Privacy Policy

Who we are

Qedara Contract Management ("Qedara", "we") is an AI-assisted contract management platform operated by QEDARA S.R.L., Romania, company tax identifier (CUI) 54412264. This policy explains what data we process when you use the service. Contact: office@qedara.com.

Data we process

Account data: name, email address, password (stored only as a salted hash), email-verification status, session metadata.

Workspace data: workspace names, membership and roles, invitations (invitee email and role).

Document data: uploaded PDF/DOCX files, native documents, drafting requests, extracted text, metadata and versions. Signing workflows also process recipient details, verification events, signed documents and evidence packages.

AI analysis: summaries, extracted parties, dates, clauses, risks, obligations, comparison results and risk scores generated from your contracts.

Audit logs: security-relevant events (logins, uploads, exports, deletions, role changes) with user, timestamp, IP address and event metadata. Do not include passwords or document content in support messages or free-text audit metadata.

AI processing

AI features can transmit relevant document text, questions, drafting instructions or offer information to the configured AI provider. For OpenAI Responses requests, QCM sets store:false. This controls response storage; it does not establish Zero Data Retention or exclude provider abuse-monitoring retention.

AI output is informational only. It does not constitute legal advice — see the AI Processing Notice.

Purposes and responsibilities

Qedara handles business contact, account administration, support and security information to provide the service and protect it. Depending on the relationship, processing relies on the contract with you, legal obligations, or legitimate interests in operating and securing a business service. Optional browser preferences require your choice.

For contract content processed on behalf of a customer, the customer determines the purposes and legal basis and Qedara acts under documented instructions and the applicable data-processing agreement. Confidential business information is not automatically a special category of personal data.

Your responsibility for uploaded content

You confirm that you have the legal right to upload and process each document you submit, including any personal data it contains, and that doing so does not violate confidentiality obligations you owe to third parties. You are the data controller for the contract content you upload; Qedara processes it on your behalf.

Retention and deletion

Workspace content is retained to provide the contracted service. Authorised deletion requests are handled through the applicable product controls and support process. Deleting an account does not necessarily delete records owned by an organisation or evidence that must be retained.

Active content, signed evidence, security logs and backups have different lifecycles. Retention and deletion are subject to the applicable agreement, security needs and legal preservation requirements. Ask office@qedara.com for the schedule applicable to your workspace and confirmation of a deletion request.

Deletion from the active service does not immediately remove historical backup copies. Backups remain access-restricted and expire under the applicable backup schedule. We do not represent an unverified automatic purge or a universal retention period as a guarantee.

Your rights

You can export your workspace data (Settings / API), delete contracts, workspaces or your entire account from within the product, and request assistance at office@qedara.com. EU users have the rights provided by the GDPR, including access, rectification, erasure, portability and complaint to a supervisory authority.

Subprocessors

OpenAI (AI operations; response storage and provider retention are distinct), Resend (transactional email), Hetzner (EU hosting). We do not sell personal data and we do not use your contract content to train AI models.