Privacy Policy

Effective Date: October 13, 2026

Notice of change, October 22, 2026: we are adding error monitoring that receives only technical error reports (sections 1.6 and 4). This change takes effect November 6, 2026. The rest of this policy is unchanged.

Operator: BeforeJD LLC, a Texas limited liability company

BeforeJD LLC ("BeforeJD," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, with whom we share it, and the choices you have. This policy applies to the beforejd.ai website and all associated Services.

Our Lapwing application for iPhone is governed by its own Lapwing Privacy Policy.

1. Information We Collect

1.1 Account Information. When you register for an account, we collect your name, email address, account credentials (hashed password or OAuth token), and account creation date.

1.2 Payment Information. Payments on the web are processed by Stripe, Inc. Purchases in our iOS app are processed by Apple through the App Store and recorded through our in-app purchase provider. BeforeJD receives and stores only transaction metadata (amount, date and scan tier). Card numbers are never transmitted to or stored on BeforeJD systems, in whole or in part.

1.3 Uploaded Documents. When you submit a document for analysis, we receive the file and extract its text. We store every file you upload for a read, encrypted, for seven days after the read, so that you can open it, download it or keep it in your contract vault. This storage is automatic and applies to every upload. After seven days, a nightly job deletes the file. You may delete a stored file sooner from your account. The report produced from the file is kept separately, as described in Section 1.4.

1.3a Contracts You Choose to Keep. You may choose to keep a contract. When you do, we copy that document into your contract vault, where it is retained until you delete it rather than on the seven-day schedule above. Keeping a contract is always your action and never automatic, with one exception: a contract you execute through our signature service is kept for you, because it is a record of an agreement you are party to. You may delete any kept contract at any time from the contract itself, which removes both the stored document and its record. A contract you upload directly to your contract vault is kept the same way, until you delete it.

1.3b Preparing a Kept Contract So You Can Search It and Ask About It. A contract in your vault is prepared so that you can search it and ask questions about it. Preparing it means dividing the document text into passages and computing a numeric representation of each passage, and storing both alongside the contract. Passages are readable only by you, and by the members of your organization when the contract belongs to one, under the same access rules as the contract itself. This preparation is part of the contract and is deleted with it: when you delete a contract, its passages and their representations are removed in the same action, and nothing derived from that contract remains searchable.

1.4 Analysis Output. The report we produce for an Uploaded Document (the Analysis Output) is associated with your account and retained so that you can return to it. The report contains the full text of the contract as we read it, together with our findings and the redline. It is kept until you delete the analysis or your account, including after the uploaded file itself is deleted at seven days. You may delete an individual analysis from your account, which deletes the report, the contract text it contains and the files stored for it.

1.5 Usage Data. We collect information about how you interact with the Services, including pages visited, features used, scan counts, timestamps and click events. On our public website (for example, the home, pricing, blog and help pages) we also record sessions. A session recording captures what appears on those pages and how you move through them, along with the technical messages the page writes to your browser console, with what you type into form fields hidden. Sessions are not recorded anywhere you are signed in to the web app, on the sign-in and password pages, in our iOS app, in the report view inside our apps, on the pages a signer uses to sign, or on shared presentation pages; a recording stops when you move from the public website into any of them. Usage data and session recordings are collected through PostHog (our analytics provider), are linked to your account by an internal identifier rather than by your name or email address, and are used to improve the Services. We honor Global Privacy Control. When your browser sends the signal (the Sec-GPC header, or navigator.globalPrivacyControl), we treat it as your request to opt out of the sale or sharing of your personal information and of non-essential analytics: our analytics library is not loaded, so we record no events and no sessions for your visit, and we do not set our first-touch attribution cookie. The signal applies to the browser or device that sends it. It does not turn off error reporting or the data we need to run the Services, such as sign-in, payment and security. We also count page views with Vercel Web Analytics, a measurement tool provided by our hosting company. It sets no cookies, and it ignores any browser that sends a Global Privacy Control signal. For each page view it receives the page path (never the rest of our web address), the address of the site that sent you, and the general device, browser and country that any website sees in an ordinary request.

1.6 Log Data. Our hosting infrastructure (Vercel) automatically collects server logs including IP addresses, browser type, operating system, referring URLs, and request timestamps for security, debugging, and performance monitoring. Starting November 6, 2026, when something fails on our website or servers, we send Sentry, our error-monitoring provider in the United States, a technical error report: the kind of error, where in our code it happened, the page path and the browser or server software. A report contains only technical details like these, never contract text, what you type or personal details.

1.7 Communications. If you contact us by email or through support channels, we retain those communications and your contact information to respond to your inquiry and to improve our support.

1.8 Cookies and Similar Technologies. We use session cookies and local storage to maintain authentication state and preferences. We also use first-party cookies and local storage for our own analytics described in Section 1.5, including a cookie that remembers how you first arrived at the site. If you open the personal link of one of our independent sales representatives, or enter a representative's code at checkout, we record which representative it was and when; for a link visit we also record your IP address (for an IPv6 address, its network prefix), your browser and device details (user agent) and a random identifier that ties repeat visits from the same browser together. The link also saves a note in your browser for up to 30 days. If you are already signed in when you open the link, we tie that record to your account at once; otherwise we tie it when you sign in or check out. We do this so that we can decide whether the representative earns a commission on your purchase and pay it. We do not use advertising cookies, and we do not use cookies to track you across other websites. You can manage cookie preferences through your browser settings; disabling cookies may affect your ability to log in.

1.9 Electronic Signatures. When you send a document for signature or sign one through our signature service, we collect what the signing record needs: the name and email address of each signer, a mobile phone number when a signer is sent a code by text message, the signature or initials each signer applies, the times each signer viewed, consented and signed, and the IP address and browser details of the device each signer used. A completed signing record, which includes the signed document and its certificate of completion, is kept as a record of the agreement for every party to it. It is not deleted when one party deletes his or her account. In that case we detach the record from the deleted account, and on records that belong to another sender we remove that person's name, email address and phone number from the signing record. The signed document, the certificate of completion, the signature, the times and the device details remain with the record.

1.10 Contracts We Draft for You. When you ask us to draft a contract, we keep your answers and the drafted document with your account so that you can return to them. They are kept until you delete your account.

1.11 Spoken Questions. When you ask questions about a report by voice through the optional Contract Assistant, your voice, your report, and the parts of your contract the conversation uses are processed by ElevenLabs, a voice service, as described in Section 3. We keep a transcript and a summary of each conversation with the report. Our copies are deleted when you delete the analysis or your account. Deleting them does not delete the recordings, transcripts, summaries, and analyses that ElevenLabs keeps.

2. How We Use Your Information

We use the information described above for the following purposes:

• To provide, operate, and improve the Services, including processing your documents through our multi-model AI analysis pipeline;
• To authenticate your identity and maintain your account;
• To process payments and maintain transaction records;
• To send transactional emails, including analysis completion notifications and receipts, via Resend (our email delivery provider);
• To analyze usage patterns and product performance using the usage data and session recordings described in Section 1.5;
• To detect, prevent, and respond to fraud, abuse, security incidents, and violations of these Terms;
• To comply with applicable legal obligations, respond to lawful requests, and protect BeforeJD's legal rights;
• To communicate with you about material changes to our Terms or Privacy Policy.

We do not use your information to train our AI models, nor do we sell, rent, or share your information for third-party advertising purposes.

Quality Assurance Monitoring

When we deliver an analysis by email, BeforeJD sends a short internal quality assurance notice to info@beforejd.ai for the sole purpose of confirming that the delivery succeeded. Since September 27, 2026, this notice contains no document content: only the analysis reference, the domain of the recipient's address, the delivery status, and how many files were sent. Notices sent before that date were blind copies of the delivery email and contained the same attachments delivered to you. Every notice and copy is retained for no more than 90 days from the date of receipt, after which it is permanently and irreversibly destroyed. None is ever shared with third parties, and only BeforeJD personnel responsible for quality review can access them.

Testing and Improving the Services

We never use the text of your contracts to train models or to build benchmarks. We may review results to test and improve the quality of our own service. We also use aggregate, non-identifying measurements, for example how long a read took or how many findings it had, to improve the Services. Those measurements do not identify you or your contracts and are never sold or licensed.

3. Third-Party AI Processing

The core analytical function of the Services requires transmitting Uploaded Document text to one or more third-party artificial intelligence service providers ("AI Processing Partners") for model inference. BeforeJD currently uses three AI Processing Partners: OpenAI (ChatGPT), Anthropic (Claude), and SpaceXAI LLC (xAI, Grok). BeforeJD also uses Google (Gemini API), only as a fallback quality check on finished reports when the primary check cannot run. Contract text is transmitted to these services only to provide the Services you use: your analysis report and redline, a contract you ask us to draft, search and questions about a contract you keep, and the automated quality checks we run on those outputs. No provider uses submitted contract data for model training. Users may review each provider's privacy practices at openai.com/privacy, anthropic.com/privacy, x.ai/privacy, and policies.google.com/privacy. The identity and combination of AI Processing Partners may change over time as BeforeJD updates its analytical pipeline.

If you use the optional Contract Assistant, your voice, your report, and the parts of your contract the conversation uses are sent to ElevenLabs, a voice service, while the conversation is open. ElevenLabs processes your voice, and Anthropic (Claude) answers your questions. If Claude is unavailable, ElevenLabs may send the conversation to a backup model from another company, such as Google (Gemini) or OpenAI (GPT). After each conversation, ElevenLabs uses Google (Gemini) to summarize and analyze it. When the conversation ends, its transcript is sent to BeforeJD, and Anthropic (Claude) may also write a summary of it for your report. ElevenLabs keeps a recording, a transcript, and its own summary and analysis of each conversation.

By submitting a document for analysis, you acknowledge and consent to the transmission of your Uploaded Document text to AI Processing Partners for the purposes described in this Section.

BeforeJD uses its AI Processing Partners under their commercial API terms, which state that submitted API inputs are not used to train their models by default, and BeforeJD is putting signed data processing terms in place with each AI provider we use. However, BeforeJD does not control, and cannot guarantee, the data handling practices of third-party providers.

Each transmission is governed by the applicable terms and privacy policies of the relevant AI Processing Partner. By using the Services, you accept the risk that third-party AI Processing Partners may update their data handling policies, and you agree that BeforeJD's liability is limited as set forth in the Terms of Use.

4. Service Providers

BeforeJD engages third-party service providers to support the operation, hosting, security, and delivery of the Services (collectively, "Service Providers"). Service Providers are contractually bound to use your information only as directed by BeforeJD, solely for the purpose of providing their respective services, and may not use your information for their own independent purposes.

BeforeJD uses Service Providers in the following functional categories:

BeforeJD may add, replace, or remove Service Providers at any time without prior notice, provided that any replacement Service Provider is subject to contractual obligations at least as protective as those described above. The identity of specific Service Providers is available upon request by emailing info@beforejd.ai.

5. Disclosure of Information

We do not sell or rent your personal information. We may disclose your information in the following circumstances:

• Legal compliance: When required by subpoena, court order, or other valid legal process, or when we believe in good faith that disclosure is necessary to comply with applicable law or protect rights, property, or safety.
• Business transaction: If BeforeJD is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
• Enforcement: To enforce these Terms, detect or prevent fraud or abuse, or protect the security of the Services.
• Consent: For any other purpose with your explicit consent.

6. Data Retention

When you delete your account, we delete, at the time of your request, your account record, your analyses and the reports they contain, your drafts and your answers, the contracts you kept (with their versions and the passages that make them searchable), and the files stored for all of them. If you created an organization that has other members, its ownership passes to the longest-standing remaining administrator, then member, then viewer. If you are the only member of an organization, your account cannot be deleted until that organization is resolved, and we tell you so when you try. Completed signing records are kept as described in Section 1.9, backup copies are handled as shown in the table above, and payment transaction metadata is kept for the period above. Quality assurance notices and copies about your deliveries are destroyed on their own 90-day schedule, shown in the table above. Any other personal information is deleted or anonymized within 30 days, except where required for legal or compliance purposes. Deleting your account deletes our copies of your Contract Assistant conversations. It does not delete the recordings, transcripts, summaries, and analyses that ElevenLabs keeps.

7. Your Rights and Choices

Depending on your state of residence, you may have the following rights with respect to your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate personal information.
• Deletion: Request that we delete your personal information, subject to legal retention requirements.
• Portability: Request that we provide your data in a portable format.
• Opt-out of model training: BeforeJD does not train AI models on your data by default.

To exercise any of these rights, email us at info@beforejd.ai with the subject line "Privacy Request." We will respond within 45 days. We may request verification of your identity before fulfilling your request.

You can also manage many of these choices directly in your account settings, including deleting individual analyses, deleting stored documents, and deleting your account.

8. Security

BeforeJD implements commercially reasonable safeguards to protect your personal information, including server-side encryption of stored documents (AES-256 at rest), encrypted transmission (TLS 1.2 or higher), row-level database security policies, authentication via Supabase Auth, and automated document deletion at retention period expiration.

No security system is impenetrable. We cannot guarantee absolute security, and we are not responsible for unauthorized access resulting from circumstances beyond our reasonable control. Please notify us immediately at info@beforejd.ai if you believe your account has been compromised.

9. Children's Privacy

The Services are not directed to children under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a minor, we will delete it promptly.

10. U.S. State-Specific Disclosures

California (CCPA/CPRA): BeforeJD does not "sell" or "share" personal information for cross-contextual behavioral advertising as those terms are defined under California law. California residents may submit rights requests as described in Section 7.

Texas (TDPSA) and Other State Laws: We honor applicable privacy rights under applicable U.S. state privacy laws. BeforeJD does not process sensitive personal information for purposes of inferring characteristics about individuals.

11. International Users

BeforeJD's Services are operated from the United States and are intended for users in the United States. If you are accessing the Services from outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your country. By using the Services, you consent to this transfer.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or Site notification at least fourteen (14) days before taking effect. Continued use of the Services after the effective date constitutes acceptance of the revised policy.

13. Contact Us

For privacy-related questions, requests, or concerns:

BeforeJD LLC
Email: info@beforejd.ai
Website: beforejd.ai