Privacy Policy

ContractsConnected, LLC (“ContractsConnected,” “we,” “our,” or “us”) is committed to protecting the privacy and security of the information entrusted to us by our customers and their users. This Privacy Policy describes how we collect, use, store, and share information when you access or use the ContractsConnected cloud-based contract management and compliance platform (the “Platform” or “Service”), and when you visit this website.

This policy applies to our business customers (“Customers”), their authorized users (“Users”), and visitors to our website. By using the Service, you agree to the practices described in this Privacy Policy.

The governing version of this policy is published at legal.contractsconnected.com/privacy-policy and controls if it ever differs from the page you are reading. If you want your data deleted, see our Data Deletion Policy, also summarized below in “Deleting your data.”

1. Information We Collect

In short: We collect what you give us directly, what our systems log automatically, and what authorized third-party integrations send us.

1.1 Information you provide directly

When you register for or use the Service, we may collect:

Account and contact information, including name, email address, phone number, job title, and company name.
Billing and payment information, processed securely through our payment processor. We do not store full payment card details.
Contract and document content uploaded to the Platform, including templates, completed contracts, compliance records, and associated metadata.
Communications you send to us, including support requests, feedback, and correspondence.

1.2 Information collected automatically

When you use the Service, we automatically collect certain technical and usage information, including:

Log data such as IP addresses, browser type, operating system, referring URLs, and pages visited.
Usage data describing how you interact with the Platform, including features accessed, actions taken, and time spent.
Device identifiers and session information.
Cookies and similar tracking technologies, described in Section 6 and in “Cookies and tracking on this website” below.

1.3 Information from third parties

We may receive information about you from third-party integrations you authorize, such as identity verification services, single sign-on (SSO) providers, or integration partners connected to your account. We handle this information in accordance with this Privacy Policy.

2. How We Use Your Information

In short: We use your information to run the Platform, support your account, and meet our legal obligations. We do not sell it.

We use the information we collect for the following purposes:

Providing and operating the Service, including processing contracts, managing workflows, and enabling compliance tracking.
Account management, authentication, and customer support.
Improving and developing the Platform, including analyzing usage patterns and diagnosing technical issues.
Training and improving artificial intelligence and machine learning features, subject to the limitations described in Section 3 below.
Communicating with you about your account, updates, and Service-related notices.
Enforcing our Terms of Service and other agreements.
Complying with applicable legal obligations and responding to lawful requests from government authorities.
Protecting the rights, property, and safety of ContractsConnected, our customers, and others.

We do not sell your personal information to third parties.

3. Artificial Intelligence and Machine Learning

In short: AI features work on your contract and account data to power the Platform. Identifiable content is never used to train models shared with other customers, and you can turn AI off account-wide.

ContractsConnected uses artificial intelligence and machine learning technologies to power features within the Platform, including document analysis, compliance automation, and workflow recommendations.

Customer Content and Usage Data may be used to develop, train, or improve these AI and ML features. Where Customer Content is used for this purpose:

Data is aggregated and de-identified using commercially reasonable, industry-standard methods before use in model training.
We do not use identifiable Customer Content to train models that are shared with or accessible by other customers.
The AI model vendor we use retains zero data after processing your request.
Every account has a master AI off switch. When AI is switched off, the Platform runs at the Do it yourself level, with no AI involved.
AI-generated outputs are provided for informational purposes and may be inaccurate. They are not a substitute for human review and professional judgment.
Customers may contact us to ask about the AI data handling practices that apply to their account.

In short: We share information only with vendors who help us run the Platform, in a business transfer, when the law requires it, to protect people, or with your consent. We never sell it.

4.1 Service providers

We share information with trusted third-party vendors and service providers who assist us in operating the Platform and delivering our services. These include:

Cloud infrastructure and hosting providers.
Payment processors.
Customer support and communication tools.
Analytics and performance monitoring services.
Security and fraud prevention providers.

Each vendor sees only what it needs to perform its own function, and every vendor is contractually required to handle information only as directed by us and in accordance with applicable privacy laws.

4.2 Business transfers

If ContractsConnected is involved in a merger, acquisition, financing, reorganization, or sale of all or substantially all of its assets, your information may be transferred as part of that transaction. We will notify affected customers by email or a prominent notice on our website before any such transfer.

4.3 Legal requirements

We may disclose information when required to do so by law or in response to valid legal process, including subpoenas, court orders, or government requests. Where permitted, we will notify you of such requests in advance.

4.4 Protection of rights

We may disclose information when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of ContractsConnected, our customers, or the public, to detect or prevent fraud, or to enforce our agreements.

We may share your information for other purposes with your explicit consent.

5. Data Retention

In short: We keep information only as long as we need it to run the Service and meet our legal obligations, then delete it on the schedule below.

We retain personal information for as long as necessary to provide the Service, fulfill the purposes described in this Privacy Policy, and comply with our legal obligations.

Account information is retained for the duration of the customer relationship and for a reasonable period after that, to fulfill legal and contractual obligations.
Customer Content is retained during the Subscription Period. Upon termination or expiration of a Customer’s agreement, we delete Customer Content within 60 days of a written request.
Usage and log data is typically retained for up to 12 months, unless a longer retention period is required by law.
Backup copies of data may be retained for up to 90 days after deletion from active systems.

6. Cookies and Tracking Technologies

In short: The Platform uses cookies to keep you signed in, remember your settings, and keep the product secure. You can block them in your browser, at some cost to functionality.

We use cookies and similar technologies, such as web beacons and local storage, to operate and improve the Platform. Cookies help us:

Authenticate users and maintain session state.
Remember your preferences and settings.
Analyze usage patterns and measure the effectiveness of our Service.
Detect and prevent security threats.

You can configure your browser to refuse cookies or alert you when cookies are being sent. Disabling cookies may affect the functionality of certain parts of the Service.

Cookies and tracking on this website

In short: This marketing website uses Google Tag Manager for analytics and marketing tags, and HubSpot for demo scheduling and forms.

Separately from the Platform described above, this website loads Google Tag Manager, which in turn loads analytics and marketing tags we use to understand how visitors use the site and to measure our marketing. The site also embeds HubSpot to power demo scheduling and web forms, including the forms you use to request a demo or contact us.

These tools may set cookies or use similar technologies in your browser. You can control them through your browser settings as described in Section 6 above.

7. Data Security

In short: We protect your data with encryption, access controls, and an independent SOC 2 Type II audit, hosted on AWS in the United States. No system is perfectly secure.

ContractsConnected implements administrative, technical, and physical safeguards designed to protect the information we collect against unauthorized access, disclosure, alteration, and destruction. These measures include:

Encryption of data in transit using TLS 1.2 or higher, and encryption at rest using industry-standard encryption.
Hosting on Amazon Web Services (AWS) infrastructure in the United States.
An independent SOC 2 Type II audit of our security controls.
Access controls limiting employee access to personal information on a need-to-know basis.
A record of every action taken on the Platform, kept in an audit trail.
Regular security assessments and vulnerability monitoring.
Incident response procedures to address potential data breaches promptly.

No security system is impenetrable. While we take reasonable measures to protect your information, we cannot guarantee absolute security. If a data breach affects your information, we will notify you in accordance with applicable law.

8. Data Subject Rights

In short: Depending on where you are, you can ask to see, fix, delete, or receive a copy of your personal information, and you can object to some uses of it.

Depending on your location and applicable law, you or your authorized Users may have the following rights with respect to personal information we hold:

Access. The right to request a copy of personal information we hold about you.
Correction. The right to request correction of inaccurate or incomplete information.
Deletion. The right to request deletion of your personal information, subject to legal retention obligations.
Portability. The right to receive your personal information in a structured, machine-readable format.
Objection. The right to object to certain processing activities, including direct marketing.
Restriction. The right to request that we restrict processing of your information in certain circumstances.

To exercise any of these rights, contact us using the information in “Contact Us” below. We will respond to verified requests within the timeframe required by applicable law. Certain rights may be limited where we have a legal basis for retaining or processing your information.

Deleting your data

In short: You, or your authorized representative, can ask us to delete your data by emailing support@contractsconnected.com. We verify the request, then complete it within 30 days.

This section summarizes our Data Deletion Policy, published in full at legal.contractsconnected.com/data-deletion-policy.

Who can ask. An authorized representative of a customer organization, or an individual user acting on behalf of their organization, subject to verification. Requests must come from an email address associated with the customer account or otherwise verifiable as authorized.

How to ask. Email support@contractsconnected.com with:

Company name.
User name and email address.
A brief description of the data to be deleted.
Confirmation that the requester is authorized to make the request.

Verification. We verify the identity and authorization of the requester before processing a deletion request. If we need more information to complete verification, we will contact you. Unverified or incomplete requests may be delayed until verification is complete.

What can be deleted. Customer account information, user profile data, customer-provided content and documents, and application metadata associated with the customer account. Data may be retained where required by applicable law or regulation, contractual obligations, or legitimate business or security purposes.

Timing. Verified data deletion requests are fulfilled within 30 days of confirmation, unless a longer period is required by law. We notify you once the deletion process is complete.

Backups. Data stored in system backups is retained according to our internal backup retention schedule. Deleted data is not restored after a deletion request is fulfilled, except where required for disaster recovery within the retention period.

9. International Data Transfers

In short: We are based in the United States. If you are elsewhere, your data may be processed here, with safeguards where the law requires them.

ContractsConnected is based in the United States. If you are located outside the United States, information we collect may be transferred to, processed, and stored in the United States and other countries, which may have different data protection laws than your country of residence.

Where required by applicable law, we implement appropriate safeguards for international transfers, such as standard contractual clauses or other legally recognized transfer mechanisms.

In short: European, UK, and California users have specific rights under GDPR and the CCPA and CPRA. We do not sell or share personal information as those laws define it.

If you are located in the European Economic Area or the United Kingdom, ContractsConnected acts as a data processor with respect to Customer Content, and as a data controller with respect to certain account and usage data. Our legal bases for processing include:

Performance of a contract, to provide the Service.
Legitimate interests, to improve the Service, ensure security, and prevent fraud.
Compliance with legal obligations.
Consent, where explicitly obtained.

Customers that submit personal data governed by GDPR must execute a Data Processing Agreement (DPA) with ContractsConnected before submitting that data to the Platform.

10.2 California (CCPA/CPRA)

California residents may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt out of the sale or sharing of personal information. ContractsConnected does not sell or share personal information as defined by California law.

Contact Us

If you have questions about this Privacy Policy, or want to exercise any of the rights described above, contact us at support@contractsconnected.com. Our legal entity is ContractsConnected, LLC.