Privacy Policy

Redline is operated by Sebastian Giupana, an individual developer. For privacy inquiries, contact privacy@example.com.

• Contract text — When you upload a contract (PDF or DOCX), the extracted text is sent to a third-party AI provider for analysis. When your interface is in a language other than English, the analysis instructions themselves are also localised — Mistral is multilingual and runs in the EU, so no machine-translation service is in the path. See "Third-party processors" below.
• Theme preference Your dark/light mode choice is stored in your browser's localStorage under the key redline-theme.
• Cookie banner dismissal Whether you have dismissed the cookie banner is stored in localStorage under the key redline-cookie-dismissed.

We do not use cookies. We do not collect personal information, create user accounts, or run analytics or tracking scripts.

• Contract analysis — Processing is necessary to provide the service you request (GDPR Art. 6(1)(b) — performance of a contract).
• Theme preference & banner dismissal — Legitimate interest in providing a functional user experience (GDPR Art. 6(1)(f)). These are strictly necessary for the interface to work as expected.

For a per-provider breakdown — including region, data categories, and legal basis — see the data residency page.

• Mistral AI (mistral-small-latest) — Contract text is sent to Mistral La Plateforme for clause extraction and risk analysis. Mistral is a French company; the La Plateforme API is hosted in the European Union (Paris region). Mistral processes this data under their Data Processing Addendum and Privacy Policy.
• Vercel — Frontend hosting. Privacy Policy.
• Railway — Backend hosting. Privacy Policy.

• Contract text — Processed in-memory and discarded after the analysis response is returned. Not stored on any server, not logged, not used for model training.
• Saved analyses — If you are signed in and explicitly save an analysis, it is retained for 30 days and then automatically deleted by a daily sweep. You can pin an analysis to keep it indefinitely, or extend the 30-day window at any time from the history page. Unsigned-in runs and analyses you never save are never written to the server.
• localStorage data — Persists in your browser until you clear it. No server-side copy exists.

Contract text is processed by Mistral La Plateforme within the European Union (Paris). No transfer outside the EU/EEA occurs for the AI analysis step.

Vercel and Railway may process operational metadata (request headers, IP addresses during a request) outside the EU under their respective data processing agreements. No contract text leaves the EU.

Under GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure of your data
• Restrict processing
• Data portability
• Object to processing
• Lodge a complaint with a supervisory authority

If you are signed in, you can exercise the rights of access (Art. 15) and erasure (Art. 17) directly from your account page. "Export my data" returns a single JSON bundle containing your account record and every saved analysis. "Delete my account" permanently removes your account and all associated data after a typed confirmation. For anonymous visitors, there is nothing on our servers to access or delete — your localStorage data is entirely under your control in your browser.

For any other requests, contact privacy@example.com.

Redline is a generative-AI tool subject to the transparency obligations in EU Regulation 2024/1689. Every analysis carries a provenance record (model, region, timestamp, reasoning-effort policy per pass) and a disclaimer that the output is AI-generated. The full mapping to Art 13 and Art 50, the pipeline diagram, the operator rollback levers, and the machine-readable receipt live on the transparency page.

We may update this policy from time to time. The "Last updated" date at the top of the page reflects the most recent revision. Material changes will be reflected by an updated date.