Privacy Policy

Marketing Studios ("Company", "we", "us", or "our") operates ContractDiff and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

This policy complies with:

• GDPR (EU General Data Protection Regulation)
• CCPA (California Consumer Privacy Act)
• IT Act 2000 (India Information Technology Act)
• Privacy Act 1988 (Australia)
• PIPEDA (Canada Personal Information Protection)

1. Information We Collect

1.1 Information You Provide

• Account Information: Name, email address, password, company name
• Contract Data: Documents you upload for analysis (processed locally, not stored on our servers unless explicitly saved)
• Payment Information: Billing address, payment method details (processed by Razorpay/Stripe)
• Communications: Support tickets, feedback, correspondence

1.2 Automatically Collected Information

• Usage Data: Features used, analysis frequency, session duration
• Device Information: Browser type, operating system, IP address
• Cookies: Session management, preferences, analytics

2. How We Use Your Information

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Respond to your comments and questions
• Analyze usage patterns to improve user experience
• Detect, prevent, and address technical issues

3. Data Processing & Storage

Local Processing: Contract analysis is performed entirely in your browser. Your contract text is NOT transmitted to our servers unless you explicitly choose to save it to your account.

Data Residency: Account data is stored in secure data centers. EU users' data remains within the EU (AWS Frankfurt). Indian users' data is processed per IT Act 2000 requirements.

4. Data Sharing & Disclosure

We do NOT sell your personal information. We may share data with:

• Service Providers: Hosting (AWS), payments (Razorpay/Stripe), analytics (privacy-focused)
• Legal Requirements: When required by law or to protect rights
• Business Transfers: In connection with merger, acquisition, or asset sale

5. Your Rights

5.1 All Users

• Access your personal data
• Correct inaccurate data
• Delete your account and data
• Export your data in portable format
• Opt-out of marketing communications

5.2 GDPR Rights (EU/EEA Users)

• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent
• Right to lodge complaint with supervisory authority

5.3 CCPA Rights (California Residents)

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to say no to the sale of personal information
• Right to equal service and price

5.4 Indian Users (IT Act 2000)

• Right to access sensitive personal data
• Right to correct or amend data
• Right to withdraw consent
• Grievance redressal within 30 days

6. Data Retention

We retain your data for as long as your account is active. Upon account deletion:

• Personal data is deleted within 30 days
• Backups are purged within 90 days
• Anonymized analytics may be retained indefinitely

7. Security

We implement industry-standard security measures:

• 256-bit TLS encryption in transit
• AES-256 encryption at rest
• SOC 2 Type II compliance
• Regular security audits and penetration testing
• Multi-factor authentication available

8. Cookies

We use essential cookies for authentication and preferences. Analytics cookies are optional and can be disabled in settings.

9. Children's Privacy

Our services are not intended for users under 16. We do not knowingly collect data from children.

10. International Transfers

Data may be transferred internationally with appropriate safeguards (Standard Contractual Clauses for EU transfers).

11. Changes to This Policy

We will notify you of material changes via email or in-app notification at least 30 days before they take effect.