1. Scope
This policy applies to the PactSage website, web application, mobile application, APIs, and related support interactions. “PactSage,” “we,” and “us” refer to the operator of those services.
The important document disclosure: documents you scan or upload leave your device. PactSage stores them and sends relevant content to third-party AI providers so the service can extract text, analyse terms, create embeddings, and answer questions. Do not upload material you are not authorised or willing to have processed this way.
2. Information we collect
Account and profile information
We collect the username, email address, password hash, preferences, plan and billing status, and profile details you choose to provide. We do not store your plain-text password.
Google sign-in information
If you continue with Google, Google sends PactSage a stable account identifier and basic profile information covered by the openid, email, and profile scopes. Depending on your Google profile, that can include your email address, name, profile image, and email verification status.
Documents and product content
We collect uploaded files, extracted text, analyses, clauses, redlines, obligations, deadlines, counterparties, spaces, conversations, messages, tags, notes, and other content you add to the service.
Transactions, support, and technical data
We receive plan selections, payment status and transaction references from our payment provider, plus information you submit in sales or support messages. Requests necessarily carry technical information such as an IP address and browser request headers. We may use an IP address transiently for security, rate limiting, and approximate country or currency selection.
3. How we use information
We use information to:
- create, authenticate, secure, and support your account;
- store documents and provide extraction, analysis, search, chat, and alerts;
- apply plan limits, process payments, and maintain transaction records;
- send password resets, deadline alerts, and service communications;
- measure whether the product works and improve reliability and usability;
- prevent abuse, investigate failures, and comply with legal obligations.
PactSage does not sell personal information and does not use Google account data or uploaded documents for targeted advertising.
4. Google sign-in data
Google sign-in is used only to create or locate your PactSage account and sign you in. PactSage requests only openid, email, and profile. We do not request access to Google Drive, Gmail, Calendar, contacts, or other Google product content.
We keep the Google account identifier and profile details needed to maintain the login connection. We do not transfer Google user data for advertising, sell it, or allow people to read it except where needed to operate, secure, support, or legally protect the service.
Removing PactSage from your Google Account permissions stops future Google authorisation but does not by itself delete your PactSage account. Use our account-deletion process for that.
5. Documents and AI processing
PactSage sends document content and prompts to configured third-party AI services, including OpenRouter-hosted models and Google Gemini services, to perform OCR, generation, analysis, embeddings, and question answering. The provider used can change when a model is unavailable or the service is improved.
PactSage does not use your documents to train a PactSage model. Third-party providers process content under their own service terms and privacy commitments. Avoid uploading secrets or personal data that are not necessary for the task.
AI output can be incomplete or wrong. PactSage is not a law firm, and its output is not legal advice. Review source quotations and consult a qualified lawyer for a binding opinion.
6. Cookies, local storage, and analytics
PactSage uses strictly functional cookies for the signed-in session, selected workspace, navigation state, and short-lived Google OAuth security state. The site also uses local or session storage for theme preference, interface state, and anonymous first-party analytics identifiers.
Marketing analytics records the page path without its query string, referrer domain, campaign labels, and a small set of events such as page view, pricing exposure, engagement, and contact intent. Random browser and tab identifiers are one-way hashed before storage. PactSage does not persist the raw identifier, full referrer URL, query string, or IP address in an analytics event.
The marketing tracker honours Global Privacy Control and Do Not Track. Blocking storage or scripts may also stop these analytics events without preventing the public site from working.
7. When information is shared
We share information only as needed with:
- AI and embedding providers that process document content;
- hosting, storage, database, email, monitoring, and security providers;
- Razorpay or another disclosed payment provider when you purchase a plan;
- workspace members you authorise, according to their role;
- authorities or advisers when required by law or necessary to protect rights and safety;
- a successor in a merger, financing, reorganisation, or sale, subject to appropriate safeguards.
Providers receive only the information reasonably needed for their task. Their own terms may also apply to their processing.
8. Retention and deletion
Account details, documents, extracted text, analyses, spaces, conversations, contracts, and obligations remain available until you delete the relevant item or your account, unless a shorter operational limit applies.
Deleting your account permanently removes the account and the scans, spaces, organisations, contracts, and authentication tokens that belong to it. Some de-identified transaction, subscription, analytics, support, security, audit, or legal records may remain where needed for fraud prevention, accounting, dispute handling, or legal compliance. Backup copies can remain until routine backup rotation completes.
The external request path and the exact categories removed are described on the Account deletion page.
9. Security
PactSage uses access controls, server-side session handling, encrypted transport on the hosted service, scoped workspaces, and operational safeguards intended to protect information. No internet service can promise perfect security. Protect your credentials, use a unique password, and contact us if you suspect account misuse.
10. Your choices and rights
You can update account preferences in Settings, disable deadline emails, remove individual product content where the interface provides that control, revoke Google access through your Google Account, and delete your PactSage account.
Depending on the law that applies to you, you may also request access, correction, export, restriction, objection, or deletion. Email support@pactsage.com from the address on your account so we can verify the request.
11. Changes and contact
We may update this policy when the service, providers, or legal requirements change. The effective date at the top identifies the current version. Material changes may also be communicated in the service or by email where appropriate.
Privacy questions can be sent to support@pactsage.com. General product enquiries can also be submitted through the contact form.