Privacy Policy

What we collect

Freyr And Sons LLC, a Texas limited liability company, operates ClauseSignaland is responsible for the personal data described in this policy. "We" and "us" below mean Freyr And Sons LLC.

ClauseSignal collects only what the service needs to work:

• Your email address and authentication identity.
• The exact FAR/DFARS clause identifiers you choose to watch.
• Subscription and billing state identifiers from Stripe (plan, status, renewal date) — never your card number or other card data, which Stripe collects directly.
• Minimal operational events needed to deliver notifications and diagnose problems (for example, email delivery status).
• Your IP address and basic request metadata, used only to rate limit and protect public pages, search, and sign-in. Rate limit counters are keyed by IP address and deleted once they are older than 24 hours; our hosting provider keeps its own short-lived request logs.
• Strictly necessary authentication and session cookies set by our auth provider so you stay signed in. We set no advertising, tracking, or analytics cookies.

We do not accept or want your contracts, solicitations, proposals, or any controlled, proprietary, or otherwise sensitive documents. Do not send us that material.

How we use it

We use your data to operate your watchlist, send change and account notifications, process billing, and keep the service secure and reliable. We do not sell your data or use it for advertising.

Who processes it

The following processors handle data on our behalf:

• Vercel — hosts the application and its background scheduling.
• Neon — hosts the database and manages authentication (sign-in, email verification, sessions).
• Stripe — processes payments and holds your card details; we only receive subscription status identifiers back.
• Resend — delivers transactional and notification email on our behalf.
• An AI provider (OpenAI) — reserved for an optional future plain-language summary feature. This processor is not active in the current version of the service; regulatory text would be treated as data, not instructions, if this feature is enabled.

Retention and deletion

You can request account deletion at any time from your account page. Doing so immediately stops email delivery and pauses your watchlist after any Stripe subscription is canceled and Stripe confirms that billing is in a terminal state. If Stripe cannot confirm cancellation, deletion is not scheduled and the account remains available for a retry. Your profile, watchlist, and notification data are permanently erased after a 14-day grace period. We retain only the minimal financial records required by law and never retain card data ourselves. Accepted regulatory source history is public-domain product data, not personal data, and is kept indefinitely so other users' monitoring keeps working.

Security

Every account, billing, and watchlist action is authorized server-side. Sessions and authentication are handled by our managed auth provider; we do not build or store password hashes ourselves. Secrets are stored only in server-side environment variables and are never exposed to the browser.

Your rights

You can request access to, correction of, or deletion of your personal data by emailing support@clausesignal.com. The fastest path for deletion is the in-product request on your account page described above, which also stops billing. We respond to rights requests within 30 days, never charge for them, and never reduce your service because you made one.

ClauseSignal is a business-to-business service offered in and directed to the United States. We do not market it to consumers outside the United States and do not knowingly collect data from anyone under 18.

Contact

Questions about this policy or your data: support@clausesignal.com. See the Terms of Service for the full service terms.