Privacy Policy

Account information including name, email, phone number, and role.

Payment and billing data processed through Stripe (we do not store full credit card numbers).

Project data such as documents, photos, schedules, and communication logs shared through ContractShield.

Usage analytics that help us improve performance, diagnose issues, and plan capacity (collected via Mixpanel).

Integrations data from third-party services you connect (e.g., Google Calendar, QuickBooks, Procore, Slack).

AI interaction data—prompts and responses generated when you use AI-powered features (pricebook advisor, smart notifications, quote suggestions). This data is sent to OpenAI for processing and is not used to train their models.

Bot-detection signals collected by Cloudflare Turnstile during registration to prevent abuse.

Provide, maintain, and improve the ContractShield platform.

Facilitate collaboration between contractors, clients, and subcontractors.

Deliver insights, AI-powered recommendations, and predictive analytics.

Communicate about updates, support tickets, and security notifications.

We do not sell your personal data.

Data is shared with trusted subprocessors who provide infrastructure, analytics, or customer support—listed below and in our Trust Center.

Our current subprocessors include: Supabase (database & storage), Vercel (hosting & edge delivery), Stripe (payments), OpenAI (AI features), Resend (transactional email), Mixpanel (analytics), Google (maps, calendar, authentication), and Cloudflare (bot protection).

We may disclose information if required by law or to protect the safety and rights of users.

Aggregated or anonymized data may be used for benchmarking and product development.

SOC 2 Type I audit underway with controls monitored by our security team; Type II roadmap published in the Trust Center.

All data encrypted in transit (TLS 1.3) and at rest (AES-256). OAuth tokens are encrypted with dedicated application-level encryption keys.

Role-based access, multi-factor authentication, and SSO (SAML/SCIM) support.

Regional data hosting options to support residency requirements.

CSRF protection, rate limiting, and Cloudflare Turnstile CAPTCHA on registration to prevent automated abuse.

Request access, correction, or deletion of your personal data by emailing legal@contractshield.io.

Manage marketing preferences via the unsubscribe link in emails.

Disable or revoke third-party integrations at any time from workspace settings.