Privacy Policy

There is no analytics on this site. No tracking cookies, no pixels, no third-party scripts. If you read this site and never sign up, we store nothing about you at all.

Once you do sign up, we store what the product needs to work: your account, the production facts you enter, the documents built from them, and the signature records that make those documents evidence. We do not sell any of it, we do not share it for advertising, and we do not use it to train models.

Browsing ClearFrame sets no cookie and writes no record. Our hosting provider keeps short-lived server logs the way every host does, which include IP addresses, and we do not build anything on top of them.

When you do sign up, we record one line about where you came from: a source label taken from the link you followed or the referring site, and the page you landed on. That is how we know whether writing answers is working. It is attached to the account being created, it is not a browsing history, and it is not collected for anyone who does not sign up.

We store:

• Your email address
• Your password, hashed with bcrypt — we cannot read it and cannot recover it for you
• Your company name
• Which plan you are on and when it renews
• Identifiers from Dodo Payments that link your account to your subscription

We never see your card number. It goes to Dodo Payments and stays there. What we get back is an identifier and whether the payment worked.

Everything you enter about a production is stored: the intake facts, the determination that ran against them, the rules-corpus version it used, the instruments generated, and the packets exported.

Determinations are kept rather than overwritten. A packet issued in July has to stay reproducible in October, after the corpus has moved on, or it is not a record. That retention is the product, not an oversight.

When you send a signature request, we store the signer’s name and email address so the document can reach them and the record can say who it went to.

When they sign, we additionally store:

• The name they typed
• Their drawn signature, if they drew one
• The exact time they signed
• Their IP address and browser user-agent string
• The SHA-256 hash of the exact document text they were shown

The IP address and the user-agent are there on purpose. A signature that cannot say when and from where it was made is weaker evidence, and the whole point of this record is that someone can rely on it later. We do not use either for anything else.

For those signers, you are the one who decided to collect this. We hold it on your behalf and act on your instructions.

If you signed something through ClearFrameand want to know what is held about you, email us and we will tell you what we have and put you in touch with the production that asked you to sign. If a document concerns a minor, the production is responsible for having a parent or guardian’s consent.

ClearFrame keeps an append-only log of what happened to a production: a determination run, a document generated, a request sent, a signature recorded. Entries include who acted and the IP address it came from, and each entry commits to the hash of the one before it.

That chaining is what makes the record trustworthy, and it means individual entries cannot be edited out. Deleting is still possible — see below — but it deletes the chain, not a line in the middle of it.

One cookie. It is called cf_session, it is what keeps you signed in, it is HTTP-only so scripts cannot read it, and it lasts 30 days. Signing out deletes it.

There is no analytics cookie, no advertising cookie and no third-party cookie, which is why this site has no consent banner. There is nothing to consent to.

Four companies, each doing one job:

• Vercel — hosts and serves the application
• Railway — runs the PostgreSQL database everything is stored in
• Dodo Payments — merchant of record; takes payments and holds card details, which we never see
• Zoho— runs the mailbox you reach us at. Email you send us is processed in Zoho’s India region

That is the whole list. We do not send your data anywhere else, and we do not use an analytics or advertising vendor at all.

DNS Ventures LLC is a United States company and ClearFrame is operated from the United States. Our infrastructure providers run equipment in more than one country and decide where a given record physically sits; we do not currently pin storage to a single region, and we would rather say so than imply a guarantee we cannot keep.

Your account and production data: because we need it to provide the service you asked for. Signer data: because you asked us to collect it in order to create a record you have a legitimate reason to hold. Billing records: because tax and accounting law requires us to keep them.

We do not rely on consent for marketing, because we do not send marketing email. We do not run cold outreach from this mailbox at all.

For as long as your account is open. Clearance records are meant to outlive the production — an E&O question can arrive years after delivery — so nothing expires on a timer.

Billing records are kept for as long as tax law requires, even after an account closes. Those are transaction records, not production data.

Email hello@synthworx.com from the address on the account and ask. We will confirm, then do it within 30 days.

Deleting your account destroys the clearance record with it: your productions, determinations, generated instruments, signature records and packets all go. Export anything you might need first.

That warning is not a hurdle to talk you out of it. It is that these records exist to be produced on demand later, and once the chain is gone we cannot rebuild it for you — which is the same property that makes it worth handing to an underwriter.

You can also just cancel and keep the account. Cancelling deletes nothing. See the Refund and Cancellation Policy.

Depending on where you live you may have specific rights over your data — to see it, to correct it, to have it deleted, to get a copy, or to object to some processing. The UK and EU GDPR and the California Consumer Privacy Act are the usual sources.

We do not run a different process depending on where you are. Email us and ask, and we will do it. We will not charge you for it and we will not make it harder than a reply.

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are used in California law. There is nothing to opt out of.

If you think we have handled your data badly, tell us first — but you are entitled to complain to your local data protection authority instead, and we will not treat that as a hostile act.

Passwords are hashed with bcrypt and never stored in a readable form. Traffic runs over TLS. Session cookies are HTTP-only and are not readable by scripts in the page. The audit log is hash-chained, so tampering with a stored record is detectable rather than silent.

We are a small operation and we will not pretend otherwise: we hold no security certification, and we are not going to claim one. What we will do is tell you promptly and plainly if a breach affects your data, including what we know and what we do not yet know.

ClearFrameis a tool for working productions and is not directed at children. You must be 18 to open an account. A minor may be the subject of a document, and may sign one where a parent or guardian has consented — that consent is the production’s responsibility, not something we verify.

If we change how any of this works, the date at the top of this page changes. If a change materially affects data we already hold about you, we will email you rather than rely on you noticing.

Privacy questions, access requests and deletion requests all go to hello@synthworx.com. DNS Ventures LLC is the controller of the data described here, except for signer data, where the production that sent the document is.