1. Who we are
Contract Loop provides contract drafting and contract review for companies in the supply chain. For the personal data described in this policy, Contract Loop is the controller — except for the contents of documents you send us as a client, where we generally act as a processor on your instructions under a separate data processing agreement.
You can reach us about anything in this policy at info@contractloop.eu.
2. What this policy covers
It covers the Contract Loop website at www.contractloop.eu, the request forms on it, and the internal staff dashboard at internal.contractloop.eu. It does not cover third-party websites we link to.
3. What we collect
When you send us a request
- Contact and company details you type into the form — your name, company, email address, and any phone number or role you choose to give.
- What you tell us about the work — the objective of the contract, the parties involved, the governing law, deadlines and any other free-text answers.
- Documents you upload — contracts, annexes, price lists and similar files (PDF, Word, Excel, CSV, ODF, plain text and images, up to 10 MB per file and 10 files per request). These frequently contain personal data about your own staff and counterparties.
When you email us
Your message, your address and anything you attach.
When staff use the internal dashboard
Sign-in is restricted to a short, explicitly listed set of Contract Loop staff addresses. Only the verified email address of the signed-in person is used, to check they are on that list and to record who uploaded or acted on a file. Google account data is not used for any other purpose, is not sold, and is not shared with anyone else.
Automatically, when you visit
Our server processes the usual technical request data — IP address, timestamp, requested URL, user agent — as part of serving and securing the site.
What we do not do. There is no analytics package, no advertising pixel and no third-party tracker anywhere on this site. We do not build profiles of visitors and we do not sell or rent personal data to anyone.
4. Why we process it, and on what basis
| Purpose | Lawful basis (GDPR Art. 6) |
|---|---|
| Answering your request and preparing a quote | Steps taken at your request prior to entering a contract — Art. 6(1)(b) |
| Drafting or reviewing the contract you asked for, and delivering it | Performance of our contract with you — Art. 6(1)(b) |
| Restricting and logging staff access to client files | Legitimate interest in the security and confidentiality of client documents — Art. 6(1)(f) |
| Keeping the site and the API available and free of abuse | Legitimate interest in the security of our service — Art. 6(1)(f) |
| Invoicing and keeping the records we are required to keep | Legal obligation — Art. 6(1)(c) |
5. AI processing
Contract Loop uses AI to produce a first draft only. The content of your request and your uploaded documents is sent to our AI provider to generate that draft. A named contract expert then reads, corrects and signs off on every output before anything is delivered to you — nothing reaches you on the strength of a model's confidence alone.
AI processing runs under enterprise terms that exclude training on submitted content. Your contracts are not used to train third-party AI models. What we build from our work is an internal playbook of clause positions and fallback wording, written by our experts in generic terms and containing no commercial details, party names or figures from your file.
6. Who else processes your data
We use a small number of sub-processors, each under a data processing agreement and each only for the purpose named:
| Sub-processor | What it does for us |
|---|---|
| Google (Gemini API) | Generates the AI first draft from your request and documents |
| Google (Drive) | Stores request documents and generated drafts for the assigned expert |
| Resend | Sends transactional email — your confirmation, and the internal notification |
| Railway | Hosts the website and the drafting service |
| Google Fonts | Serves the site's typefaces; your browser requests them directly, which discloses your IP address to Google |
Beyond these, we disclose personal data only where we are legally required to, or where you ask us to. We do not sell personal data.
7. Where your data is stored
Your documents and the related metadata are held by the sub-processors named in section 6 — managed cloud services that we hold under contract, not personal devices or consumer accounts. Several of those providers are established outside the EEA, so part of the processing takes place outside the EEA. Those transfers rely on an appropriate safeguard, in practice the European Commission's Standard Contractual Clauses, which form part of each provider's data processing terms. We will confirm the current sub-processor list and the applicable safeguards in writing before you send us anything — ask, and it is included in the data processing agreement.
8. How long we keep it
- Uploaded documents and generated drafts: deleted automatically 180 days after the request, unless you have asked us to hold them for longer or we still need them to support the delivered work.
- Correspondence and request details: kept for the duration of the working relationship and a reasonable period afterwards.
- Invoicing records: kept for the period our tax law requires.
You can ask us to delete your documents at any point, including before the 180 days are up. Send the request to info@contractloop.eu and we delete them and confirm it in writing, retaining only what we are legally required to keep.
9. Security
- Everything moves over TLS and is encrypted at rest.
- Access is need-to-know: only the contract expert assigned to your file, and where strictly necessary a second expert for quality control, can open it. Every expert is under a written confidentiality obligation.
- The internal dashboard is behind authentication and restricted to an explicit list of staff addresses; the file store it reads is scoped to a single folder and cannot reach anything above it.
- Once your file is open with us, nothing sensitive is sent as an unprotected email attachment.
We are happy to sign an NDA before you send anything — ours or yours.
10. Cookies
We set no analytics or advertising cookies. The only cookies this site uses are strictly necessary ones:
- Access cookie — while the site is a private draft, it records that the correct access password was entered, so you are not asked again on every page.
- Dashboard session cookie — on
internal.contractloop.eu, keeps a signed-in staff member signed in for the length of their session.
Because these are strictly necessary to deliver a service you asked for, they do not require consent. You can clear them in your browser at any time; you will simply be asked to sign in again.
11. Your rights
Under the GDPR you have the right to:
- ask what personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have data erased, where we have no overriding obligation to keep it;
- ask us to restrict processing, or object to processing based on our legitimate interests;
- receive data you gave us in a portable, machine-readable format;
- withdraw consent, where processing rests on consent, without affecting what was lawful beforehand.
Write to info@contractloop.eu and we will respond within one month. If you are unhappy with how we handled it, you can lodge a complaint with your national data protection authority.
If you are a client and the request concerns your own contract documents, we usually act as processor for those. Send the request to us and we will forward it to the controller and act on their instructions.
12. Changes to this policy
If we change how we handle personal data, we update this page and move the "last updated" date at the top. Where a change is material, we tell active clients directly.
13. Contact
Questions about this policy, or about anything we hold: info@contractloop.eu. We would rather answer ten questions up front than have you wondering afterwards.