Privacy policy

Learn how Custonic protects data through disclosed storage and processing locations, tenant isolation, and documented processor terms.

Last updated: September 2026

Who we are

Custonic is operated by Monrad Ruzt Technology (MRT), based in Norway. Contact: privacy@custonic.com

What data we collect

We collect account information such as email, name, and organization; uploaded contracts processed for analysis and stored in the configured Supabase EU project; and limited technical and workflow events required to operate, secure, retry, and troubleshoot the service.

How we use your data

We use data to provide contract analysis services, send configured alerts and notifications, and improve the product through anonymized aggregated analytics. We never sell your data, and we never use your contracts to train AI models.

Where your data is stored

Persistent account data, contracts, findings and settings are stored in the Supabase EU project in Stockholm, while application functions run in Vercel Frankfurt. Vercel Workflow stores encrypted identifier/status payloads plus unencrypted operational metadata for durable execution in iad1; contract text, findings and summaries are excluded from that workflow payload. Contract content is sent to Anthropic under its commercial API terms: inputs and outputs are not used for model training by default, and standard deletion is within 30 days; zero data retention applies only if separately contracted.

Your rights (GDPR)

You can request access, rectification, erasure, and portability of your data, withdraw consent, and lodge a complaint with a supervisory authority. Contact: privacy@custonic.com

Cookies

We use essential cookies for authentication and session management. The current product does not claim an active third-party analytics deployment and does not use third-party advertising cookies.

Changes to this policy

We will notify registered users of material policy changes by email.