How ContractingClaims handles personal data.

We process account details, company and team information, billing references, support communications, usage and security logs, and the project records or files that authorised users upload. Payment card details are handled by Stripe and are not stored by ContractingClaims.

Information is used to provide and secure the service, authenticate users, deliver invitations and alerts, process subscriptions, generate requested outputs, prevent abuse, diagnose faults, comply with law and improve the product. Processing is based on contract, legitimate interests, legal obligations and consent where applicable.

We use Supabase for authentication, database and private storage; Vercel for the website; Railway for the private API; Stripe for billing; Resend for transactional email; Sentry for error monitoring; and OpenAI and Anthropic for requested AI-assisted analysis. Each provider processes only the information needed for its role.

When an authorised user requests analysis, relevant structured event information may be sent to configured AI providers. Users should avoid submitting unnecessary personal data and must have authority to process project information.

Workspace data is isolated using row-level security, private storage and signed links. We use access controls, audit records and encrypted provider connections. Data is retained while an account is active and as needed for contractual, legal, security and backup purposes.

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection. Company-managed workspace data may need to be handled through the relevant company owner. You may also complain to the UK Information Commissioner's Office.

We use essential authentication and security cookies. Providers may process data outside the UK under appropriate contractual and legal safeguards. We do not sell personal data.

Privacy questions and rights requests can be sent to privacy@contractingclaims.com.