ContractMaker Create a document

Privacy Policy

Last updated: 5 November 2026

1. Who we are and how to reach us

ContractMaker (contractmaker.app) is operated by Yassine Rajallah, a sole proprietor under German law (“ContractMaker,” “we,” “us,” or “our”). This Privacy Policy explains how we handle information when you use our document generation tool and website (the “Service”).

Controller: Yassine Rajallah, Berlin, Germany. Email: contact@contractmaker.app

Data Protection Officer: we are not legally required to appoint a Data Protection Officer. For all privacy matters, contact us directly at the address above.

Our core privacy promise: the documents you create are assembled entirely in your browser. The details you type into the generator — party names, scope, prices, dates, and any other contract content — are processed on your own device and are never transmitted to, seen by, or stored on our servers.

This policy is provided pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR) and applicable German data protection law.

2. How document generation works

When you use the ContractMaker generator:

  1. You select a base template and fill in plain-language fields.
  2. The fields are merged into the template locally, in your browser, using client-side code.
  3. You download, copy, or print the finished document directly from your device.
  4. We do not receive a copy of your inputs or your generated document, and we cannot retrieve them.

2a. ContractMaker in ChatGPT and other AI assistants

You can use ContractMaker inside an AI assistant such as ChatGPT. The assistant calls a server of ours at mcp.contractmaker.app to find a template and build a draft. This section describes only that server. The assistant itself, and your conversation with it, are covered by the privacy policy of its maker, for example OpenAI. Section 2 above describes the generator on this website, which works differently: there, your inputs stay in your browser.

  • What the server gets: the values the assistant sends for one request, for example a template name, the names of the two parties, a description of the work, dates and other details you gave the assistant. That can include personal data. It does not get your account, your conversation or your location.
  • Accounts: there is no account and no sign-in. The server uses no cookies.
  • What we keep: we do not save the values you send or the drafts. A draft exists only in the answer sent back to the assistant. The server writes a short log line for each request: the time, the tool name, the result status and how long it took. The log does not contain the values.
  • Web server log: the web server in front of it (nginx) keeps an access log with IP addresses, the path of the request and the client name, for up to 14 days, for security and to find and stop abuse. Legal basis: legitimate interests (Art. 6(1)(f) GDPR). Building the draft is done to give you the answer you asked for (Art. 6(1)(b) GDPR).
  • Where it runs: on Amazon Web Services in Frankfurt, Germany. We do not share the data with anyone.
  • Drafts are not legal advice: see Section 5 of the Terms of Service.

3. Information we process vs. information we store

What we process but never store

  • Document content: the information you enter into the generator, processed only in your browser and never sent to us.
  • Generated documents: created on your device; we keep no copy.

What we may store

  • Server logs: technical request data (such as IP address, date and time, requested page, and browser type) that is processed when your browser loads the site or the analytics script, as described in Sections 4 and 5.
  • Analytics: usage data such as page views and the technical details listed in Section 5 (no document content), if you have not switched analytics off.
  • Support communications: your email address and message if you contact us by email, and what you write in the chat widget if you use it.
  • Account information (only if and when accounts are offered): email, name, and an encrypted password.
  • Billing data (only if and when paid plans are offered): transaction history and subscription status, handled by our payment processor.

The Service is currently free and does not require an account. Account and billing data are processed only if you choose to register or purchase once such features are available.

4. Legal basis for processing (GDPR)

We process personal data only where a lawful basis exists under Article 6 GDPR.

  • Legitimate interests (Art. 6(1)(f)): to deliver, secure, and protect the website against abuse (server and hosting logs, delivery through a content delivery network), to display the site correctly (web font), to answer your questions (email and chat), and to understand which pages help visitors most so we can improve the Service (analytics, Section 5). We have weighed these interests against yours, we limit the data to what is necessary, and you can object at any time (see Sections 5 and 9).
  • Contract (Art. 6(1)(b)): to answer requests you make before a contract, and to provide a paid plan you subscribe to (if applicable).
  • Legal obligations (Art. 6(1)(c)): to keep tax and accounting records.
  • Consent (Art. 6(1)(a)): for marketing communications, should we ever send any, and wherever the law requires consent for something we ask you about.

5. Cookies and analytics

5.1 Cookie banner and your choice

On your first visit a cookie banner appears at the bottom-left of the page. The analytics described below run unless you decline: you decline by choosing “Customize,” switching “Analytics & performance” off, and saving. Choosing “Accept” or closing the banner with the x grants the setting. Closing the preferences window without saving does not change anything and the banner stays visible. The preferences window also lists further categories (functional, targeting and advertising, social media); we do not use cookies for those purposes of our own, and only the Analytics switch has an effect.

Your choice is stored in the first-party cookie cookie_consent (value “granted” or “denied”) for 180 days. You can change it at any time with “Cookie settings” in the footer of every page. If you decline, the analytics cookies listed below are deleted, both analytics tools stop, and they are not loaded on later visits. To keep the tools off on your device, the banner also stores small markers in your browser’s local storage (named datafast_ignore and ck_df_ignored); these contain no personal data.

5.2 Our own analytics: selfast

We measure visits with selfast, an analytics tool that runs on our own server at dataf.blazehive.io (hosted with AWS in Ireland and delivered through Cloudflare). It is not a third-party analytics service. For each page view it collects the page address, the referrer, browser, operating system and device type, language, time zone, screen size, approximate location (country, region, and city derived from your IP address), and a random visitor ID and session ID. It uses four first-party cookies:

  • datafast_visitor_id: random visitor ID, 1 year;
  • datafast_visitor_first_seen_at: time of the first visit, 1 year;
  • datafast_visitor_session_count: number of sessions, 1 year;
  • datafast_session_id: random session ID, 30 minutes after the last page view.

The statistics database does not store your IP address. The server’s access log, however, keeps IP addresses for up to 14 days (to operate and protect the server) and is then deleted. We do not sell this data and do not share it with anyone else.

5.3 Google Analytics 4

We also use Google Analytics 4 (measurement ID G-CQBQT2L3SM), a web analytics service provided by Google. It sets the cookies _ga and _ga_* in your browser and sends usage data about your visit, including your IP address, to Google. It is loaded under the same rules as selfast: it runs unless you decline as described in Section 5.1, and declining deletes these cookies and stops the tool. Google processes this data under its own terms; for more information see Google’s privacy policy.

5.4 Other cookies and similar technologies

  • cookie_consent: stores your banner choice (180 days). It is necessary to remember your decision.
  • Customer chat (Crisp): every page loads the chat widget of Crisp, a live-chat provider. Your browser therefore connects to Crisp’s servers, which receive your IP address and technical data, and Crisp may store cookies or similar identifiers in your browser to run the chat. If you write to us in the chat, we and Crisp process what you send. This widget is not controlled by the “Analytics & performance” switch.
  • Web font (Google Fonts): the site loads the Inter typeface from Google’s font servers, so your browser sends your IP address and browser details to Google when a page loads.
  • Hosting and delivery (Cloudflare): the site is delivered through Cloudflare, which processes request data, including your IP address, to deliver the pages and protect them against abuse.

You can also control or delete cookies in your browser settings. We do not use advertising cookies and do not share cookie data with advertisers.

6. Your privacy rights

You have the following rights under Chapter III GDPR:

  • Access (Art. 15): obtain confirmation of processing and a copy of your personal data;
  • Rectification (Art. 16): have inaccurate data corrected without undue delay;
  • Erasure (Art. 17): request deletion where data is no longer necessary, consent is withdrawn, or processing is unlawful;
  • Restriction (Art. 18): restrict processing while accuracy is contested or an objection is pending;
  • Portability (Art. 20): receive your data in a structured, commonly used, machine-readable format;
  • Object (Art. 21): object at any time to processing based on legitimate interests; for analytics you can do so immediately with “Cookie settings” in the footer;
  • Withdraw consent (Art. 7(3)): withdraw any consent at any time; withdrawal does not affect prior lawful processing;
  • Complaint (Art. 77): lodge a complaint with a supervisory authority (Section 12).

To exercise any right, email contact@contractmaker.app with the subject line “Data Subject Request.” We will respond within one (1) month of receipt; for complex or numerous requests we may extend this by a further two months and will tell you within the first month. We do not charge a fee unless requests are manifestly unfounded or excessive, and we may ask for proof of identity. Because the statistics use random IDs and we do not store your IP address in the statistics database, we may need the visitor ID from your cookie to find data about you.

7. Data retention

  • Document content & generated documents: never stored (processed in your browser only).
  • AI assistant server (Section 2a): the values sent for a request and the drafts are not stored. Its web server access log, with IP addresses and request paths: up to 14 days.
  • Cookie consent choice: the cookie_consent cookie lasts 180 days.
  • Analytics cookies: selfast cookies last 1 year (visitor ID, first-seen time, and session count) and 30 minutes after the last page view (session ID); declining deletes them.
  • Analytics server access log: IP addresses are kept for up to 14 days.
  • Analytics statistics: no IP address is stored; retained no longer than necessary.
  • Support correspondence: up to 2 years.
  • Billing records (if applicable): up to 10 years, as required by German tax law (§ 147 AO).

After retention periods expire, data is securely deleted or irreversibly anonymized.

8. Third-party services and recipients

We rely on a small number of carefully selected providers. We do not sell personal data.

  • Hosting & CDN (Cloudflare): serves the website and static assets.
  • Analytics server: selfast, run by us on AWS infrastructure in Ireland and delivered through Cloudflare (Section 5.2).
  • Google: Google Analytics 4 (Section 5.3) and the Google Fonts service (Section 5.4).
  • Crisp: customer chat widget (Section 5.4).
  • Payment processor (if and when paid plans launch): handles billing securely and is PCI-DSS compliant; we never see full card numbers.

9. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR), and no profiling for advertising or credit scoring takes place.

10. Data security

  • Encryption: TLS for data in transit.
  • Minimal data: because document content never leaves your browser, there is nothing for us to lose.
  • Incident response: where a personal data breach is likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority within 72 hours (Art. 33 GDPR) and, where the risk is high, you without undue delay (Art. 34 GDPR).

11. International transfers

Our own analytics server is located in the European Union (Ireland). Google and Crisp, however, may process data outside the European Union or the EEA, including in the United States. Where this happens, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision, as provided by the respective provider. Declining analytics in the cookie banner stops the transfer of analytics data to Google.

12. Supervisory authority

You have the right to lodge a complaint with your local data protection authority. For our establishment, that is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Friedrichstr. 219, 10969 Berlin, Germany, www.datenschutz-berlin.de. We would, however, appreciate the opportunity to address your concern before you contact the authority, so please reach out to us first at contact@contractmaker.app.

13. Children’s privacy

ContractMaker is not intended for users under 18. We do not knowingly collect data from children. If you believe a child has provided us data, please contact us and we will delete it without undue delay.

14. California privacy rights

California residents have rights under the CCPA/CPRA, including to know what personal information we collect, to request deletion or correction, and to opt out of any “sale” or “sharing” of personal information. We do not sell or share personal information as defined under the CCPA, and you will not be discriminated against for exercising your rights. To exercise them, contact contact@contractmaker.app.

15. Changes to this policy

We may update this policy to reflect legal requirements, new features, or security improvements. The current version is always available at contractmaker.app/privacy-policy with the “Last updated” date at the top. Material changes will be notified via the website or, where you have an account, by email at least 14 days before they take effect.

16. Contact us

Questions or requests about your privacy:
Email: contact@contractmaker.app
Operator: Yassine Rajallah, Berlin, Germany

For complaints, you may also contact the supervisory authority named in Section 12.

By using ContractMaker, you acknowledge that you have read and understood this Privacy Policy.