Does Contrax use my contracts to train AI models?

No. Document text is sent to the AI provider only when you run a vendor extraction, to return the extracted terms to your workspace. Contrax does not train models on your contracts.

How do I access or delete my personal data in Contrax?

Email sales@usecontrax.com with your request. Workspace admins can also remove contracts and members from the dashboard.

Summary: Contrax stores the account details, contracts, and renewal data your team puts into the workspace so it can track deadlines and send reminders. We do not sell personal data and we do not train AI models on your contracts. Email sales@usecontrax.com for any privacy request.

Privacy Policy

Last updated: October 21, 2026

This policy explains how Contrax ("we", "us") handles personal data when you visit usecontrax.com or use the Contrax application at app.usecontrax.com (the "Service"). It complements our Terms of Service and Cookie Policy.

Who is responsible for your data

For account, billing, and website data, Contrax is the controller. For the contracts and vendor information a customer uploads into its workspace, the customer organization decides what is stored and why; Contrax processes that content on the customer's behalf to provide the Service.

What we collect

Account data: name, work email, organization, role, and sign-in details managed by our authentication provider.
Workspace content: contracts and documents you upload or import, extracted terms, renewal dates, notice periods, workflow notes, approvals, and the change history of those records.
Vendor contacts: names and emails of vendor representatives you add, for example to confirm renewal dates through the vendor portal.
Integration data: when an admin connects a tool (for example Google Drive, SharePoint, DocuSign, Salesforce, Coupa, NetSuite, Slack, or Microsoft Teams), the files, records, and tokens needed for that connection.
Billing data: plan and subscription status. Card details are collected and stored by Stripe, not by Contrax.
Usage and device data: pages visited, actions in the app, browser type, and IP address, collected through the analytics tools described in our Cookie Policy.
Messages you send us: support tickets, contact forms, and email.

How we use it

To run the Service: store contracts, compute deadlines, and send the reminders and digests you set up.
To extract contract terms when you run a vendor extraction.
To manage your subscription and billing.
To secure the Service, prevent abuse, and keep audit records.
To answer support requests and send service notices.
To understand how the product is used and improve it.

Under the EU General Data Protection Regulation (GDPR), we rely on the performance of our contract with you, our legitimate interests in securing and improving the Service, compliance with legal obligations, and, where required (for example for non-essential cookies), your consent.

AI extraction

When you run a vendor extraction, the document text is sent to our AI provider (Anthropic) to return the extracted terms to your workspace. Extraction only runs when you or an automation you enabled starts it. Contrax does not use your contracts to train AI models.

Benchmarks

Vendor benchmarks are off by default. If a workspace admin opts in, Contrax shares anonymized contract terms (such as notice periods and escalation) in aggregates that are only shown once at least 15 organizations contribute for the same vendor. Opting out removes the workspace's past contributions from the benchmark dataset.

Who we share it with

We do not sell personal data. We share it only with the providers that run the Service on our behalf, with the integrations your admins connect, and when the law requires it. Our main providers are:

Vercel: application hosting, file storage, and site analytics
Clerk: authentication and Enterprise SSO
Our hosted PostgreSQL database provider: primary data storage
Stripe: payments and subscriptions
Resend: transactional email such as reminders and digests
Inngest: scheduled jobs such as reminders and exports
Anthropic: AI extraction when you run an analysis
PostHog and Microsoft Clarity: product analytics

The security-review pack lists these providers with more detail. Some providers are based outside the European Economic Area; where data leaves the EEA, the transfer relies on safeguards recognized under the GDPR, such as the European Commission's standard contractual clauses.

How long we keep it

We keep workspace content while your organization has an account, so reminders and audit history keep working. When an account is closed, or when you ask us to delete data, we delete it or anonymize it, except where we must keep records (for example invoices) to meet legal obligations.

Your rights

Depending on where you live, you can ask to access, correct, delete, or export your personal data, to restrict or object to some processing, and to withdraw consent at any time. Email sales@usecontrax.com. If your data sits in a customer workspace, we may refer your request to that organization. In the EU you can also lodge a complaint with your data protection authority; in France this is the CNIL.

Security

Data is encrypted in transit, access inside a workspace is role-based, and documents are served through authenticated routes. See the security-review pack and trust and data processing for details.

Changes to this policy

We will post updates on this page and change the date above.

Contact

Privacy questions and requests: sales@usecontrax.com, or use the contact page.