Privacy Policy

MossMoor Ltd, registered in Nigeria under the Companies and Allied Matters Act and trading as ClausesGuard, is the data controller for the personal data described here.

Contact for privacy matters: privacy@clausesguard.com.

We do not ask for and do not want special category data (health, biometric, political, religious and similar). Please do not upload documents containing it.

• —If you upload a PDF or Word file, it is parsed inside your own browser. The file itself is never transmitted to us or stored on our servers.
• —The extracted text — or text you paste directly — is sent to our servers, then to OpenRouter, which routes it to the AI model provider that generates your analysis or draft. Both are listed as processors in section 06.
• —We do not store the contract text itself after the request completes. It is not written to our database.
• —We DO store what the AI produced from it: the document name, risk score, risk level, plain-English summary, and the full clause breakdown including explanations and negotiation suggestions. This is substantive content derived from your contract, not merely metadata.
• —For drafting, we store the complete text of the agreement generated for you, including any edits you save.
• —Long documents are reviewed in sections rather than truncated. Each section is a separate request to our AI provider. The number of sections is capped by your plan, and the Service reports how much of the document was reviewed.
• —Nothing you submit is used to train AI models — ours or our providers’. This is a contractual requirement on our AI provider, not just our own policy.

You can delete any individual analysis or draft from the Documents area at any time, which removes it from our database.

For users in the EU, UK and other jurisdictions applying a lawful-basis requirement:

Where we rely on consent you may withdraw it at any time. Where we rely on legitimate interests you may object, and we will stop unless we have overriding grounds.

The analysis, risk score and drafts are produced by an AI model without human review. This is the core function of the Service and is what you are asking us to do.

We do not use this processing to make any decision that has a legal effect on you or similarly significantly affects you within the meaning of Article 22 GDPR — the Output is information for you to act on, and every decision about your contracts remains yours. We do not use automated profiling for credit, employment, insurance or eligibility decisions.

We do not sell personal data and we do not share it for advertising. We use the following processors, each under a written data processing agreement:

We may also disclose data where legally required, to establish or defend legal claims, or to a successor entity on a merger or sale of the business (in which case we will tell you).

Our database is hosted in the European Union (Ireland, eu-west-1). Application hosting and AI processing may take place in the United States and other countries.

This means personal data is transferred out of Nigeria, and out of the EEA and UK, to countries that may not have been assessed as providing an equivalent level of protection. For transfers from the EEA and UK we rely on the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable, plus supplementary technical measures including encryption in transit and at rest.

You can request a copy of the transfer mechanism we rely on for any given provider.

Where we must keep a record for accounting reasons we keep only what is necessary for that purpose and stop using it for anything else.

• —Encryption in transit (TLS) and at rest for stored records.
• —Authentication and session management delegated to a specialist provider (Clerk); we never store passwords.
• —Card data never touches our systems — payments are handled entirely by Paystack.
• —Uploaded files are parsed in your browser, so the original document is never stored on our infrastructure.
• —Access to production data is limited to personnel who need it, and payment webhooks are cryptographically signature-verified.

No system is perfectly secure. We cannot guarantee absolute security, and you share information with us on that understanding.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where required, within 72 hours of becoming aware of it. Where the risk to you is high we will notify you directly and without undue delay, and tell you what happened, what data was involved and what to do.

Depending on where you live, you have the right to:

• —Access — get a copy of the personal data we hold about you.
• —Rectification — have inaccurate data corrected.
• —Erasure — have your data deleted, subject to records we must keep by law.
• —Restriction — ask us to pause processing while a dispute is resolved.
• —Portability — receive your data in a structured, machine-readable format.
• —Objection — object to processing based on legitimate interests, and to direct marketing at any time.
• —Withdraw consent — where we rely on consent, withdraw it at any time.
• —Human review — ask a person to look at anything you believe the Service got wrong.
• —Complain — to your data protection authority (see clause 13).

These rights arise under the Nigeria Data Protection Act and, where they apply to you, the EU GDPR and UK GDPR.

You can do some of this yourself, immediately:

• —Delete an individual analysis or draft — from the Documents area of your dashboard.
• —Correct your name or email — through your account settings.
• —Stop future billing — cancel from Billing in your dashboard.

For anything else — a full copy of your data, deletion of your whole account, restriction, or objection — email privacy@clausesguard.com. We will acknowledge within 7 days and respond substantively within 30 days. We may ask you to verify your identity first. There is no charge unless a request is manifestly unfounded or excessive.

Please raise it with us first — we would rather fix it. You also have the right to complain to a supervisory authority:

• —Nigeria — Nigeria Data Protection Commission (ndpc.gov.ng).
• —United Kingdom — Information Commissioner’s Office (ico.org.uk).
• —EEA — the data protection authority of your country of residence or workplace.

The Service is for business use and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.

See our Cookie Policy. In short: we set only the cookies strictly necessary to keep you signed in, and we run no advertising or analytics trackers.

We may update this policy. For changes that materially affect how we use your data we will give at least 30 days’ notice by email or in-app notice. The version and its date always appear at the top of this page.