Privacy Policy

The data controller under the GDPR is: Amer Akhter Thalkirchner Strasse 190, 81371 München, Deutschland Email: hello@clausecheck.de For privacy-related inquiries, please contact: hello@clausecheck.de

We collect the following categories of personal data: Data you provide directly to us: • Identity and Contact Data: Email address and display name when you create an account. • Contract Documents: Rental contract text you upload or paste for analysis. This is processed temporarily and deleted immediately after analysis — we do not store contract text permanently. • Payment Information: Processed by Stripe. We do not store card details. • Communications: Contents of emails or messages you send to us. Data we collect automatically: • Technical Data: IP address, browser type, operating system, access times. • Usage Data: Pages viewed, analysis requests, and interactions with the service. • Log Data: Error logs and performance data to maintain service reliability. • Cookies: Strictly necessary cookies for session management and authentication only.

We use your data solely for the following purposes: • Service Delivery: Analysing rental contracts and generating reports. • Account Management: Creating and managing your user account. • Payment Processing: Handling one-time payments for full reports. • Communications: Sending your report by email on request, and verification emails on registration. • Security: Fraud prevention, abuse protection, and rate limiting. • Service Improvement: Error monitoring and performance optimisation. We do not use your data for advertising, sell it to third parties, or use it to train AI models.

We process your personal data on the following legal bases under the GDPR: • Art. 6(1)(b) — Contract Performance: Processing uploaded contracts, account creation, and payment handling. • Art. 6(1)(f) — Legitimate Interest: Security, fraud prevention, error monitoring, and rate limiting. • Art. 6(1)(c) — Legal Obligation: Retention of payment records for tax compliance purposes.

We do not sell or share your personal data for advertising purposes. We work with the following processors who handle data solely to provide their services to ClauseCheck: • Anthropic (USA) — AI contract analysis. Contract text is transmitted for processing and not retained. Data transfer is governed by Standard Contractual Clauses (SCCs). • Supabase (Frankfurt, Germany) — Database hosting and authentication. EU servers, GDPR-compliant. • Vercel (Frankfurt, Germany) — Web hosting and deployment. EU servers. • Stripe (Ireland, EU) — Payment processing. We store no payment data. • Resend (USA) — Email delivery. Data transfer governed by SCCs. • Sentry (USA) — Error monitoring. Personal data is stripped before transmission. • Upstash (EU/USA) — Rate limiting. Only IP addresses, stored briefly.

Some of our service providers process data outside the European Economic Area (EEA), particularly in the United States. We ensure that appropriate safeguards are in place for all such transfers, including: • EU Standard Contractual Clauses (SCCs) under Art. 46 GDPR • EU Commission adequacy decisions where applicable Providers affected: Anthropic, Resend, Sentry, and Upstash.

We retain personal data only for as long as necessary for each purpose: • Contract text: Deleted immediately after analysis is complete. • Free reports: Automatically deleted after 7 days. • Paid reports: Automatically deleted after 30 days. • Account data: Until account deletion or after 2 years of inactivity. • Payment records: 7 years as required by tax law. • Log data: Up to 90 days. You can delete your account and all associated data at any time from your Profile page under "Delete Account".

As a data subject under the GDPR, you have the following rights: • Right of Access (Art. 15): Right to obtain information about the personal data we hold about you. • Right to Rectification (Art. 16): Right to have inaccurate data corrected. • Right to Erasure (Art. 17): Right to have your data deleted ("right to be forgotten"). • Right to Restriction (Art. 18): Right to restrict processing of your data. • Right to Data Portability (Art. 20): Right to receive your data in a structured format. Use the export function in your Profile. • Right to Object (Art. 21): Right to object to processing based on legitimate interests. • Right to Lodge a Complaint (Art. 77): Right to lodge a complaint with a supervisory authority. To exercise your rights, contact us at: hello@clausecheck.de You also have the right to lodge a complaint with the relevant data protection supervisory authority. In Germany, this is the Federal Commissioner for Data Protection and Freedom of Information (BfDI).

ClauseCheck uses two categories of cookies: Essential Cookies (always active — cannot be disabled): • Session cookie: Maintains your login session. Session-based. • Consent cookie: Stores your cookie preferences. 1 year. These are strictly necessary and require no separate consent under applicable law. Optional Cookies (require your consent): • Error Monitoring (Sentry): Helps us detect and fix bugs. Your email and name are stripped before any data is transmitted to Sentry. You can opt out via the cookie banner or by clearing your browser cookies. You can change your cookie preferences at any time by clearing your browser cookies and revisiting the site.

We implement appropriate technical and organisational measures to protect your data: • Encrypted Transmission: All data is transmitted over HTTPS/TLS. • Data Encryption: Analysis reports are encrypted at rest using AES-256-GCM. • Access Controls: Row Level Security policies ensure users can only access their own data. • Rate Limiting: API-level rate limiting protects against abuse. • Error Monitoring: Sentry monitors for errors — personal data is stripped before transmission.

ClauseCheck uses AI technology (Claude by Anthropic) for automated analysis of rental contracts. The following applies: • Contract text is transmitted to Anthropic for analysis and is not stored permanently thereafter. • AI analysis provides legal information only — it does not constitute legal advice. • Users can contest analysis results by contacting us. • By uploading a contract, you confirm that you have the right to process the document.

We reserve the right to update this Privacy Policy when our services change materially or legal requirements change. Registered users will be notified by email of significant changes. The date of the last update is shown above.