This Privacy Policy explains how Coventract ("we", "us", or "our") collects, uses, shares, and protects personal data when you use our websites and services (the "Service"). Coventract is operated from the State of Qatar. We act as a controller for your account data, and as a processor for the contract content you create on behalf of your organisation and its counterparties.
1. Information We Collect
We collect the following categories of personal data:
- Identity & contact — name, email address, phone number, company name.
- Authentication — password (stored hashed by our provider), Google/SSO identifiers, and, if you enable them, one-time email login codes.
- Profile — avatar/photo, preferences, and settings.
- Contract content & signatures — the contracts you create and manage, and the electronic signatures and any personal data of counterparties contained within them.
- Payment — records of your subscriptions and purchases. Payments are processed by PayPal; we do not store your full card or bank details.
- Media — images you upload (logos, avatars, and files in your media library).
- AI inputs — text, transcripts, and prompts you submit to AI features.
- Usage, device & log data — IP address, browser/device information, signed-in devices, and how you use the Service.
2. How We Use Your Information
We use personal data to: provide, maintain, and secure the Service; create and manage your contracts and signatures; process payments and manage subscriptions; verify sign-in (including email login codes); operate AI features; provide support; send transactional and, with your consent, promotional messages; detect and prevent abuse and fraud; and comply with legal obligations.
3. Legal Bases for Processing
Where applicable law requires, we rely on: performance of a contract with you (to provide the Service); your consent (for example, marketing or optional features); our legitimate interests (to secure and improve the Service and prevent abuse); and compliance with legal obligations.
4. Sharing Your Information
We do not sell your personal data. We share it only with the service providers listed in Section 10, with counterparties you choose to share a contract with, where required by law or legal process, and to protect our rights or the safety of others.
5. Data Retention & Deletion
We retain personal data for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. You can delete your account at any time from your settings; when you do, we permanently delete your profile, your contracts, your uploaded media (including your media library), and your authentication record. Limited information may be retained where required by law or for legitimate business records (for example, transaction records), and residual copies may persist briefly in backups.
6. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, hashed passwords, optional email login codes, and signed-in-device management. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Your Rights
Depending on your location, you may have the right to access, correct, delete, export, or restrict your personal data, to object to certain processing, and to withdraw consent. You can exercise several of these directly in the app (for example, editing your profile or deleting your account), or by contacting us. You also have the right to complain to your local data-protection authority.
8. Cookies
We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Service is used. Where required, we ask for your consent for non-essential cookies. You can also control cookies through your browser settings. See our cookie notice for details.
9. Where Your Data Is Hosted (Data Residency)
The Service runs on Google Cloud / Firebase, and your data — including your account, contracts, media, and signatures — is currently hosted in the asia-east1 (Taiwan) region, i.e. outside the State of Qatar. Where we transfer personal data internationally, we rely on appropriate safeguards — including the data-protection commitments of our sub-processors and contractual protections — to ensure an adequate level of protection. If your organisation requires in-country data residency, contact us to discuss enterprise options.
10. Sub-processors
We use a limited set of vetted service providers to operate the Service, each bound by confidentiality and data-protection obligations:
- Google Cloud / Firebase — hosting, database, authentication, and file storage.
- Google AI (Gemini) — AI clause drafting, review, and explanation features.
- Resend — transactional email delivery.
- PayPal — payment processing.
We do not sell your personal data, and we do not use your contract content to train third-party AI models.
11. Qatar — Personal Data Privacy Protection Law (PDPPL)
If you are in the State of Qatar, we process your personal data in a manner consistent with Law No. (13) of 2016 on Personal Data Privacy Protection (PDPPL) and the guidelines issued by the National Cyber Security Agency (NCSA):
- Lawfulness & transparency — we process personal data fairly, for the specific purposes described here, and only to the extent necessary.
- Consent — where we rely on your consent (for example, direct marketing), you may withdraw it at any time.
- Data of a special nature — data relating to ethnic origin, health, religious beliefs, criminal records, or similar categories is treated as data of a special nature and given additional protection.
- Your rights — you have the right to be informed of, to access, to object to, and to request correction or erasure of your personal data, and to withdraw consent, subject to legal limits.
- Breach notification — where a personal-data breach poses a serious risk, we will notify the competent authority and affected individuals as required by the PDPPL.
- Children & direct marketing — we apply the PDPPL's additional safeguards for processing concerning children and for electronic direct marketing.
To exercise any of these rights, contact us using the details below; you also have the right to lodge a complaint with the competent Qatari authority.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the effective date.
13. Contact Us
Questions about this Privacy Policy, or want to exercise your rights? Contact us at abubker141998@gmail.com or via our contact page.