Privacy

Privacy

Documents you draft or check never leave this browser tab. The only personal information this site can send anywhere is an email address you type into the Desk Pro waitlist form. The form is open on the pricing page.

Who is responsible

This site is published under the name Clauseworthy. It names no company or individual behind it; the publisher is responsible for the processing described here and is reached at support@clauseworthy.com, which is also the address for every request about your data.

Your documents

The NDA you fill in, the text or file you check, and the numbers you enter in the SAFE, founder and compliance tools are processed by scripts running in your browser. No page makes a request that carries them. When you choose a PDF to check, the browser loads a copy of the pdf.js reader from this site to read it; the file itself is not sent.

The local desk

When you press Save to desk, and only then, the site writes to your browser's local storage under the key cw.desk.v1. Each saved item holds its kind, a title, the time it was saved and either what you filled in (for a draft or a plan) or the check report (the findings, including the short quotations they show). An uploaded file and the full pasted text are never stored. The desk holds up to 50 items. It stays in this browser, is never sent to us, and can be emptied from your desk or by clearing this site's data in your browser.

Analytics

The site counts page views and a fixed list of 32 named events with Umami, a cookieless analytics tool that the publisher runs itself at analytics.pagefabrica.com; the figures are not shared with anyone else. An event is a name and nothing else: no text, no value, no file name, no state. The complete list is check_completed, check_file_dropped, check_pasted, check_report_exported, check_started, compliance_completed, compliance_exported, compliance_started, desk_deleted, desk_reopened, desk_saved, founder_completed, founder_exported, founder_started, nda_completed, nda_exported, nda_started, noncompete_checked, noncompete_state_viewed, notify_confirm_rejected, notify_confirmed, notify_delete_rejected, notify_deleted, notify_request_rejected, notify_request_submitted, notify_unsubscribe_rejected, notify_unsubscribed, safe_completed, safe_exported, safe_started, work_completed, work_started.

For each page view the collector records the page address (without the part after # or ?, which the tracker is told to drop), the page title, the referring page, the browser and its version, the operating system, the device type, the screen size, the browser language, and the country, region and city looked up from the IP address. The IP address and the browser's user-agent string are also used to form a visit identifier that changes every month; the IP address itself is not stored. The collector sets no cookie and writes nothing to your browser. If your browser sends Do Not Track, nothing is counted.

The Desk Pro waitlist

The form is open on the pricing page. When it opens, it will ask for an email address and a separate, unticked agreement to receive one message: the notice that Desk Pro has opened. The address is sent to this site's own API, stored in Amazon DynamoDB and mailed through Amazon SES, both in the AWS Frankfurt region (eu-central-1). You first receive a plain-text confirmation mail with no tracking pixel and no rewritten links. Retention:

• Waiting for confirmation: the address is kept for 30 days; the confirmation link works for 48 hours.
• Confirmed: kept for 365 days. If Desk Pro has not opened by then, the address expires and is never mailed.
• Unsubscribed: kept for 30 days, marked so it is never mailed again, then removed.
• Deleted: removed at once.

Every mail links to a page where you can unsubscribe or delete the address at once. The list is used for that one notice and is deleted after it.

Mail to support

Mail you send to support@clauseworthy.com is kept as ordinary correspondence so we can reply. Ask and it is deleted.

Hosting and links

Pages are delivered by Amazon Web Services. As with any website, the servers that deliver a page see your IP address and the address of the page requested; no document content is ever part of a request. Links to Common Paper, Y Combinator, Carta and state legislatures are plain links: nothing is loaded from those sites unless you follow one.

Legal basis

The waitlist address is processed on your consent (Article 6(1)(a) GDPR), given by ticking the box; you can withdraw it at any time with the link in any mail or by writing to support, and withdrawing does not affect what was done before. Cookieless page-view counting rests on the publisher's legitimate interest in knowing which pages are used (Article 6(1)(f)); the Do Not Track setting switches it off. Mail to support is processed to answer it (Article 6(1)(f)).

Your rights

You control the desk yourself. For anything the publisher holds, you may ask for access to it, a copy in a portable form, its correction or deletion, a restriction of its use, or object to its use; write to support@clauseworthy.com. Page-view counts carry no name or address, so they usually cannot be linked back to you. You also have the right to complain to a data protection supervisory authority, in particular in the EU or EEA country where you live or work. Nothing is sold or shared for advertising.

Last updated October 14, 2026. Questions: support@clauseworthy.com