What happens to your contract.

The controller for any personal data processed through this service is Contractward. For anything in this policy, including a request about your own data — or to ask a question about it before you send us anything — write to support@contractward.com.

Two things, and only for as long as it takes to answer one request:

• The document you send, or the text you paste. A contract commonly contains personal data — your name, your address, your salary, your bank details, sometimes more. It belongs to you; we treat it as yours throughout.
• The request itself. Ordinary web request data: the time, the response status, and whether the read succeeded or failed. Our own error logs record what went wrong, never what the document said.

We do not ask for your name, your email address or any account details, because the service has no accounts.

• We do not store your document. It is never written to disk, to a database or to object storage.
• We do not keep your report. It exists in the page you are looking at, and it is gone when you close the tab.
• We set no cookies and no local storage, so there is no cookie banner on this site and nothing to consent to.
• We run no analytics, no tracking pixels, no advertising tags, no session recording and no A/B testing scripts. Nothing on this page phones anywhere except the font files and, when you press the button, our own reader.
• We do not build a profile of you, and we have nothing to sell to anyone.
• We do not use your document to train anything of ours — we have nothing to train.

When you press “Read my contract”:

• Your file or pasted text is sent to our server over an encrypted connection.
• If it is a PDF or a Word file, the text is extracted in memory. If it is a photograph, the image is passed through as it is.
• The text or image is sent to OpenRouter, which routes it to the model that does the reading.
• The model's answer comes back, every quoted sentence is checked against your text, and the finished report is returned to your browser.
• The request ends. The document, the extracted text and the report are released from memory along with it.

There is no step in which a copy is kept on our side.

The reading is done by a large language model, which we reach through OpenRouter Inc. OpenRouter passes the request to the provider of the model being used. Both are processors acting on our instructions, and both are outside the United Kingdom, so this involves an international transfer of whatever personal data your contract contains.

We ask OpenRouter to route only to providers that do not retain prompts — the request carries an explicit no-data-collection preference. We cannot independently verify what a given provider does with a request once it has it, and that is the honest limit of this promise.

If a contract contains something you would rather not send to a third party at all — health information, a child's details, bank details, someone else's personal data — redact it before you send it. The reader does not need it to read a clause.

Our hosting provider processes requests in the ordinary course of serving the site, and the fonts on this page are served by Google Fonts, self-hosted at build time by the framework so that your browser does not contact Google while you read.

Under the UK GDPR, we process the contents of your document to perform the service you have asked for, at your request, before or under a contract with you.

A contract can contain special category data — a gym agreement with a medical cancellation clause, an employment contract touching health or trade union membership. We do not ask for it and we do not want it. Where you choose to send it, you are explicitly asking us to process it in order to read the document, and that is the basis on which we do so. If you would rather not, redact it first.

You have the right to ask for access to your personal data, and to its rectification or erasure; to restrict or object to processing; and to data portability. Write to support@contractward.com and we will answer within one month.

In practice, there is very little for us to act on: we hold no copy of your document, no account, and nothing that identifies you. An erasure request about a document you sent us last week cannot be fulfilled, because there is nothing left to erase. That is the point of the design.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or to the supervisory authority where you live.

This service is not intended for use by anyone under 16, and we do not knowingly process the personal data of children. See §5 of the terms of use.

Everything travels over TLS. The API key for the reader lives in server-side configuration and is never exposed to your browser. There is no database to breach and no stored document to leak, which removes most of the risk rather than managing it.

No transmission over the internet is completely secure, and we cannot guarantee the security of data in transit to us.

If this policy changes, the date at the top of the page changes with it. If a change materially affects what happens to your document, the change will be described on the page rather than quietly folded in.