Privacy & the life of your data
You are uploading a confidential-feeling document. Here is exactly what happens to it, in a table, because prose is where privacy promises go to hide.
| What | Where it lives | How long, and why |
|---|---|---|
| Original uploaded file / pasted text | Encrypted application storage, access-restricted | Retained up to 30 days for reliability and troubleshooting, then removed; not linked to your account. Opt-in: 'Save this contract to my account' keeps a redacted copy while your account exists — it enables sharing with an attorney (with your explicit permission), v1-vs-v2 offer comparison, and re-extraction as models improve. |
| Extracted terms (redacted) | Database, bound to your report/account | Kept while the report or account exists; deleted on account deletion. Names, employers, and contact details are stripped server-side during processing, before storage. |
| Rendered report | Database, capability URL (+ your account when signed in) | Free: 30 days, extended indefinitely when you sign in. Paid: kept while your account exists. |
| Anonymized benchmark contribution | Aggregate database (numbers and categories only — no text, no names) | Indefinite; survives account deletion because it is already de-identified. Contributed only with your explicit consent checkbox. |
The commitments
Extract, then delete — by default. The default path stores no document. Saving your contract is a feature you turn on, not a checkbox we pre-tick.
Redaction happens server-side, during processing. Physician names, signatures, emails, phone numbers, and street addresses are pattern-stripped from anything we persist.
Deleting your data is free and one click. Account → Delete my data. It works immediately and deletes reports, saved contracts, and intro requests. Pay-to-delete is a dark pattern (and illegal in key states); we reject it.
Give-to-get, with consent. The community benchmark improves only from explicitly consented, de-identified numeric terms. Contributors unlock full benchmark detail; nobody's document ever enters the aggregate.
Extraction processing. Live extraction sends contract text to Anthropic's API for processing under their commercial API terms (API inputs are not used to train models). No advertising, no data brokers, no selling your information — to your employer or anyone else.