Privacy Policy

Effective date: October 5, 2026  ·  Last updated: October 5, 2026

Changes: 2026-10-05 — transactional email via Resend is live (verification is required before a paid plan); sign-in now uses one strictly necessary HttpOnly session cookie instead of browser storage; optional two-step verification; stronger password hashing; error reports filter document text. 2026-09-07 — sub-processor list, retention periods and security description updated to match the service.

1. Who We Are

IdaMil LLC ("IdaMil™," "we," "us," or "our") is an AI-assisted contract analysis platform designed for attorneys and law firms. This Privacy Policy describes how we collect, use, store, and disclose personal information when you use our website (contractus.idamil.com) and web application (together, the "Service").

IdaMil LLC is the data controller for your account and personal information. For contract documents you upload, IdaMil LLC acts as a data processor on your behalf.

2. What We Collect

Account information

When you register, we collect your name, email address, and hashed password (we never store your password in plain text). If you upgrade, we also collect your billing information through our payment processor (Stripe — see Section 5). We do not store full credit card numbers.

Usage data

We log which tools you use (Review, Draft, Redline, etc.), timestamps, and counts to enforce plan limits and generate your usage dashboard. We do not log the content of your AI queries or results in our audit log — only the action type, associated contract name (if saved), matter/client names and filenames, and timestamp.

Contract library metadata

When you upload a file or save a contract to your library, we store the contract name, type, status, matter assignment, expiry date (if entered), and the full contract text. This data is associated with your account and stored in our secure database. You control this data — you can rename, delete, or export it at any time.

Technical data

Standard server logs including IP address, browser type, and request timestamps. These are used for security monitoring, rate limiting, and debugging. Logs are retained for 30 days.

Waitlist

If you join the waitlist we store the email, name, firm, headcount and message you give us, the page you came from and your IP address, until you ask us to remove them.

Communications

If you contact support, we retain that correspondence. Stripe sends billing receipts. We send transactional emails (password reset, email verification, firm invitations, payment notices) via Resend.

3. How We Use Your Data

• To provide the Service: Run AI analysis on your documents, maintain your contract library, enforce plan limits, and authenticate your account.
• To process payments: Pass billing information to Stripe to handle subscriptions and receipts.
• To send transactional communications: Stripe sends billing receipts. We send transactional emails (password reset, email verification, firm invitations, payment notices) via Resend.
• To improve reliability: Error monitoring via Sentry (browser type, page URL and error details; sign-in tokens are scrubbed; document content is not sent).
• To enforce our Terms of Service: Detect abuse, enforce rate limits, and investigate security incidents.
• Legal compliance: To respond to lawful requests from courts or government authorities.

We do not use your data for advertising, profiling, or behavioral targeting. We do not sell your data. We do not share your data with data brokers.

4. Your Documents — Special Rules

Pasted text

When you paste text into a tool (Review, Redline, Extract, etc.), the text is:

1. Transmitted over TLS to our server
2. Passed to Anthropic's Claude API for analysis (see Section 5)
3. Discarded from our server memory after the response is returned

We do not write pasted text to disk, log it, or retain it in any database. The analysis result is returned to your browser and displayed — it is not stored server-side unless you explicitly export or save it.

Uploaded files and documents saved to your library

Text you paste into a tool is processed in memory and discarded after the response is returned. Files you upload are saved to your contract library (full text) so you can reuse them across tools; you can delete them at any time. Library contents are stored in your account database, encrypted at rest (Cloudflare D1). You own this data. You can delete individual contracts at any time from the library, or delete your whole account (see Section 8).

AI model and your documents

Contractus™ uses Anthropic's Claude API to process documents. Anthropic's commercial API terms prohibit using customer-submitted data to train their AI models. Your documents do not train Claude or any other AI model. For more information, see Anthropic's Privacy Policy.

Attorney-client privilege considerations

Contractus™ is designed as an attorney work-product tool. We do not assert any interest in documents you submit. We strongly recommend that attorneys review their state bar's guidance on cloud-based legal tools and AI before use, and ensure their engagement letters address the use of AI-assisted tools where appropriate. See our Ethics Resources section for state bar guidance links.

5. Data Sharing and Sub-Processors

We share data with the following sub-processors to operate the Service. Sub-processors operate under their published terms and privacy policies:

Sub-Processor	Purpose	Data Shared
Cloudflare	Hosting, serverless functions, D1 database	All stored data (account, library, audit log); request logs
Anthropic	AI analysis (Claude API)	Document text sent for analysis only; not used for training
Stripe	Payment processing and billing receipts	Billing info, email, subscription status
Resend	Transactional email delivery	Name, email address, email content
Sentry	Browser error monitoring	Browser type, page URL and error details; sign-in tokens scrubbed; no document content
Plausible	Cookieless analytics	Page views and referrer; no cookies, no personal identifiers
FormSubmit	Enterprise contact form delivery	Name, email, firm, phone and message you submit on the Enterprise contact page
Google Fonts	Font files	Your IP address is disclosed to Google on page load
Cloud storage providers (not yet available) (Google Drive, Dropbox, OneDrive, Box, Clio)	Document import (when these integrations ship and you connect them)	OAuth tokens stored per your account; document content retrieved on demand only

We do not share your data with any other third parties except as required by law.

6. Data Retention

• Account data: Retained while your account is active; deleted immediately when you delete your account.
• Contract library: Retained until you delete individual contracts or delete your account.
• Pasted text: Not retained — discarded immediately after analysis.
• Audit logs (action type, timestamp): 30 days.
• Server logs (IP, request data): 30 days.
• Billing records: 7 years as required by financial regulations.
• Support correspondence: 3 years.

7. Security

We implement security measures proportionate to the sensitivity of attorney work-product data:

• Encryption in transit: TLS via Cloudflare.
• Encryption at rest: Cloudflare D1.
• Passwords: Salted and hashed with PBKDF2-SHA256 (600,000 iterations, in six chained rounds); never stored in plain text.
• Sessions: 7-day session in a secure, HttpOnly cookie that page scripts cannot read; optional two-step verification (authenticator app) for every account.
• Rate limiting: On sign-in, signup, password reset and AI calls.
• Audit log: AI, library and account actions are logged and retained 30 days.
• Security headers: HSTS, a Content-Security-Policy that blocks inline and third-party scripts we have not approved, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy on every response.
• Analytics and monitoring: Cookieless Plausible analytics and Sentry error monitoring (credentials and document text are filtered out of error reports); no advertising trackers.

No system is perfectly secure. If you discover a security vulnerability, please report it responsibly to customer.service@idamil.com.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate personal data.
• Deletion: Request deletion of your account and all associated data. You can initiate this from Account → Delete Account within the app, or by emailing customer.service@idamil.com. Account deletion is immediate. Billing records required by law are retained for 7 years as noted above.
• Data portability: Export your contract library as a JSON file from Account → Export My Data.
• Objection: Object to certain processing activities.
• Withdraw consent: Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, email customer.service@idamil.com. We will respond within 30 days.

9. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA:

• The right to know what personal information we collect, use, and disclose.
• The right to delete your personal information (subject to certain exceptions).
• The right to opt out of the sale or sharing of personal information. We do not sell or share personal information.
• The right to non-discrimination for exercising your CCPA rights.
• The right to correct inaccurate personal information.
• The right to limit use of sensitive personal information. We do not use sensitive personal information beyond what is necessary to provide the Service.

To submit a CCPA request, email customer.service@idamil.com with "CCPA Request" in the subject.

10. Virginia Residents (VCDPA)

As a Virginia limited liability company, we comply with the Virginia Consumer Data Protection Act (VCDPA). Virginia residents have the following rights:

• The right to confirm whether we are processing your personal data and to access that data.
• The right to correct inaccuracies in your personal data.
• The right to delete your personal data.
• The right to obtain a copy of your personal data in a portable and readily usable format.
• The right to opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling. We do not engage in any of these activities.

To exercise your VCDPA rights, email customer.service@idamil.com. We will respond within 45 days. If we decline your request, you may appeal by contacting us with "VCDPA Appeal" in your message. If you are unsatisfied with our response to your appeal, you may contact the Virginia Attorney General at oag.state.va.us.

11. Cookies and Tracking

Contractus™ sets one cookie, and only when you sign in: __Host-cx_session, your sign-in session (7 days; Secure, HttpOnly, SameSite=Lax, readable only by our servers). It is strictly necessary and is removed when you sign out or delete your account.

We also use browser localStorage for the following strictly functional preferences:

• contractus_cookie_consent — whether you have dismissed the storage notice
• contractus_jurisdiction — your jurisdiction preference (to pre-fill the jurisdiction selector)
• frb_shown — whether the first-run banner has been shown
• contractus_notice_dismissed — whether you have dismissed the AI notice banner

These are essential to the operation of the Service. You can clear them at any time by clearing your browser's local storage. We use Plausible, a cookieless, privacy-focused analytics script, and Sentry browser error monitoring. There are no advertising trackers and no other cookies.

12. Children

Contractus™ is a professional legal tool intended for licensed attorneys and law firm personnel. We do not knowingly collect personal information from anyone under the age of 18. If you believe a minor has provided us with personal information, please email customer.service@idamil.com and we will promptly delete that information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice by email or in-app notice before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was most recently revised.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree with a change, you may cancel your subscription before the effective date.

14. Contact Us

If you have questions about this Privacy Policy, how we handle your data, or billing, email customer.service@idamil.com.