1. Who we are
Contraqt is operated by C. Emre Sucuoglu, trading as CES IT Services, a sole trader at 83 North Lane, Portslade, Brighton, BN41 2HF, United Kingdom. Contact support@contraqt.app about privacy or your information.
We are the controller of account, billing, support and service-security information. Where a business customer uploads personal data for document preparation, that customer normally determines its purpose and we process it on their instructions. The business document data terms explain that relationship.
2. Information we use
- Account information: your name, email address, password hash, account status, subscription entitlement and account-management history. Registration requests temporarily store your email address, hashed verification token and delivery status; an account is created only after confirmation.
- Documents: original uploads, working templates, editor settings, variables, rules and values submitted for generation. Word files can also contain comments, revision history, embedded objects and metadata.
- Usage and security: download counts and status, request times, IP addresses or derived identifiers, browser/request information in hosting logs, and records used to prevent abuse or recover accounts.
- Support: your email correspondence and, when available, support tickets and replies.
- Billing: plan, renewal/cancellation status, payment-provider identifiers, the terms and start-of-service request accepted at checkout, acceptance time and agreement-email delivery status. Card details are entered with Stripe rather than stored in Contraqt's database.
- Optional advertising measurement: if you allow it, Google Ads receives ad-click identifiers, browser/network information (including IP address), a limited page address and verified purchase amount, currency and a pseudonymous transaction reference. We do not send account names, emails, document contents or support messages through this integration.
We receive information from you, your browser, people whose documents you upload, and service providers reporting payment or security events. Account details are needed to provide an account; document content is needed to process a template. Do not submit information unrelated to your task.
The service is intended for adults. Do not upload special-category data (such as health information), criminal-offence data, identity-document scans or payment-card details. Use anonymised examples when contacting support.
3. Why we use it
- Providing your service
- Account access, templates, generation, subscriptions and requested support: performance of our contract with you. For business contacts who are not personally the contracting customer, our legitimate interest is administering the customer's service.
- Protecting and maintaining Contraqt
- Abuse prevention, troubleshooting, access controls and resolving disputes: our legitimate interests in running a reliable service and protecting customers. We consider the impact on individuals when relying on these interests.
- Legal and accounting obligations
- Records and disclosures required by tax, accounting or other applicable law: compliance with a legal obligation.
- Optional communications or technologies
- Where consent is required, we ask separately. Accepting the service terms does not give consent to marketing. You can withdraw consent without affecting earlier lawful processing.
We do not sell personal information or use uploaded documents to train AI models. Template rules and calculations follow your settings; they do not constitute credit scoring or other decisions by us with legal or similarly significant effects on you.
4. Providers and locations
Hostinger hosts our website and database on a server in the United Kingdom and provides email services. Backup and email storage locations can vary, and authorised support staff may access data from outside the UK. We do not offer UK-only storage or processing. AWS supports the legacy UK document-conversion infrastructure where used; the customer Word-only service does not include PDF conversion.
Other providers may receive information when their features are used:
- Cloudflare Turnstile: processes browser and network signals to check for bots on protected forms. Cloudflare processes these signals on our behalf to protect the site and as a controller to improve its bot detection. Document content is not intentionally submitted to CAPTCHA verification. See Cloudflare's Turnstile privacy notice.
- Stripe and Link: when checkout is enabled, receive account/contact and transaction information for payment processing, tax handling, fraud prevention and subscription management. Link acts as merchant of record for Managed Payments purchases and provides receipts and transaction support. Stripe and Link have their own responsibilities for this data. We do not send your document contents to them. See Stripe's privacy policy and Link's privacy policy.
- UNPKG: the builder loads a document-processing JavaScript library from this content-delivery service. The request exposes network/browser information; downloading the library does not itself upload your document to UNPKG.
- Professional advisers and authorities: information necessary for advice, a legal obligation or the establishment or defence of legal claims.
- GitHub: runs deployment and backup jobs and stores encrypted recovery copies in a private repository's workflow storage. Backup decryption keys are held separately.
- Google Ads: with your consent, measures whether advertising leads to purchases. This optional processing may take place outside the UK. We do not enable personalised advertising, Google Analytics or enhanced conversions in this integration. See Google's privacy policy and Google's business data protection information.
Provider arrangements can involve international processing. Restricted transfers require an applicable adequacy regulation or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum. Contact us for information about relevant safeguards. Do not upload information that must remain exclusively in a particular country.
We do not automatically send your generated documents to Adobe or a recipient. If you download and upload them to another service, that service's terms and privacy information apply.
5. Keeping and deleting data
Retention depends on the purpose and record type, rather than a single period for everything:
- Accounts and saved templates: retained while your account remains open and they are needed to provide your workspace. Cancelling a paid plan is not account deletion: older templates remain saved but locked on Free. Settings offers a copy of saved account data and template files, including locked templates, and a request for account closure. You can also contact support for a copy or deletion review.
- Unfinished registration: verification links expire after 30 minutes. Uncompleted registration records are removed by scheduled cleanup after 24 hours; a later request can start a new verification.
- Generated files: prepared as temporary downloads, not as a permanent document archive. Normal export handling removes its temporary output, but interrupted processing may leave temporary files for cleanup. Keep your own downloaded copies.
- Support, usage and security records: retained according to whether an issue remains open, abuse investigation is needed, usage must be checked, or a dispute or legal obligation requires the record. These records are not all automatically deleted when a template is removed.
- Billing records: retained for applicable accounting/tax requirements and any unresolved transaction or claim; erasure of an account does not override those duties.
- Backups: deletion from the live service may not immediately remove backup copies. Copies can remain until the relevant backup is replaced or expires; they are not intended for ordinary use after deletion.
We assess deletion requests individually, including any necessary legal exceptions, and explain what must be retained and why. Where business document data is processed for a customer, their instructions and the processing terms also apply. Contact us for a retention assessment for your account; do not assume that inactivity or subscription expiry deletes it.
7. Your rights
Depending on the circumstances, you can ask to access, correct, erase, restrict or receive a portable copy of your personal data. You can object to processing based on legitimate interests. You can also withdraw consent where we rely on it. These rights have legal conditions and exceptions.
Email support@contraqt.app. We may need proportionate identity checks. Requests are normally free and we normally respond within one month; if a lawful extension or exception applies, we will explain it. If your information belongs to a business customer's document, we may refer your request to that customer and assist them.
You may complain to the Information Commissioner's Office (ICO). You do not have to contact us first, although we welcome the opportunity to resolve the issue.
8. Policy changes
We update this policy when our service or obligations change and show the revision date above. We will bring material changes affecting existing customers to their attention. A policy update does not replace any consent or other legal step that is required.