Privacy Policy

This Policy applies to information collected through the UnBind website and application, including account creation, sign-in, document upload and analysis, the negotiation and impact-simulator features, and payment for paid plans. By using the Service, you agree to the collection and use of information as described here.

a. Account information

When you create an account directly, we collect the username, email address, and password you provide. Your password is never stored in plain text; it is hashed (via bcrypt) before being saved, and we cannot recover or view your original password. If you sign in with Google, we instead receive basic profile information from Google (your name, email address, and profile picture) and do not receive or store your Google password.

b. User Content

“User Content” means the contracts, agreements, and other documents or images you upload for analysis, together with the text extracted from them (including via optical character recognition of photos and scans). User Content may contain sensitive, confidential, or personal information: for example, names, addresses, financial terms, or information about third parties named in your documents. You should only upload documents you have the right to share, and you should consider redacting information you do not want processed if it is not necessary for the analysis you need.

c. Payment information

Paid plans are processed through Razorpay, our third-party payment processor. UnBind does not receive, process, or store your full card number, CVV, UPI credentials, or other raw payment credentials; Razorpay collects and handles that information directly. We store limited, non-sensitive billing records on our side, such as the plan purchased, amount and currency charged, Razorpay’s order and payment identifiers, and the transaction date, so we can show you your billing history and confirm plan activation.

d. Usage & analytics data

We use Vercel Analytics and Vercel Speed Insights to understand how the Service is used and performing. These tools collect aggregated, privacy-conscious usage data such as page views, referring pages, device/browser type, and performance metrics (e.g. page load times). This helps us identify issues and improve the Service.

e. Cookies & session tokens

When you sign in, we issue a signed authentication token (JSON Web Token) that is stored in an HTTP-only cookie in your browser (or, for some clients, sent as a bearer token) so the Service can recognize you as signed in across requests. This cookie is used strictly for authentication and session management, is marked secure in production, and is not used to track you across other websites. See Section 11 for more on cookies.

We use the information described above to:

• Provide and operate the Service, including creating and authenticating your account, running document analysis, the negotiation helper, and the impact simulator;
• Process payments and subscriptions, and maintain your billing history and plan status;
• Maintain the security of your account and the Service, including detecting and preventing fraud, abuse, and unauthorized access;
• Send you transactional communications, such as payment receipts and account-related notices; and
• Understand aggregated usage patterns and performance via analytics, in order to maintain and improve the Service.

This is the most important data flow to understand before you upload a document. To generate clause-level risk analysis, plain-language summaries, key terms and dates, negotiation drafts, and impact-simulation answers, the text of your uploaded document (and, where relevant, the text transcribed from uploaded images or scans) is transmitted to Groq, a third-party AI inference provider, so that a large language model can process it and return the analysis. Photographed or scanned documents are additionally sent, as images, to a Groq vision model for optical character recognition before analysis.

This transmission to Groq is necessary for the core analysis features of the Service to function; there is currently no way to run the analysis without sending the relevant document text (and, for image uploads, the image itself) to Groq for inference. We do not control Groq’s infrastructure and Groq processes this content subject to its own terms and privacy policy.

Separately, the “impact simulator” feature also sends short excerpts of your document text to a third-party hosted embedding API (via Hugging Face’s Inference API) so that relevant passages can be matched to your question. We may also use LangSmith, a tracing/observability tool, to log prompts and model responses for debugging and quality monitoring of our AI pipelines; such traces can include excerpts of document text processed in that request.

We rely on the following third-party service providers, each of which acts as a data processor on our behalf and is subject to its own privacy policy:

• Groq: AI inference for document analysis, clause risk detection, negotiation drafting, and vision-based OCR (see Section 4).
• Hugging Face: hosted inference API used to generate text embeddings for the impact-simulator’s retrieval feature.
• LangSmith: optional tracing and observability of our AI pipeline calls, used for debugging and quality monitoring.
• Razorpay: payment processing for paid plans (see Section 2c).
• Google: optional Google OAuth sign-in, used only to authenticate you and retrieve basic profile information you choose to share.
• Vercel: hosting of the Service, plus Vercel Analytics and Speed Insights (see Section 2d).

We do not sell your personal information to third parties for their own marketing purposes.

We retain your account information, uploaded documents, and the analysis results generated from them for as long as your account remains active, so that you can access your history and dashboard and revisit past analyses. Billing records are retained as part of your account’s payment history.

If you delete your account, we work to remove or de-identify the associated account data and User Content from our active systems, except where we are required to retain certain records (for example, payment records) for legal, accounting, or fraud-prevention purposes, or where data persists for a limited time in backups before being purged in the ordinary course of our backup cycle.

We use reasonable technical and organizational measures to protect your information, including hashing passwords (so we never store them in plain text), transmitting data over encrypted connections, and using signed, HTTP-only authentication tokens for sessions. Payment credentials are handled directly by Razorpay rather than by our own systems.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately using the details in Section 13.

Depending on your location, you may have rights to access, correct, or delete the personal information we hold about you, to obtain a copy of it, or to object to or restrict certain processing. You can update basic account details from within the Service, and you can request access, correction, deletion of your account and associated data, or answers to other privacy questions by contacting us at unbind.legal@gmail.com. We will respond to verifiable requests within a reasonable timeframe.

The Service is not directed to children under the age of 13 (or 16, where a higher threshold applies under local law), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action, including deleting that information.

Because we use third-party service providers (see Section 5), your information, including User Content, may be processed or stored in countries other than your own, which may have different data protection laws than your jurisdiction. Where this occurs, we take steps intended to ensure your information continues to receive an appropriate level of protection wherever it is processed.

We use an essential, HTTP-only authentication cookie to keep you signed in and to identify your account on subsequent requests (see Section 2e). We also use Vercel Analytics and Speed Insights, which may set or read limited technical identifiers/cookies in your browser to measure aggregated usage and performance. We do not use cookies for third-party behavioral advertising. You can control cookies through your browser settings, but blocking the authentication cookie will prevent you from staying signed in.

We may update this Privacy Policy from time to time to reflect changes to the Service, the third parties we rely on, or legal requirements. If we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice (such as an in-app notification or email). Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

If you have questions about this Privacy Policy or how we handle your information, please contact us at unbind.legal@gmail.com.