Privacy Policy
Effective August 28, 2026 · Last updated August 28, 2026
CraftAClause.com ("CraftAClause," "we," "us," or "our") helps small teams write and maintain their security and operations policies. You're trusting us with documents that describe how your business protects itself, so we've tried to write this in plain English and keep it honest.
Built and hosted in the United StatesThe short version
- We collect your email, the answers you give about your business, and the policy documents you create or upload.
- We use that data to run the product — nothing more. We don't sell it, and we don't run ads.
- Your policy text is sent to AI providers only to draft and review it for you. It isn't used to train their models.
- Everything is hosted in the United States. See our subprocessors for the full list of who we share data with and why.
- You can export your data or ask us to delete your account at any time through our contact form.
This summary is here to help you get oriented. The full policy below is what governs.
1. Who this policy covers
This policy applies to the CraftAClause website at craftaclause.com and the CraftAClause application (together, the "Service"). It explains what we collect, why, and what you can do about it. It does not cover third-party websites we link to, or the internal privacy practices of the businesses that use our Service to manage their own policies.
CraftAClause is intended for businesses and the people who work for them, located in the United States. By using the Service, you agree to this policy. If you don't agree, please don't use the Service.
2. Information we collect
Information you give us
- Account and sign-in. We use passwordless sign-in, so we don't store a password. When you request access or sign in, we collect your email address and send a one-time magic link to it.
- Waitlist and invitations. If you request an invite, we store your email and your invitation status so we can let you in when a spot opens.
- Business profile. The answers you provide about your organization (for example, company name, industry, and preferences) that we use to tailor the policies you generate.
- Policy content. The documents you create, import, edit, and version within the Service, including any text you submit to the AI features.
- Team and sharing. Workspace membership, the colleagues you invite, and any read-only share links you create.
- Communications. Messages you send to us (for example, support or security emails).
Information we collect automatically
- Log and usage data. IP address, browser and device type, pages viewed, actions taken, and timestamps.
- Cookies. A session cookie that keeps you signed in, plus limited analytics described in Section 6.
We do not intentionally collect sensitive personal information, and we ask that you not put personal data you don't need into your policy documents.
3. How we use information
We use the information above only to run and improve the Service, specifically to:
- Authenticate you and keep your account secure.
- Store, version, and let you export your policies.
- Provide the AI drafting and review features you ask for.
- Send you service email — magic links, review reminders, and important account or security notices.
- Operate, maintain, debug, and improve the Service, and monitor for abuse or security issues.
- Comply with law and enforce our terms.
We do not sell your personal information, and we do not use it for third-party advertising.
4. AI processing of your policies
When you use the builder or the co-editor, the policy text and instructions you submit are sent to third-party AI providers so they can draft or review the document for you. This is a core part of how the Service works.
- We share only what's needed to fulfill your request — the relevant policy text and your prompt.
- Under our arrangements with these providers, your content is not used to train their models.
- We don't sell your content, and the AI providers act as our subprocessors, not independent controllers of your data.
5. When we share information
We share data only in these limited situations:
- Subprocessors. Vetted service providers who process data on our behalf to run the Service — email delivery, AI drafting and review, hosting, and infrastructure. The current list, what each does, and where it operates is on our subprocessors page.
- Your own sharing. If you create a read-only share link or invite a colleague to a workspace, you're choosing to share that content. You can revoke access at any time.
- Legal and safety. When we reasonably believe disclosure is required by law, or is necessary to protect the rights, property, or safety of CraftAClause, our users, or the public.
- Business transfers. If CraftAClause is involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction, subject to this policy.
6. Cookies and analytics
We use a strictly necessary session cookie so you stay signed in — the Service doesn't work without it. On our public marketing pages we also use a privacy-oriented analytics tool to understand how the site is used and to improve it. We don't use advertising cookies or cross-site tracking. Most browsers let you block or delete cookies, though blocking the session cookie will prevent sign-in.
7. How long we keep data
We keep your account and policy data for as long as your account is active, and as long as we need it to provide the Service. When you delete your account or ask us to delete your data, we remove it within a reasonable period, except where we need to retain limited records to comply with law, resolve disputes, or enforce our agreements. Backups and logs age out on our normal cycles.
8. How we protect data
We take security seriously and use reasonable administrative, technical, and organizational safeguards to protect your information — including encrypted connections, access controls, and passwordless sign-in. Your policy content is hosted on infrastructure located in the United States.
9. Your choices and rights
You have straightforward control over your data. You can:
- Access and export your policies from within the Service, including PDF export of any version.
- Correct your profile and policy content directly in the app.
- Delete your account and associated data through our contact form.
- Opt out of non-essential email. Note that some service messages (like security and account notices) are required to use the Service.
We'll respond to verifiable requests within a reasonable time. Depending on where you live, you may have additional rights under applicable state law; contact us and we'll help you exercise them. We won't discriminate against you for exercising any privacy right.
10. Data location
CraftAClause is operated, and your data is stored and processed, in the United States. Our subprocessors also process data in the United States. If you access the Service from outside the U.S., you understand your information will be processed here.
11. Children's privacy
The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we'll delete it.
12. Not legal advice
13. Disclaimers
THE SERVICE AND ALL CONTENT IT PRODUCES ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WITHOUT LIMITATION IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, AND NON-INFRINGEMENT. We do not warrant that the Service will be uninterrupted, error-free, or secure, or that any policy generated through it will be accurate, complete, current, or sufficient for your needs or any legal or regulatory requirement. The Service is currently offered as a free private beta and may change or be discontinued at any time.
14. Limitation of liability
TO THE MAXIMUM EXTENT PERMITTED BY LAW, CRAFTACLAUSE AND ITS OWNERS, OPERATORS, AND SUPPLIERS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, GOODWILL, OR OTHER INTANGIBLE LOSSES, ARISING OUT OF OR RELATED TO YOUR USE OF (OR INABILITY TO USE) THE SERVICE OR ANY CONTENT IT PRODUCES, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THIS INCLUDES, WITHOUT LIMITATION, ANY DAMAGES RESULTING FROM RELIANCE ON A POLICY, A SECURITY INCIDENT, OR A COMPLIANCE OR REGULATORY OUTCOME.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, OUR TOTAL LIABILITY FOR ALL CLAIMS RELATING TO THE SERVICE WILL NOT EXCEED THE GREATER OF (A) THE AMOUNT YOU PAID US FOR THE SERVICE IN THE TWELVE MONTHS BEFORE THE CLAIM, OR (B) ONE HUNDRED U.S. DOLLARS ($100). Some jurisdictions don't allow certain limitations, so parts of this section may not apply to you.
15. Governing law and disputes
This policy and any dispute arising out of or relating to it or the Service are governed by the laws of the State of Texas, without regard to its conflict-of-laws rules.
Informal resolution first. Before filing any claim, you agree to contact us through our contact form and give us at least 30 days to resolve the issue informally.
Binding arbitration. If we can't resolve a dispute informally, you and CraftAClause agree that any dispute arising out of or relating to this policy or the Service will be resolved by final and binding individual arbitration administered in the State of Texas under the rules of a recognized arbitration provider, rather than in court, except that either party may bring an individual claim in small-claims court. The arbitrator decides all issues, except that a court decides the enforceability of this arbitration provision.
Class-action waiver. You and CraftAClause agree to bring claims only in an individual capacity, and not as a plaintiff or class member in any purported class, collective, consolidated, or representative proceeding. The arbitrator may not consolidate more than one person's claims or preside over any form of a representative or class proceeding.
If any part of this section is found unenforceable, the rest remains in effect, except that if the class-action waiver is found unenforceable, this entire arbitration section will not apply.
16. Changes to this policy
We may update this policy as the Service evolves. When we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you. Continuing to use the Service after a change means you accept the updated policy.
17. Contact us
Questions, requests, or concerns about your privacy? Send us a note through our contact form, and choose the "Security" topic for anything security-related.