How we look after your contracts

What happens to a contract you upload

Your file is stored encrypted in a private storage bucket that isn’t publicly accessible, and only the LegalSling app has permission to read it. Its text is split into numbered paragraphs and kept with your analysis, your notes and your questions, all linked to your account and shown only to you.

To produce the analysis, LegalSling sends the contract’s text to Claude, an AI model made by Anthropic, through Anthropic’s API. For a scanned PDF, the file itself is sent, so its pages can be read. The same applies to the questions you ask about a contract.

• No training on your documents. LegalSling doesn’t train AI models, and Anthropic’s commercial terms don’t allow it to train its models on content sent through its API.
• Encrypted in transit. The app only works over HTTPS, and it talks to Anthropic, Stripe and its file storage over encrypted connections too.
• Hosted on Amazon Web Services. The app, its database and your files run on AWS.

Deleting your documents and account

You can delete any document at any time. That deletes the stored file, the analysis, your notes on its clauses and the questions you asked about it.

Deleting your account deletes all of your documents, your credit history and your account details. Two things outlast it:

• Stripe’s payment records. If you bought credits, Stripe keeps its own record of the payment, for tax and accounting.
• A one-way hash of your email address. Free credits are given once per person, so a hash made from your address is kept to recognise it if you sign up again. Your address itself isn’t kept, and the hash holds nothing else.

Payments

Credits are paid for through Stripe Checkout. Your card details are entered on Stripe’s payment page and go straight to Stripe: LegalSling never sees or stores them. We keep the payment’s reference and amount, and a history of how your credits were used, so your balance always adds up.

Your account

• Passwords are stored only as a salted, one-way hash, never as the password itself.
• Sign-in attempts are limited, to slow down anyone trying to guess a password.
• The app uses one essential cookie, to keep you signed in. It’s marked secure and can’t be read by scripts on the page. The only other cookies are the optional ones for ads, below.
• Every form is protected against cross-site request forgery, and a strict content security policy limits what can run in the page.
• We email you only about your account, such as a link to reset your password. Payment receipts come from Stripe.

Cookies and ads

We advertise on Reddit and Google, and we’d like to know which ads bring people to LegalSling. So we ask before using Reddit’s pixel and Google’s tag, small scripts from each. If you allow them, they set their own cookies (such as Reddit’s _rdt_uuid and Google’s _gcl_au) and tell Reddit and Google when you visit this site, open the sign-up page, create an account or buy credits, so they can match those visits to their ads. They also receive what any website you load receives, such as your IP address and the kind of browser you use. We ask Google not to use this to show you ads elsewhere.

• They never run alongside your contracts. In the app they run on only three pages: the sign-up page, the page you see straight after signing up, and the one that thanks you for a payment. Every other page in the app blocks them.
• Nothing about you or your contracts goes with them. We don’t send Reddit or Google your name, your email address or anything from a document. A purchase is reported only as its amount and currency.
• They’re off unless you say yes. If you say no, or don’t choose, nothing is sent to Reddit or Google. Your choice is kept in a cookie of ours (legalsling_ads) for six months, for this site and the app.

Contracts are read, never obeyed

A contract could contain text written to mislead an AI reviewer, such as hidden white text asking it to describe the terms as fair. LegalSling treats everything in a document as text to explain, never as instructions to follow. Text addressed to an AI or a reviewer, and text hidden in a Word document, is flagged in the analysis so you can see it.

Reporting a security problem

If you think you’ve found a security problem in LegalSling, please email hello@legalsling.com with the details, and we’ll look into it and reply.