← Back to login

Privacy Policy

Last updated: May 19, 2026

Overview

Contracts Tracker is an internal productivity tool built and operated by Takeshi Nakagawa. It is not a public service. Access is limited to invited members of the IT engineering team.

This policy explains what data the application accesses, how it is used, how it is stored, and what rights you have over your data.

Legal Basis for Processing

Contracts Tracker processes your data based on your explicit consent, which you provide when you first sign in and accept the data processing terms. You may withdraw consent at any time by deleting your account from the Settings page.

Processing is limited to what is necessary to track vendor contracts and renewals (Drive-based contract discovery, opt-in AI term extraction, Jira renewal tickets). Vendor and signatory details appearing inside contract documents are processed under legitimate interest (Art. 6(1)(f)).

Data We Access

Contracts Tracker connects to the following services. All non-Google connections are optional and initiated by you from the Settings page.

Google Account

  • Profile: Name, email address, and profile picture for account identification.
  • Google Drive (optional): Read-only access used solely to discover contract documents in the shared vendor-contracts folder (folder/file names, links, modification dates). Documents may contain vendor signatory names and contact details. Nothing is written to your Drive.

Atlassian Jira

  • Renewal tickets: Creates and updates one Jira ticket per vendor approaching renewal. The contract owner is set as the ticket requester and added as a watcher, so renewal alerts route through Jira (no separate email channel).

Anthropic Claude API

  • Contract documents are sent to the Claude API only when you explicitly click Extract on a specific document, to propose commercial terms (cost, dates, notice period, auto-renewal). One document at a time; the feature defaults off until an administrator enables it.
  • Untrusted document text is wrapped in clearly-marked sections with a prompt-injection notice, and the AI output is validated before it is shown for your review — nothing is saved until you accept it.
  • Anthropic does not retain data between requests per its API data policy. API requests are not used for model training.
  • A global kill switch and per-feature toggles let administrators disable any AI feature instantly; per-feature hourly volume caps prevent runaway automation.

Privacy Boundaries

  • Google Drive access is scoped to the designated shared vendor-contracts folder — not broad drive enumeration, and never your personal files.
  • This deployment stores its data in its own isolated database with its own encryption key, separate from any other DEPT system.
  • AI term extraction runs only on your explicit click, one document at a time, and is rate-capped.

Data We Store

The following data is stored in the application database:

Stored

  • Account info: Google profile (name, email, picture), role, creation date, and consent timestamp.
  • OAuth tokens: Google and Jira tokens, encrypted at rest using Fernet symmetric encryption (AES-128 + HMAC). Used to make API calls on your behalf.
  • Vendor and contract records: Vendor names, products, costs, renewal/notice dates, assigned owners, document links, Jira ticket keys, and — when you accept an AI extraction — the extracted terms and a short key-terms summary. The full contract text is never persisted. Documents may contain vendor signatory names and contacts as they appear in the contract.
  • API usage logs: Claude token counts and external API call counts per user, for monitoring, cost tracking, and per-feature rate caps.
  • Audit logs: Actions performed in the app (login, sync, settings changes, ticket creation) for security and debugging.

Not Stored

  • Full contract document text (only extracted terms and a key-terms summary, after you accept them)
  • Google Drive file contents beyond contract metadata (names, links, dates)
  • Any calendar, email, Slack, or HR data — this deployment does not connect to those systems

Data Security

  • The application runs on Google Cloud Run with HTTPS enforced and HSTS (Strict-Transport-Security) enabled.
  • Database is hosted on Google Cloud SQL (PostgreSQL) in the us-central1 region, encrypted at rest.
  • OAuth tokens are encrypted using Fernet symmetric encryption (AES-128 + HMAC-SHA256) before storage.
  • Secrets (API keys, client secrets, signing keys) are managed via Google Cloud Secret Manager.
  • CSRF protection, rate limiting, CORS restrictions, Content Security Policy, and Permissions-Policy headers are enforced.
  • Session cookies are signed, HttpOnly, Secure, SameSite=Lax, and expire after 7 days.
  • The application container runs as a non-root user following the principle of least privilege.
  • All admin actions are logged in an immutable audit trail.

Data Retention

Data is retained only as long as necessary for its stated purpose. The following retention periods are enforced automatically:

  • Vendor and contract records: Kept for the life of the vendor relationship; archived records are retained for history and can be purged by an administrator.
  • API usage logs (Claude and external): Automatically deleted after 90 days.
  • Audit logs: Automatically deleted after 1 year.

A daily automated retention job enforces these periods. You may also request immediate deletion at any time (see Your Rights below).

Third-Party Services

The following third-party services process your data as described above:

No data is sold to or shared with third parties for advertising, marketing, or any purpose beyond operating this application.

Your Rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15): You can view what data is stored about you in the Settings page.
  • Right to data portability (Art. 20): You can download all your data as a JSON file from Settings > Your Data > Download My Data.
  • Right to erasure (Art. 17): You can delete your account and all associated data from Settings > Your Data > Delete My Account. This action is immediate and irreversible.
  • Right to withdraw consent: You can withdraw consent at any time by deleting your account. You can also disconnect individual services (Google Drive, Jira) from the Settings page.
  • Right to rectification (Art. 16): Account data (name, email, picture) is synced from your Google account. Update it there to update it here.
  • Admin users can also purge individual user data via the Data & Privacy admin panel.

All data subject requests are processed immediately through self-service. If you need additional assistance, contact the administrator.

Contact

For questions about this policy or your data, contact Takeshi Nakagawa.