Privacy Policy

This Privacy Policy describes the information that we gather on or through ClauseTrail (the website at clausetrail.com, the app, the API and the MCP server: the "Service"), how we use and disclose it, and the steps we take to protect it. By using ClauseTrail, you accept this Privacy Policy. It is incorporated into, and is subject to, the ClauseTrail Terms of Service.

What information do we collect?

We keep the personal information we collect to the minimum needed to run the Service. Specifically:

• Account information: your email address and a hashed password or, if you sign in with Google, the email address and account ID Google shares with us.
• Workspace information: the workspace's name and website, the email addresses of the people you invite, the vendors you track or ask us to add, your review decisions and notes, and your alert settings. If you connect Slack, we keep the webhook address encrypted and use it only to post your alerts to the channel you chose.
• Billing information: handled entirely by our payment processor, Stripe. We do not see or store your card details. The billing name, address and tax ID you enter at checkout are kept by Stripe, which issues your invoices; we keep only the Stripe customer and subscription IDs, your plan, its status and its renewal date.
• Usage and log data: standard server and analytics logs (see below) and, when you sign up, how you found us: the campaign tags of the link you followed, or the directory page you came from.

You can visit our public pages, including the vendor directory, anonymously.

The vendor documents ClauseTrail monitors, such as subprocessor lists, data processing agreements, privacy policies and terms, are public pages on the vendors' own websites. We do not ask for, and you don't need to give us, your contracts, your records of processing, your customers' data or any credentials. A CSV of vendors you import is read to find them in our catalog and is not stored.

What do we use your information for?

We use the limited information we collect only to:

• Operate the Service: authenticate your account, check the vendors you track and show you what changed
• Send the alerts and digests you set up, by email and, if you connect it, to Slack
• Process payments and issue invoices through Stripe
• Send the emails the Service needs (sign-in and account emails, billing notices) and occasional product updates (see below)
• Diagnose issues, prevent abuse, and improve the Service

We do not sell, rent, or share your personal information for advertising purposes.

Marketing communications

If you sign up for ClauseTrail or become a customer, we may send you emails about new features, product updates, tips, and offers related to ClauseTrail. Our legal basis is legitimate interest (for users and customers) under GDPR Article 6(1)(f), or your consent where required. You can opt out at any time by clicking the unsubscribe link in any marketing email, or by emailing [email protected]. Opting out of marketing emails does not affect the emails the Service needs to send. Alert emails have their own settings in your account and their own unsubscribe link.

How do we protect your information?

The security of your personal information is important to us. Every connection to the Service is encrypted with TLS. Passwords and API keys are stored only as one-way hashes, Slack webhook addresses are encrypted in our database, and card details never reach our servers: you enter them on Stripe's checkout page.

We follow generally accepted standards to protect personal information submitted to us, both during transmission and once we receive it. No method of transmission over the Internet, or method of electronic storage, is 100% secure, however. Therefore, we cannot guarantee its absolute security. If you have any questions about security, you can contact [email protected].

Access, correction and deletion

You can change your email address, password and alert settings in your account, and delete your account there yourself. When the last person in a workspace deletes their account, the workspace and everything in it are deleted too; a paid plan has to be cancelled first. For anything else, including a copy of your information, or to object to or restrict how we use it, contact us at [email protected]. We will respond to verified requests within 30 days. You can also complain to a data protection authority; in Portugal, that is the CNPD.

Log files

As is true of most websites, we gather certain information automatically and store it in log files. This information includes internet protocol (IP) addresses, browser type, internet service provider (ISP), referring/exit pages, operating system, date/time stamp, and clickstream data. We use this information to analyze trends, administer the site, and understand how the Service is used as a whole.

Analytics

ClauseTrail uses first-party and third-party analytics tools (for example, Google Analytics) to understand how the site and the app are used. These tools may set cookies and collect information such as IP addresses, browser type, and pages visited. When you're signed in, our product analytics link what you do in the app to your account's email address and your workspace. You can opt out of Google Analytics via the browser add-on at tools.google.com/dlpage/gaoptout.

International data transfers

ClauseTrail is operated by While True Ventures, Lda, a company based in Portugal. Several of the service providers listed below are based in the United States or process information there. If you access the Service from the European Economic Area, the United Kingdom, Switzerland, or any other region with laws governing data collection and use, your personal information may be transferred to, processed, and stored in the United States.

For transfers of personal information from the EEA, UK, or Switzerland to the United States, we rely on appropriate safeguards under applicable law, including the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where relevant), or the EU-US Data Privacy Framework where the receiving party is certified. By using the Service, you acknowledge and consent to this transfer and processing.

Do we disclose any information to outside parties?

We do not sell your personal information. We may share personal information with third parties only in the ways described in this privacy statement.

Other companies provide the services below to us, and may use your personal information only as necessary to provide them:

Hosting

Runs the app and its database. Receives everything the Service stores.

Content delivery

Serves the site, protects it from attacks, and stores the vendor pages we fetch. Receives every request to the site, with its IP address and browser.

Payments (Stripe)

Takes payments, issues invoices and runs the billing portal. Receives your email address, workspace name and billing details.

Email delivery

Sends our emails. Receives your email address and the emails we send you, alerts included.

Analytics

Measures how the site and the app are used. Receives how you use them, with your email address and workspace while you're signed in.

Error monitoring

Collects our error reports. Receives the request that failed, with its IP address and browser.

Team notifications

Tells our team about new sign-ups and subscriptions. Receives the email address and workspace name of each one.

To read vendors' public documents, we also use AI models and page-rendering services. They receive the vendors' public pages, never information about you.

We may also disclose your personal information as required by law, such as to comply with a subpoena or similar legal process, when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

If ClauseTrail is involved in a merger, acquisition, or sale of all or a portion of its assets, you will be notified via email and/or a prominent notice on our site of any change in ownership or uses of your personal information.

How long we keep your personal information

We keep your personal information only for as long as we need to, in accordance with this privacy policy. If your personal information is no longer required, we will delete it or make it anonymous by removing all details that identify you.

However, if necessary, we may retain your personal information for compliance with a legal, accounting, or reporting obligation, or for statistical purposes.

Cookies

Cookies are a feature of web browser software that allow web servers to recognize the computer used to access a site. ClauseTrail uses cookies to keep you signed in, protect its forms, and remember your preferences, such as the dark theme. Our analytics tools may set their own (see Analytics).

Changes to this policy

We may update this privacy statement to reflect changes to our information practices. If we make any material changes we will notify you by email (sent to the email address specified in your account) or by means of a notice on this site prior to the change becoming effective. We encourage you to periodically review this page for the latest information on our privacy practices.

About us

ClauseTrail is a service of While True Ventures, Lda, Portugal (VAT ID 517180960), the controller of the personal information this policy describes. If you wish to contact us for any reason (for example, if you have any queries, or if you wish to exercise any of your rights under this policy), please contact us at [email protected].