How we look after your contracts

What happens to a contract you upload

Your file is stored encrypted in a private storage bucket that isn’t publicly accessible, and only the LegalSling app has permission to read it. Its text is split into numbered paragraphs and kept with your analysis, your notes and your questions, all linked to your account and shown only to you.

To produce the analysis, LegalSling sends the contract’s text to Claude, an AI model made by Anthropic, through Anthropic’s API. For a scanned PDF, the file itself is sent, so its pages can be read. The same applies to the questions you ask about a contract.

• No training on your documents. LegalSling doesn’t train AI models, and Anthropic’s commercial terms don’t allow it to train its models on content sent through its API.
• Encrypted in transit. The app only works over HTTPS, and it talks to Anthropic, Stripe and its file storage over encrypted connections too.
• Hosted on Amazon Web Services. The app, its database and your files run on AWS.

Deleting your documents and account

You can delete any document at any time. That deletes the stored file, the analysis, your notes on its clauses and the questions you asked about it.

Deleting your account deletes all of your documents, your credit history and your account details. Two things outlast it:

• Stripe’s payment records. If you bought credits, Stripe keeps its own record of the payment, for tax and accounting.
• A one-way hash of your email address. Free credits are given once per person, so a hash made from your address is kept to recognise it if you sign up again. Your address itself isn’t kept, and the hash holds nothing else.

Payments

Credits are paid for through Stripe Checkout. Your card details are entered on Stripe’s payment page and go straight to Stripe: LegalSling never sees or stores them. We keep the payment’s reference and amount, and a history of how your credits were used, so your balance always adds up.

Your account

• Passwords are stored only as a salted, one-way hash, never as the password itself.
• Sign-in attempts are limited, to slow down anyone trying to guess a password.
• The app uses one essential cookie, to keep you signed in. It’s marked secure and can’t be read by scripts on the page.
• Every form is protected against cross-site request forgery, and a strict content security policy limits what can run in the page.
• We email you only about your account: to confirm your address and to reset your password. Payment receipts come from Stripe.

Contracts are read, never obeyed

A contract could contain text written to mislead an AI reviewer, such as hidden white text asking it to describe the terms as fair. LegalSling treats everything in a document as text to explain, never as instructions to follow. Text addressed to an AI or a reviewer, and text hidden in a Word document, is flagged in the analysis so you can see it.

Reporting a security problem

If you think you’ve found a security problem in LegalSling, please email [email protected] with the details, and we’ll look into it and reply.