Privacy Policy

1. Information we collect

• Questions and inputs. The questions you ask and details you enter into our tools (e.g., seat counts, prices) so we can generate a response.
• Benchmark contributions. When the contribution option is on in a calculator (it is on by default; you can opt out), the structured price points you enter — product, price per seat, agreement type, term, and a banded org size, never your name, email, company, or quote text — are stored as de-identifiedbenchmark data. See “Benchmark data” below.
• Anonymous usage. We meter free usage and collect aggregate analytics (e.g., counts of questions, pages viewed). Free usage can be used without an account.
• Account information. If you create an account, your email address (via magic-link sign-in) and subscription status.
• Technical data. Standard server logs such as IP address, browser type, and timestamps, used for security and rate-limiting.

2. How we use information

To provide and improve the Service, generate responses, meter and secure usage, process payments, communicate with you, build de-identified aggregated pricing benchmarks (see “Benchmark data”), and comply with legal obligations. [PLACEHOLDER: confirm whether any data is used for product analytics or model evaluation, and disclose accordingly.]

3. AI processing

To answer questions, your inputs are sent to our AI provider, Anthropic, to generate a response. We use Anthropic’s Claude models under Anthropic’s commercial API terms, which do not use customer inputs to train models. We send only the minimum necessary and do not include your account email in the content sent for generation except as needed to operate the Service. Anthropic may retain API inputs only briefly (currently up to 30 days) for safety and abuse monitoring; we do not retain your prompts after your result is generated.

4. Cookies and similar technologies

We use cookies and similar technologies for essential functionality (such as sign-in sessions and rate-limiting) and, where applicable, analytics. [PLACEHOLDER: add a cookie table and consent mechanism if required in your jurisdiction.]

5. Payments

Payments are processed by Stripe. We do not store full payment-card numbers; card data is handled by Stripe under its own privacy terms. We receive limited billing metadata (e.g., subscription status and the last four digits of a card) to manage your subscription.

6. Documents you upload

Certain features (such as an Enterprise “upload your contract” capability) may let you upload documents. For any such uploads:

• Purpose limitation. Uploaded documents are used only to provide the requested analysis to you, not for unrelated purposes.
• No model training. We do not use your uploaded documents to train AI models; our AI provider, Anthropic, does not train on inputs under its commercial terms.
• Retention. Uploaded documents are retained only as long as needed to provide the requested analysis and are deleted within 30 days — or within 7 days of a deletion request.
• Deletion. You may request deletion of your uploaded documents at any time by contacting us.

7. Benchmark data (pricing you contribute)

To help everyone understand what Microsoft licensing really costs, we build aggregated pricing benchmarks from the price points users enter into our calculators. This is how it works:

• What we store. Only structured fields — product, price per unit, agreement type, term, a banded org-size range, and region. We do not store your name, email, company, or any quote text. A one-way (salted, non-reversible) hash is kept only to limit abuse and de-duplicate; it does not identify you.
• De-identified, then aggregated. Because contributions are stripped of identifiers and reduced to structured values, we treat them as de-identified. Benchmarks are only ever shown as aggregates (e.g., 25th/50th/75th percentiles) and never for a group smaller than a minimum sample size (k-anonymity), so no individual submission can be singled out.
• Purpose & legal basis. We use this data to produce and improve pricing benchmarks for current and future users. Where the GDPR/UK GDPR applies, our legal basis is legitimate interests in providing market-rate transparency, balanced against your rights. [PLACEHOLDER: confirm the legal basis and balancing test with counsel.]
• Your choice. Contribution is on by default and you can opt out at any time using the checkbox in the calculator. EU/UK users are reminded of this choice next to the control.
• No sale. We do not sell this data. We may publish or share only the aggregated, de-identified benchmarks.

8. Sharing

We share information with service providers that operate the Service on our behalf under appropriate confidentiality obligations, and where required by law. Our sub-processors are Vercel (hosting and content delivery), Supabase (database and authentication), Anthropic (AI processing), Stripe (payments), Resend (transactional email), and, where enabled, Cloudflare (Turnstile bot protection on sign-in and account forms). We do not sell your personal information.

9. Data retention

We keep personal information for as long as needed to provide the Service and for legitimate business or legal purposes, then delete or anonymise it. Specifically: the prompts and figures you enter are not retained once your result is generated; account data and saved scenarios are kept until you delete them or close your account, then removed from our live systems within 7 days of your request (and purged from backups as they roll over); and security, audit, and rate-limiting logs are deleted automatically after 30 days. We do not auto-delete the renewals and scenarios you save — they remain until you remove them, so your renewal reminders keep working. De-identified benchmark contributions are retained in aggregate to keep benchmarks accurate.

10. Your rights (GDPR / CCPA)

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing. California residents may have rights under the CCPA/CPRA, and EU/UK residents under the GDPR/UK GDPR. Note that de-identified, aggregated benchmark data generally is not “personal information” and may not be subject to access or deletion once aggregated. [PLACEHOLDER: confirm the data controller of record, legal bases for processing, international-transfer mechanism, and how to exercise these rights.]

11. Children's privacy

The Service is intended for business users and is not directed to children. You must be at least 18 years old (or the age of majority where you live) to use it. We do not knowingly collect personal information from anyone under 18.

12. Changes to this policy

We may update this policy; material changes will be reflected by updating the “Last updated” date above.

13. Contact

Privacy questions or requests: legal@renewalcheck.io.