Privacy Policy

This Privacy Policy explains how contractX.co and ContractX (collectively, “ContractX”, “we”, “us”, or “our”) collect, use, store, disclose, protect, retain, and delete personal data and other information in connection with the ContractX web platform, mobile applications, marketplace-distributed applications, APIs, and related services.

This Policy applies to the ContractX web platform and authorised distributions through Microsoft Marketplace, Apple App Store, Google Play, and other approved channels, subject to applicable law and platform-specific requirements.

ContractX is designed around data minimisation, purpose limitation, need-to-know access, transparency, accountability, and lawful processing.

We seek to collect and process only information reasonably necessary to provide, secure, support, administer, improve, and lawfully operate the Service.

ContractX does not design its Service around behavioural advertising or the sale of confidential construction project information.

Account data may include name, business email, organisation, job title, account identifiers, authentication metadata, subscription information, and authorised project memberships.

Project and Customer Data may include contracts, amendments, correspondence, notices, schedules, claims, reports, photographs, programme information, metadata, prompts, uploaded documents, and generated reports.

Technical data may include IP address, browser and device information, timestamps, session metadata, application events, diagnostic information, and usage records.

Support data may include support requests, service communications, feedback, billing correspondence, and security-related communications.

We may process information to authenticate users, provide project workspaces, analyse contracts and project records, generate AI-assisted outputs, administer subscriptions, provide support, maintain auditability, investigate misuse, prevent fraud, improve reliability, and comply with legal obligations.

Personal data will not be used for materially incompatible purposes without an appropriate legal basis and, where required, additional notice or consent.

Depending on jurisdiction and context, processing may be based on contract performance, legitimate interests, consent, compliance with legal obligations, protection of legal rights, or another recognised lawful basis.

Where consent applies, Users may withdraw consent subject to legal, contractual, security, or record-retention obligations that continue to apply.

Customers retain ownership of Customer Data. ContractX receives only the limited rights necessary to host, transmit, secure, analyse, retrieve, back up, and otherwise process Customer Data to provide the Service.

ContractX does not acquire ownership of uploaded contracts, schedules, correspondence, claims, commercial records, or other Customer Data merely because those materials are processed through the Service.

ContractX may use artificial intelligence and machine-learning services to assist with extraction, classification, summarisation, analysis, risk identification, drafting, schedule intelligence, claims support, and related functionality.

Customer Data should be disclosed to AI or infrastructure providers only to the extent reasonably necessary to provide the requested functionality and subject to appropriate contractual, confidentiality, privacy, and security safeguards.

ContractX will not intentionally sell confidential Customer Data or use confidential project documents to train a general-purpose ContractX model for unrelated customers without explicit lawful authorisation or an expressly agreed customer programme.

ContractX does not sell personal data, confidential project information, uploaded contracts, claims records, schedule data, or other Customer Data as a standalone commercial asset.

ContractX does not use confidential Customer Data for third-party targeted advertising.

ContractX may use selected providers for cloud infrastructure, database, storage, authentication, email, analytics, payments, AI processing, support, and related operational functions.

Providers should receive only the data reasonably necessary for their function and should be subject to confidentiality, privacy, and security obligations appropriate to the nature of the processing.

Enterprise customers may receive additional subprocessor disclosures or contractual notification mechanisms where agreed.

ContractX may be offered through Microsoft Marketplace, Apple App Store, Google Play, and other authorised channels. Those platforms may independently process account, device, transaction, subscription, analytics, or marketplace information under their own privacy policies and terms.

ContractX will seek to maintain privacy disclosures that accurately describe its actual data practices for each distribution channel.

Where a platform requires privacy disclosures, Data Safety information, consent controls, account deletion, or support information, ContractX will seek to implement and maintain those requirements for the relevant distribution.

ContractX may process data in jurisdictions where ContractX or its approved service providers operate. Where required, appropriate legal or contractual mechanisms should be used for cross-border transfers of personal data.

Enterprise plans may support agreed data-residency or regional-hosting requirements where commercially and technically available.

ContractX will not represent that data is confined to a particular jurisdiction unless that requirement is expressly supported by the relevant architecture and customer agreement.

ContractX will retain personal data and Customer Data only for as long as reasonably necessary to provide the Service, satisfy the purposes for which it was collected, maintain security and auditability, resolve disputes, comply with legal obligations, or enforce agreements.

Different categories of information may have different retention periods. Enterprise customers may agree specific retention schedules where technically and legally feasible.

Where the Service permits account creation, ContractX intends to provide users with a clear mechanism to request account deletion and deletion of associated personal data, subject to lawful retention requirements.

Deletion is distinct from temporary deactivation. Where deletion is requested and no retention obligation applies, associated personal data should be deleted or irreversibly de-identified within a reasonable operational period.

Certain information may be retained where necessary for fraud prevention, legal claims, financial records, regulatory obligations, contractual disputes, security investigations, or other legitimate legal requirements.

Depending on applicable law, individuals may have rights to request access, correction, deletion, restriction, portability, objection, withdrawal of consent, or information about processing of their personal data.

ContractX may need to verify identity and authority before fulfilling a request. Where ContractX processes personal data solely on behalf of an Enterprise customer, the request may be referred to that customer as the relevant controller or responsible organisation.

Mobile applications should request only permissions reasonably necessary for their functionality and should avoid sensitive permissions where a less intrusive alternative is available.

Camera, files, notifications, biometrics, contacts, location, microphone, or photo permissions should not be accessed unless required for a relevant feature and appropriately disclosed or consented to where necessary.

ContractX is intended for professional and business use and is not designed for children.

If ContractX becomes aware that personal data from a child has been collected contrary to applicable requirements, reasonable steps will be taken to delete or otherwise lawfully address that information.

ContractX may update this Privacy Policy as the Service, laws, subprocessors, distribution channels, or business practices evolve.

Material changes may be notified through the Service, by email, through marketplace release information, or by another reasonable method.

Privacy requests, access requests, correction requests, deletion requests, and questions about this Policy may be directed to info@contractx.co until a dedicated privacy contact is published.

Enterprise customers may be provided additional privacy, DPO, legal, or data-processing contact channels under their applicable agreements.