One thing on this page is still unfinished
- The limitation of liability, and whether GDPR or CCPA apply, need a lawyer. Those turn on where customers actually are, and boilerplate that does not hold up is worse than a narrower clause that does.
Everything else describes what the software genuinely does, including where your data goes.
Privacy Policy
Last updated: 12 August 2026. This describes how Billions Fine Art Limited, a company incorporated in Hong Kong — which also trades as BFA — handles data in ContractLens. ContractLens is one of its trading brands, not a separate company; the data controller is Billions Fine Art Limited. It is written to match what the software actually does — if you change the code, change this.
What we collect
- Account details — your email address and name, from Clerk when you sign up.
- Documents you submit — the contract text you paste, or the file you upload. Text is extracted from PDFs and DOCX files. If a PDF has no text layer, the file itself is sent to our AI provider so it can be read visually.
- Analysis results — the risk score, flagged clauses, summary, and suggested terms produced for each document.
- Usage records — timestamps, document size, page count, which model ran, token counts, and estimated cost. These drive quota and billing.
- Payment records — held by Stripe. We store only your Stripe customer and subscription identifiers, plan, status, and billing period. We never see or store card numbers.
Who else processes it
- Our AI analysis provider (mainland China) — receives your document text to produce the analysis. This is the only place your contract text is sent outside our own infrastructure, and it is outside Hong Kong. If that is unacceptable for a particular document, do not upload it. We will identify the provider to any customer who asks.
- Clerk — authentication and account management.
- Stripe — payments and subscription management.
- Neon (Postgres, hosted in AWS us-west-2, United States) — stores everything described above.
- Cloudflare (Workers) — runs the application at edge locations worldwide.
- Upstash — rate limiting. Stores a hashed request key and a counter; no document content.
Your data therefore leaves Hong Kong: to mainland China for the analysis itself, and to the United States for storage. We list this plainly because it is the kind of thing a reasonable person would want to know before uploading a confidential agreement.
[[ COUNSEL TO ADVISE: if you market to the EU or UK, transfers to mainland China and the United States each need a lawful basis and a transfer mechanism. That analysis is jurisdiction-specific and is not something this page can settle. ]]
Training
We do not train any model on your documents. What our analysis provider does with API traffic is governed by their terms rather than ours, and we cannot make that promise on their behalf — treat anything genuinely sensitive accordingly.
How long we keep it
Reviews are kept until you delete them. When you delete a review, the contract text, file name, and analysis are erased immediately; a record that a review was performed remains, with no document content in it, so that quota cannot be reset by deleting history.
Account and billing records are kept while your account exists, and afterwards for seven years, which is the period Hong Kong company and tax law requires business records to be retained.
Your rights
Depending on where you live you may have the right to access, correct, export, or erase your personal data, to object to or restrict processing, and to complain to a regulator. To exercise any of these, contact s@bfa.art.
Hong Kong's Personal Data (Privacy) Ordinance gives you rights of access and correction; we answer such requests within 40 days, the statutory limit. [[ COUNSEL TO ADVISE: whether GDPR, UK GDPR or CCPA also apply depends on who you actually market to. ]]
Security
Traffic is encrypted in transit. Access to review data is scoped to the account that created it. Passwords are handled entirely by Clerk and never reach our servers.
No system is perfectly secure. Consider whether a contract is too sensitive to upload to any third-party service before you upload it.
Cookies
We use the cookies Clerk needs to keep you signed in, and Stripe's cookies during checkout. We run no analytics and no advertising, so there is nothing else to consent to.
Contact
Billions Fine Art Limited
s@bfa.art
Unit 1603, 367-375 Queens Road Central
Sheung Wan, Hong Kong