Privacy Policy

Effective Date: April 15, 2026

This Privacy Policy explains how GroveStreams, Inc. ("Company," "we," "us," or "our") collects, uses, and protects your information when you use the ContractParser.ai service ("Service"). We are committed to protecting your privacy and handling your data responsibly.

1. Information We Collect

1.1 Information You Provide

Data	Purpose	Retention
Email address (optional)	Send analysis results when processing completes	Deleted with results (24 hours after processing)
Uploaded documents	AI-powered analysis and extraction	Automatically deleted 2 hours after processing
Extraction results (CSV)	Delivered to you as downloadable CSV + emailed attachment	Server-side download available for 24 hours; the emailed copy is retained by your mail provider
Extraction preferences	Configure what information to extract	Deleted with results (24 hours)

1.2 Payment Information

Payment is processed entirely by Stripe, Inc. We never receive, store, or have access to your credit card number, CVV, or full card details. Stripe may store your payment information in accordance with their Privacy Policy. We receive only a transaction confirmation, amount paid, and the email address you provide to Stripe (if any).

1.3 Automatically Collected Information

Like most web services, our servers automatically log:

• IP address
• Browser type and version
• Pages visited and timestamps
• Referring URL

This data is used solely for security monitoring and service reliability. We do not use it for advertising or tracking.

2. How We Use Your Information

• Document analysis: Your uploaded documents are sent to Anthropic's Claude API for AI-powered extraction. This is the core function of the Service.
• Results delivery: If you provide an email address, we send your results via Amazon SES when processing completes.
• Service operation: Server logs are used for security, debugging, and service reliability.

We do not:

• Sell, rent, or share your personal information or documents with third parties for marketing purposes
• Use your documents to train AI models
• Profile you for advertising
• Retain your documents beyond the 2-hour processing window

3. Third-Party Data Processors

We use the following third-party services to operate the Service:

Provider	Purpose	Data Shared	Privacy Policy
Anthropic	AI document analysis	Document content (for analysis only; not used for training under commercial API terms)	Link
Stripe	Payment processing	Payment details (handled entirely by Stripe)	Link
HorizonIQ	Server hosting	Server infrastructure	Link
Amazon Web Services	Email delivery (SES)	Email address (for results delivery)	Link

4. Data Retention and Deletion

• Uploaded documents: Automatically deleted 2 hours after processing completes. This is the sensitive asset and is purged aggressively.
• Analysis results (CSV and session): Automatically deleted 24 hours after processing completes. If you provided an email address, a CSV copy is delivered as an attachment for your own retention.
• Email addresses: Deleted with the session data (24 hours). We do not maintain an email list.
• Server logs: Retained for up to 90 days for security and operational purposes, then deleted.
• Payment records: Stripe retains transaction records in accordance with financial regulations and their own retention policy.

You do not need to request deletion — it happens automatically. If you want to verify your data has been deleted, contact us.

5. Data Security

• All data is transmitted over HTTPS (TLS encryption in transit).
• Documents are stored in temporary server storage with restricted access, not in a permanent database.
• Payment processing is PCI DSS compliant (handled by Stripe).
• Server infrastructure is hosted on HorizonIQ bare-metal servers with industry-standard security controls.

6. Cookies and Analytics

The Service uses the following cookies and analytics tools:

• Essential session cookies required for the Service to function (e.g., maintaining your upload session). These are always set and cannot be disabled.
• Google Analytics 4 (by Google LLC) — used to understand aggregate site usage (pages visited, general geography, browser type). Google Analytics may set cookies and collect an anonymized/truncated IP address, device identifiers, and usage events. We have enabled IP anonymization and have not enabled Google Signals, advertising features, or data sharing for advertising.
• CookieYes (by CookieYes Limited) — consent management platform that records your cookie preferences and loads the consent banner. It sets a first-party cookie storing your choices.

We do not use advertising cookies, behavioral-advertising tracking, cross-site tracking, or remarketing pixels.

Browser localStorage. To make return visits smoother, the Service saves your most recent UI preferences — selected extraction fields, Standard vs Verified tier choice, custom prompt text (if any), and notification email — to your browser's localStorage. This data stays on your device, is never transmitted to our servers, and is not a cookie in the technical sense. A Start fresh button on the extraction config panel clears it on demand; clearing your browser's site data for contractparser.ai also removes it.

Your choices. You can accept, reject, or customize non-essential cookies using the consent banner that appears on your first visit. Your preferences can be updated anytime via the CookieYes consent widget shown on the page. You can also opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

7. Your Rights Under GDPR (European Economic Area)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate data.
• Right to Erasure: Request deletion of your data (note: documents are auto-deleted within 2 hours).
• Right to Restrict Processing: Request that we limit how we use your data.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing of your data.
• Right to Lodge a Complaint: File a complaint with your local data protection authority.

Legal Basis for Processing (GDPR Article 6)

• Contract performance: Processing your documents is necessary to deliver the Service you paid for (Art. 6(1)(b)).
• Legitimate interest: Server logs for security and service reliability (Art. 6(1)(f)).

International Data Transfers

Your data may be transferred to and processed in the United States, where our servers and third-party providers are located. We rely on Standard Contractual Clauses (SCCs) and our providers' data protection measures for lawful international transfers.

Data Protection Officer

For GDPR-related inquiries, contact our data protection team at support@grovestreams.com.

Data Processing Agreement

Enterprise customers who require a Data Processing Agreement (DPA) may request one by contacting legal@contractparser.ai.

8. Your Rights Under US State Privacy Laws

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, or other states with comprehensive privacy laws, you may have additional rights including:

• Right to Know: What personal information we collect and how it is used.
• Right to Delete: Request deletion of your personal information.
• Right to Opt Out of Sale: We do not sell personal information. There is nothing to opt out of.
• Right to Non-Discrimination: We will not treat you differently for exercising your privacy rights.

California-Specific Disclosures (CCPA/CPRA)

In the preceding 12 months, we have:

• Collected: email addresses (optional), uploaded documents (temporary), server logs
• Sold personal information: No
• Shared personal information for cross-context behavioral advertising: No
• Used sensitive personal information beyond what is necessary to provide the Service: No

9. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes take effect when posted. We will update the effective date at the top of this page. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

11. Contact Us

For privacy-related questions or to exercise your rights:

• Email: support@grovestreams.com
• Mail: GroveStreams LLC, Attn: Privacy, Minneapolis, MN, USA