contract text transiently on our own detection service to find names and organisations — nothing is stored or logged there. We may keep a short-lived checkout draft for up to 24 hours for paid-session recovery. Generated explanations are not stored on our servers.

Your browser session

Contract text, selected options, payment session details, and results are stored temporarily in your browser session while you use the service. This data is cleared when you close your browser, manually clear your session, or after 15 minutes of inactivity.

AI provider

Our AI provider (Anthropic) processes your prepared text according to their API data handling terms, and does not use API data to train its models. We do not control their retention policies. Refer to their documentation for specifics.

Usage and abuse-control records

To enforce per-purchase limits (one explanation plus one regeneration) and prevent reuse of a paid session, we keep small usage records keyed to your payment session, and short-lived rate-limit counters keyed to IP address. Usage records are deleted automatically 30 days after purchase; they contain no contract content.

Payment records

Stripe retains payment records as required for financial and legal compliance. We keep minimal payment-session metadata (such as the Stripe session ID, amount, and the tier purchased) to verify access; it is deleted automatically 30 days after purchase. These records do not include your contract content.

Your choices

You have control over your data at every step:

  • Review the privacy check

    Every automatically detected detail is highlighted in your contract and hidden by default. Unhide anything that isn't private, and use the "Exactly what we send" view to see the precise text that will be sent.

  • Hide anything else

    Search your contract or select text directly in the document to hide it. Hidden content is replaced with an anonymous label and the original is never sent to our AI provider.

  • Edit the extracted text

    Fix extraction mistakes (like missing spaces) before analysis — protections are re-checked after any edit.

  • Output stays anonymised

    Your explanation uses the same anonymous labels — identities stay protected in the output.

  • Clear your session

    Use the clear button in the navigation to delete all contract data from your browser at any time.

  • Export or discard

    Save your explanation as a PDF, or simply close your browser to discard everything.

Security

Encryption in transit

All data transmitted between your browser and our servers, and to third-party providers, is encrypted using HTTPS/TLS.

No content logging

We do not log your contract content or explanations on our servers, and our own detection service processes text transiently without storing or logging it. Only basic operational data (like error rates) is logged.

Minimal data transmission

We transmit only the text needed to generate your explanation. You control what is sent through the privacy check — everything hidden is replaced with an anonymous label before transmission.

Session isolation

Your session data is isolated in your browser and is not accessible to other users or sessions.

Cookies & analytics

  • We do not use cookies. We set no advertising, tracking, or third-party cookies.
  • We store your theme preference (light/dark) in your browser's local storage. This is functional only and is not used to track you.
  • We use Vercel Web Analytics for aggregate usage statistics. It is cookieless, does not store information on your device, and does not identify you personally — so no cookie banner is required.

Your rights

Under UK data protection law you have the following rights over your personal data:

  • Access. Ask for a copy of the personal data we hold about you.
  • Rectification. Ask us to correct inaccurate or incomplete personal data.
  • Erasure. Ask us to delete personal data. Note most contract data is only held transiently (in your browser session, or a checkout draft for up to 24 hours); within that window you can ask us to delete a recovery draft.
  • Restriction and objection. Ask us to restrict processing, or object to processing based on our legitimate interests.
  • Portability. Where applicable, ask to receive personal data you provided in a portable format.

To exercise any of these, contact us at support@explainmycontract.co.uk.

Complaints

You have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), if you are unhappy with how we handle your personal data. We would appreciate the chance to address your concerns first.

Information Commissioner's Office (ICO) — https://ico.org.uk (helpline 0303 123 1113).

Contact us

If you have privacy concerns or questions, please contact:

support@explainmycontract.co.uk