At Clause Shepherd, we read contracts for a living — so we know exactly how it feels to hand over something sensitive. This policy explains, in plain English, what we collect, where it lives, and what we never do with it.
Your use of Clause Shepherd is also subject to our Terms & conditions, which incorporate this policy. Any terms we use here without defining them carry the meaning given in those Terms. This policy is informational — it isn't itself a contract or legal advice.
What this policy covers
This policy covers how we treat the personal data we gather when you access or use Clause Shepherd. "Personal data" means any information that identifies or relates to you — including anything described as "personally identifiable information" or "personal information" under applicable privacy laws.
It does not cover the practices of companies we don't own or control, or people we don't manage — for example, the AI provider's own services, or a website you reach through a link in your report.
Personal data we collect
We collect only what we need to review your contracts and run your account. There are four kinds:
- Account data — your name, email address, and password (stored as a one-way hash we can't read). Used to create and manage your account.
- Contract data — the PDF or DOCX files you upload for review, plus the role and contract type you select. Processed to produce your analysis; see section 4.
- Payment data — billing details, card type, and the last four digits, collected and held by our payment processor, not by us. Used for billing and subscriptions only.
- Device & usage data — IP address, browser and device type, feature usage, and error logs. Used to keep the product fast, secure, and reliable.
We collect this information directly from you when you provide it, automatically when you use the service, and through cookies as described in section 8.
How we use your data
We use your data for three things, and nothing you wouldn't expect.
To provide the service
Creating and managing your account, reviewing your contracts, generating your risk analysis and PDF report, and keeping your history available so you can return to it.
To improve the product
Understanding which features help and where people get stuck, so we can make Clause Shepherd better. This uses aggregated usage data — never the contents of your contracts.
To communicate with you
Sending account and security notices, replying to support requests, and — only if you opt in — occasional product updates. You can unsubscribe from non-essential email at any time.
We won't collect additional categories of personal data, or use what we've collected for materially different purposes, without first giving you notice or obtaining your consent.
How we handle your contracts
This is the part most people care about, so we'll be direct. When you upload a contract, it's sent to our AI provider for analysis and returned to you as a review. We hold the file only as long as it takes to do that and to keep it in your history for your convenience.
Your contracts are processed to generate your analysis — that's it. They aren't sold, shared with other users, or used for advertising.
Your documents are not used to train, fine-tune, or improve any AI model — ours or anyone else's. Our AI provider processes them on a zero-retention basis and does not keep them after returning your analysis.
How we disclose your data
We disclose your personal data only to the trusted providers below, each under a data processing agreement, and each receiving only the data it needs to do its job. We do not sell your personal data.
Runs the AI analysis of your uploaded contracts. Receives contract contents for the duration of the review only — zero retention, never used for training.
Hosts your account, history, and stored files. Receives account info, usage data, and your reviews. Located in the EU — Frankfurt, Germany.
Handles subscriptions, billing, and invoices. Receives the email and billing details you enter at checkout, held under Paddle's own privacy policy.
We may also disclose personal data to comply with the law, enforce our agreements, prevent fraud or security incidents, protect rights and safety, or in connection with a merger, acquisition, or sale of our business — in which case we'll notify you before your data becomes subject to a different policy.
Data retention and deletion
We keep your data only as long as it's useful to you or required of us. Your account information stays while your account is open. Your reviews and uploaded files remain in your history until you delete them or close your account.
When you delete a review, the file and its analysis are removed from active storage promptly and purged from backups within 30 days. When you close your account, we delete your personal data within 30 days — except where we're legally required to keep certain records, such as billing records for tax purposes. We may retain anonymous, aggregated data that can't identify you.
Your privacy rights
Because your data is stored in the EU, you have strong rights over it — and we honor these for everyone, wherever you're based.
- Access — request a copy of the personal data we hold about you.
- Correction — fix anything that's inaccurate or out of date.
- Deletion — ask us to erase your data and close your account.
- Portability — export your data in a common, machine-readable format.
Most of these you can do yourself from your account settings. For anything else, email privacy@clauseshepherd.com and we'll respond within 30 days. California residents may also request that we don't disclose personal data to third parties for their direct marketing — though as noted above, we don't sell your data.
Cookies and tracking
We use a small number of cookies, and we keep it boring on purpose.
- Essential cookies keep you logged in and the app working. These can't be turned off.
- Analytics cookies help us understand usage in aggregate. You can opt out without losing any functionality.
We don't use advertising or cross-site tracking cookies, and we don't sell cookie data to anyone. You can clear or block cookies in your browser at any time. Because of how cookies work, the service doesn't currently respond to browser "Do Not Track" signals.
Data security
We protect your personal data with appropriate technical, organizational, and administrative measures — encryption in transit and at rest, scoped access controls, and EU-based storage. You can help by choosing a strong password and signing out after you've finished.
That said, no method of transmitting or storing data is ever completely secure. If a breach ever affects your data, we'll notify you and the relevant authorities as required by law.
Children's data
Clause Shepherd is built for working adults, and we don't knowingly collect personal data from children under 16. If you're under 16, please don't use the service or send us any personal data.
If you believe a child has provided us with personal data, contact privacy@clauseshepherd.com and we'll delete it as quickly as possible.
Changes to this policy
As we improve the service, we may need to update this policy from time to time. When we make a material change, we'll post a notice in the app and update the effective date above — and, where appropriate, email you. If you keep using Clause Shepherd after a change takes effect, that means you accept the updated policy.
Contact us
If you have a question about this policy, want to exercise one of your rights, or just want a human to walk you through how your data is handled, reach out — a real person will reply.
We respond to privacy and data requests within 30 days, usually much sooner.