Privacy Policy
Last updated: 22 June 2026
This policy explains what information DueFrame may process, why it is used and the choices available to private beta users. DueFrame is a Word-first contract review product that saves metadata-only Review records, risks and reminders after the Word review.
1. Information we process
Depending on how the private beta is used, DueFrame may process:
- account and contact details, such as name, work email and authentication information;
- workspace details, including organisation name, team membership and user role;
- metadata users choose to enter or save, including Review records, Applied and Dismissed decisions, risks, reminders and workspace notes;
- support correspondence and private beta feedback; and
- basic technical and security information generated when the web service is accessed.
2. How we use information
Information is used to provide and secure the workspace, authenticate users, display and organise Review records, risks and reminders, respond to support requests, diagnose problems and improve the private beta. DueFrame does not use customer workspace content to provide legal advice.
3. Rule-based workflow assistance
The MVP may generate summaries, flags and suggested next steps during the active Microsoft Word review. Your contract is processed for the active review and is not stored by DueFrame. DueFrame saves only the Review record, risks and reminders you choose to keep.
Two features store wording you author deliberately: Playbooks(your organisation's standard positions, preferred wording and comments) and the Clause library(precedent clauses you save by selecting wording and choosing “Save as clause”). Both are workspace content you create and can edit or delete at any time; neither is populated automatically from documents you review. You can also deliberately import clauses from a precedent you upload for that purpose — and even then, only the clauses you individually approve are saved, each labelled with the file it came from.
Company profiles and personalisation settings are likewise configuration you author deliberately: a profile holds a company name, industry, jurisdiction, negotiation posture and your standing instructions for that company; personalisation holds your preferred response style, tone and custom instructions. You can edit or delete both at any time, and neither is populated from documents you review.
Position historyis an optional, per-workspace feature that a workspace admin can switch on (it is off by default). When on, DueFrame retains for each reviewed document a fixed set of structured positions (for example “liability cap: 12 months of fees”, “governing law: England and Wales”), the contract type, the side you represented and a one-way fingerprint used only to avoid double-counting the same document. It retains no contract text, clause wording, party names or file. The positions stay inside your workspace, are never pooled with other customers, and can be exported or deleted from Settings at any time. Our Security & privacy page describes exactly what is kept.
4. Service providers and sharing
DueFrame relies on a small number of service providers, each processing information only to operate their service under their own terms and privacy notices:
- Vercel — web hosting; processes all traffic to the site and add-in.
- Supabase — database and authentication; stores accounts and the metadata-only workspace records described above.
- OpenAI — AI processing. Document text you submit for a review, question or research request is sent to OpenAI to generate the result, then is not stored by DueFrame. OpenAI applies its own limited retention for abuse monitoring under its API terms.
- HelpFrame — our support chat. Messages you send through the Help control are processed by our support system, which uses its own database and AI provider.
- Google / Microsoft — only if you choose to sign in with them; they confirm your identity to us under their own privacy policies. If your organisation uses single sign-on (SAML), your identity provider confirms your identity in the same way.
- Paddle — payments, as merchant of record. If you subscribe, Paddle processes your payment details, billing address and invoices under its own terms and privacy policy; DueFrame receives only the subscription status, plan and renewal date.
- Resend — transactional email. If you switch on email notification for a reminder, the reminder title, type and due date are sent to your address through Resend.
- Microsoft 365 (optional connection) — only if you connect your own Microsoft account to attach OneDrive, SharePoint or Outlook documents to a review. DueFrame reads the file for that action, extracts its text in memory and discards it; it stores the encrypted connection tokens and nothing about the files. You can disconnect at any time from Integrations.
Information may also be disclosed where required by law, to protect the service or users, or as part of a business reorganisation with appropriate safeguards. DueFrame does not sell personal information.
5. Data location, retention and deletion
Information may be processed where DueFrame's infrastructure providers operate. Records are retained while needed to provide the private beta, meet legitimate operational or legal needs, resolve disputes and maintain security. Contract files, complete contract text, clause excerpts, redline wording and full comments are not retained as Review record data. You may request deletion of your account or workspace information, subject to any information that must reasonably be retained.
6. Security and user responsibility
Reasonable technical and organisational measures are used for the MVP, but no internet service can guarantee absolute security. Users must protect their credentials, limit access appropriately and only add information they are authorised to process. Please do not add exceptionally sensitive material to the private beta unless its use has been agreed with DueFrame.
7. Cookies and browser storage
DueFrame sets no advertising or analytics cookies. Everything the site stores in your browser is either strictly necessary or a preference you set yourself:
| Service | Name | Purpose | Category | Duration | Party |
|---|---|---|---|---|---|
| Supabase Auth | sb-…-auth-token (may be split into parts) | Keeps you signed in to your workspace | Strictly necessary | Until sign-out | First |
| Supabase Auth | sb-…-auth-token-code-verifier | One-time security value while completing sign-in | Strictly necessary | Minutes | First |
| DueFrame (browser storage) | dueframe-theme-mode | Remembers your light/dark choice | Preference you set | Until cleared | First |
| DueFrame Word add-in (browser storage) | dueframe-taskpane-*, dueframe-default-* | Add-in appearance and your saved Review defaults | Preference you set | Until cleared | First |
| Support chat (browser storage) | dueframe-help-session, dueframe-help-conversation-id | Keeps your support conversation going; created only when you send a message | Strictly necessary for the chat you start | Hours / until cleared | First |
| Cookie consent (browser storage) | dueframe-cookie-consent | Records the cookie choices you made and when | Strictly necessary | Until cleared | First |
| Google / Microsoft sign-in | Their own cookies, on their own domains | Set by Google or Microsoft only if you choose to sign in with them | Strictly necessary (you initiate it) | Per their policies | Third |
| Paddle checkout | Paddle's own cookies, set when the checkout opens | Runs the payment form and fraud checks for a purchase you start; Paddle.js is loaded only when you click a plan | Strictly necessary for the purchase you initiate | Per Paddle's policy | Third |
If we ever introduce optional cookies (for example payment-fraud prevention at checkout, or analytics), they will be off by default and asked for through the consent controls — you can review or change your choices any time via Cookie settings in the page footer.
8. Your choices and rights
Depending on applicable law, you may have rights to access, correct, delete, restrict or obtain a copy of personal information, or to object to certain processing. Contact us to make a request. We may need to verify your identity and authority before responding.
9. Children
DueFrame is a business service and is not directed to children.
10. Changes and contact
This policy may be updated as the private beta develops. Material changes will be reflected on this page. For privacy questions or requests, email founder@aqaritrack.org.