This describes what Gig Clause collects, why, and what you can do about it. For a shorter, plainer version with live numbers, see the trust and security page, this document is the fuller reference underneath it.
1. What we collect
- Your verified email address and name from Google Sign-In, used to identify your account and, if you opt in, product updates.
- The contract text you submit for review or the fields you fill in to draft one, and the analysis or draft generated from it.
- Billing metadata (your plan, renewal date), handled by Paddle, who holds your actual card details, we never see or store a card number.
- Usage events (which feature you used, when) to enforce rate limits and understand product usage in aggregate.
- A hashed IP address, used for anti-abuse rate limiting and, where you use the e-signature feature, as part of the signature record.
If you use the “don’t save this to history” option on a review, the contract text is used only in memory to generate that one report and is never written to the database at all.
2. How we use it
- To run the analysis or drafting pipeline and show you the result.
- To maintain your review and contract history, share links, and renewal reminders.
- To improve the clause corpus, in anonymized and aggregated form only, individual contract text is never used to train a model or published anywhere.
- To respond when you contact us for support.
3. Who it’s shared with
A short, named list, not a vague reference to “third parties.”
- Google Sign-In: Handles authentication. We receive your verified email and name, never your Google password.
- Google (Gemini API): Reads the contract text you submit to run the analysis. Not used to train third-party models on the paid API tier.
- Turso: Hosts the database: your account, review history, and drafted contracts.
- Resend: Sends renewal reminders and other account emails, not used for sign-in. Never used for marketing without opting in.
- Paddle: Merchant of record for billing. Paddle handles your card details and receipts directly; Gig Clause never sees or stores a card number.
- Vercel: Hosts the application itself.
We do not sell or share your personal information with anyone for their own marketing purposes. There is no advertising on Gig Clause and no ad-tracking pixels.
4. Cookies
cg_session: your sign-in session, httpOnly, required for the dashboard to work.cg_oauth_state: a short-lived (10-minute) anti-forgery check used only during the Google Sign-In flow itself, not a tracking cookie.cg_ref: an optional referral code from a shared link, kept for 30 days so a referral can be credited if you sign up.- If you start a checkout, Paddle’s own checkout script may set its own cookies while that overlay is open, those are governed by Paddle’s privacy policy, not ours.
We don’t use analytics cookies or third-party ad trackers.
5. How long we keep it
- Reviews run signed out (anonymous): auto-deleted after 7 days.
- Reviews and drafts you save: kept until you hard-delete them, which is instant, from your dashboard.
- A contract your client has already countersigned: kept as the mutual legal record you both rely on, even if you later delete your account, it’s orphaned from the login rather than removed.
- Your account: deleted, along with your reviews and usage history, the moment you click delete in your dashboard, no waiting period, no support ticket.
6. Your rights
Access and portability: your dashboard has a one-click export of every review and contract you have, as a single JSON file, anytime, no request needed. Deletion: the delete-account button in your dashboard is self-serve and immediate. If you’re in the EU, UK, or a US state with its own privacy law (like California’s CCPA/CPRA), these satisfy the access, portability, and deletion rights those laws grant you; we don’t sell personal information, so there’s nothing to opt out of on that front. If you need something those self-serve tools don’t cover, email us and we’ll handle it directly.
7. International data transfers
Our sub-processors above are US-based companies. If you’re accessing the service from outside the US, your data is processed there. Each of these providers maintains its own safeguards for international transfers; we haven’t independently audited them beyond relying on their published compliance posture.
8. Children
Gig Clause is a business tool for freelancers and agencies and isn’t directed at children. We don’t knowingly collect data from anyone under 16.
9. Changes to this policy
We’ll update the date at the top when this changes. Material changes will be reflected here directly, we don’t maintain a separate changelog for this document.
10. Contact
Questions, or a request this page doesn’t cover: contact.tanvir.chowdhury@gmail.com.