Privacy Policy

1. Introduction

Statuteharbor, Inc. ("the Company," "we," "us," or "our") operates the website statuteharbor.com and provides an AI-assisted M&A contract review and due diligence service for corporate legal teams (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to information we collect through the Service and through direct communications with you.

The Company serves corporate counsel and M&A teams who upload purchase agreements and related transactional documents to receive structured first-pass clause analysis. Because our customers work with sensitive transactional materials, we have designed our data handling practices with the confidentiality standards that legal practice requires.

We are based at 101 Federal Street, Suite 1600, Boston, MA 02110 and can be reached at [email protected].

2. Information We Collect

2.1 Account and Contact Information

When you register for the Service, request early access, or contact us, we collect:

• Name, work email address, and phone number;
• Company name, job title, and practice area (e.g., in-house M&A, corporate transactions);
• The content of messages or inquiries you send us.

2.2 Uploaded M&A Documents

The core function of Statuteharbor is reviewing M&A purchase agreements and related transactional documents. When you use the Service, we receive and temporarily process the files you upload - typically stock purchase agreements, asset purchase agreements, merger agreements, and associated schedules. These documents may contain sensitive commercial information, personally identifying information about parties to a transaction, and materials subject to attorney-client privilege.

No-training commitment: Documents you upload are never used to train, fine-tune, or evaluate any machine learning model, including Statuteharbor's own review system. Processing occurs in isolated compute environments. Uploaded agreements are deleted from Statuteharbor systems 30 days after review completion, or immediately upon your request. This commitment is a core product design decision, not a policy addendum.

2.3 Usage and Technical Data

When you visit statuteharbor.com, we automatically collect limited technical information:

• IP address and approximate location (city/region level);
• Browser type, operating system, and device class;
• Pages visited, referring URLs, and time on page;
• Cookie and similar identifiers (see Section 5).

2.4 We Do Not Knowingly Collect Children's Data

statuteharbor.com is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it.

3. How We Use Information

We use the information we collect to:

• Provide the AI-assisted M&A document review and clause-flagging functionality you requested;
• Respond to inquiries and support requests;
• Operate, maintain, and improve the Service;
• Send service-related communications and, with your consent where required, marketing updates;
• Detect, investigate, and prevent fraud or abuse;
• Comply with legal obligations.

We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see your state's section below.

4. Sharing of Information

We share personal information only with:

• Service providers acting on our behalf (such as cloud hosting, email delivery, and anonymized analytics) under contractual confidentiality terms. These providers do not receive uploaded M&A documents for any purpose other than storage and delivery of the Service;
• Authorities, when required by law or to protect rights, safety, or property;
• A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information to third parties. Uploaded M&A documents are never shared with third parties for any purpose beyond operating the clause-review function.

5. Cookies and Tracking

We use cookies and similar technologies to operate the site, remember preferences, and measure usage. For details and choices, see our Cookie Policy.

6. Data Retention

We retain different categories of data on different schedules:

• Uploaded M&A documents: deleted 30 days after review completion, or immediately on request. No backup retention after deletion;
• Account and contact information: retained for the duration of your account, then 12 months after account closure to resolve any outstanding matters;
• Marketing-list contacts: inactive contacts are removed after 24 months;
• Server access logs: retained 90 days, then aggregated.

7. Security

We use administrative, technical, and physical safeguards designed to protect personal information and uploaded documents, including AES-256 encryption at rest, TLS 1.3 in transit, restricted-access databases, and least-privilege access controls. All document processing occurs in US data centers. No system is perfectly secure; we cannot guarantee absolute security.

8. Your General Rights

Depending on your jurisdiction, you may have rights including access, correction, deletion, and the ability to limit certain processing. To make a request, email [email protected]. We will respond within the timeframe required by applicable law.

9. Massachusetts Residents

Massachusetts does not currently have a comprehensive consumer privacy statute. As a matter of policy, the Company extends the following baseline rights to all U.S. residents regardless of state of residence.

9.1 Baseline Rights

• Right to Know: request the categories of personal information we have collected about you.
• Right to Delete: request deletion of personal information you have provided.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Marketing: unsubscribe from marketing emails or opt out via the link in each marketing message.

9.2 How to Exercise

Email [email protected] with a description of your request and enough detail for us to verify your identity. We respond within 45 days.

9.3 Sector-Specific Rights

If you are protected by federal sector laws (such as HIPAA, GLBA, or FERPA), those laws may give you additional rights with respect to data covered by them.

9.4 California Visitors

If you are a California resident, you may exercise the rights granted under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. The Company does not sell personal information and does not "share" personal information for cross-context behavioral advertising.

To submit a CCPA/CPRA request, email [email protected] with the subject line "California Privacy Request."

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Service.

11. Contact

Questions, requests, or complaints about this Policy can be sent to: