1. Who We Are

TermLift is a supplier-quote analysis and negotiation service operated by its founding team. We help businesses analyse supplier quotes and negotiate better commercial terms, using AI to surface negotiation leverage and identify risks.

Contact: hello@termlift.com

2. What We Collect

Account Info:

• Email address (for login and service communications)
• Password (hashed — we never store or see your plaintext password)
• How many analyses you have run

Deal Data:

• Text extracted from your uploaded quote (kept temporarily — see Data Retention)
• AI-generated analysis output (negotiation insights, risk flags, benchmarks, email drafts)
• Deal metadata (title, vendor name, deal type, etc.), the negotiation context you enter (objective, budget, competing quotes, seats, deadlines), each round you add and the outcome you record
• If you use the negotiation service: what you tell us about the deal, the supplier contact details you choose to give us (name, email, phone) and, if you attach a quote or contract, the document itself for the duration of the case (see Data Retention)

Payment and invoicing:

• We do not collect card details inside the product today
• If you use the negotiation service we keep what an invoice needs: company name, address and VAT number

Automatically Collected:

• IP address, browser type, and device information
• Usage patterns and feature interaction via PostHog analytics, only if you accept analytics cookies

3. How We Use Your Data

• Provide the AI-powered deal analysis service
• Manage your account and apply the free-analysis limit
• Invoice the negotiation service where you have asked for it
• Send service updates and important notifications (not marketing unless you opt in)
• Improve the service based on aggregated usage patterns tied to your account id, never to your documents
• Prevent fraud, abuse, and unauthorized access
• Run the negotiation on your behalf where you have asked for it. That means sharing the relevant deal details with the vendor, and only what that negotiation needs
• Build de-identified pricing benchmarks from the outcomes of closed negotiations: vendor, product, price, term and the month of close. A benchmark row carries no name, email, account, deal or document reference. It is pseudonymised rather than anonymous, it is reviewed by a person before it is added, and it remains after the deal or account it came from is deleted

4. Who We Share Data With

We only share data with the service providers necessary to run TermLift. We do not sell, rent, or share your data with advertisers, data brokers, or social media platforms.

5. Data Retention

• Quote files: Read in memory and never stored. A final document you upload when closing a deal is read the same way; we keep only its SHA-256 fingerprint, file type and the figures we read from it
• Extracted quote text: Kept on the deal while the Negotiation Playbook may still need it, then removed: when the Playbook is built, when the deal closes, or 90 days after upload, whichever comes first
• Saved deals: Analysis results, structured deal facts (vendor, product, totals, term) and outcomes are kept until you delete the deal or your account
• Negotiation documents: Removed 30 days after the negotiation closes, and never later than 12 months after upload
• Account data: Kept until you delete your account
• Usage and AI telemetry: IP addresses and error details are removed after 90 days; token and cost counts are kept without them
• Benchmark rows: De-identified outcome rows (section 3) are kept after the deal they came from is deleted

We do not sell or share your data with advertisers. When you delete a deal or your account, its rows and documents are removed from our database and storage at once; our providers' own operational logs age out on their schedules, and de-identified benchmark rows remain.

6. Cookies

We use minimal cookies, strictly for functionality and analytics. We do not use advertising or tracking cookies.

Session Authentication:

• Supabase auth cookies to keep you logged in securely
• These are essential for the service to function

Analytics:

• PostHog cookies for product analytics tied to your account id, set only if you accept analytics cookies
• Used to understand usage patterns and improve the service

What we don't use:

• No advertising cookies
• No third-party tracking cookies
• No social media cookies

7. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR) and similar data protection laws, you have the following rights:

• Access: Request a copy of all personal data we hold about you
• Delete: Request deletion of your account and all associated data at any time — this is also available directly in your profile settings
• Correct: Update or correct any inaccurate personal information
• Export: Receive your data in a portable, machine-readable format
• Object: Object to certain types of data processing

To exercise any of these rights, contact us at hello@termlift.com. We will respond to your request within 30 days.

8. International Transfers

Our database and file storage are hosted in the EU (Supabase, eu-west-1). Your data may also be processed in the United States and other countries where our service providers (Anthropic, Vercel) operate. For transfers of personal data outside the European Economic Area and the United Kingdom we rely on Standard Contractual Clauses approved by the European Commission.

9. Children

TermLift is not intended for users under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

10. Changes to This Policy

We may update this privacy policy from time to time. If we make material changes, we will notify you via email at least 14 days before the changes take effect. Continued use of TermLift after changes take effect constitutes acceptance of the updated policy.

11. Contact

• Privacy questions: hello@termlift.com
• Data requests: hello@termlift.com
• General support: hello@termlift.com