Privacy Policy

Effective Date: September 23, 2026.

Last Updated: October 15, 2026.

This Privacy Policy explains how José Córdova, an individual with Ecuadorian Taxpayer Identification Number (RUC) 1707017693001, operating commercially under the RobyContracts brand, hereinafter “RobyContracts,” “we,” “us,” or “our,” collects, uses, stores, shares, protects, and deletes Personal Data related to RobyContracts and the services available through www.robycontracts.askroby.io, hereinafter the “Services.”

This Policy applies in accordance with the data protection laws applicable to the relevant processing, including the Organic Law on Personal Data Protection of Ecuador and its implementing regulations, and, where applicable due to the nature of the processing or the individuals affected, other laws such as the European Union GDPR or UK GDPR.

RobyContracts may be used by individuals, professionals, companies, and other organizations.

1. Who Is Responsible for Your Personal Data

RobyContracts may perform different roles depending on the processing activity involved.

With respect to information such as your Account data, billing, communications with RobyContracts, security, analytics, preferences, consents, contractual evidence, and administration of our own commercial relationship with you, RobyContracts generally acts as the Controller.

When a Customer uses RobyContracts to store, generate, complete, or manage contracts containing Personal Data of third parties and determines the purposes and essential elements of that processing, the Customer acts as Controller and RobyContracts acts as Processor with respect to such data.

In those cases, the RobyContracts Data Processing Agreement, hereinafter the “DPA,” also applies.

An individual who uses RobyContracts solely with respect to their own Personal Data does not automatically become a Controller of third-party Personal Data merely for that reason.

2. Personal Data We Collect

The Personal Data we process depends on how you use RobyContracts.

2.1. Account Data

We may process information such as:

• Email address.

• Name, when provided.

• Organization name, where applicable.

• Account type and status.

• Internal Account identifiers.

• Invitations and Organization membership.

• Roles and permissions within an Organization.

• Security configuration information.

• Multi-factor authentication status.

• Other information necessary to administer the Account.

Authentication credentials are managed by our authentication provider using appropriate hashing and security mechanisms.

RobyContracts does not store user passwords in plain text.

3. Billing Data, Subscriptions, and Individual Purchases

When you purchase a Subscription, an Individual Contract Use, or another paid Service, the transaction is managed through Polar Software, Inc., which acts as Merchant of Record for the relevant transactions.

RobyContracts may receive and retain limited information related to the transaction, for example:

• Selected Plan.

• Number of Contract Uses associated with the payment.

• Amount.

• Currency.

• Payment date.

• Expected renewal date.

• Effective activation date.

• Subscription status.

• Payment-recovery status.

• Order or transaction identifiers.

• Subscription identifiers.

• Country.

• Certain tax information, where applicable.

• Refund status.

• Amount or proportion refunded.

• Dispute or chargeback status.

• Status of scheduled Plan changes.

• Other information necessary to administer the purchased Service.

RobyContracts does not need to store your full payment-card number.

Polar and the payment providers it uses process the information necessary to complete the transaction in accordance with their own legal and privacy obligations.

4. Contract Uses and Entitlement Records

RobyContracts maintains records intended to determine which paid features are available to each Account or Organization.

These records may include:

• Source of the Contract Use.

• Purchase or renewal that generated it.

• Issuance date.

• Purchase date.

• Number of uses issued.

• Number of uses consumed.

• Number of uses remaining.

• Expiration date, where applicable.

• Polar order identifier.

• Subscription identifier.

• Refund status.

• Dispute status.

• Reversal of uses.

• Other information necessary to correctly administer purchased functionality.

These records are separate from the content of the Customer’s contracts.

5. Content You Provide to RobyContracts

Depending on how you use the Service, we may process:

• Contracts.

• Contract templates.

• DOCX files.

• PDFs.

• Word documents.

• Images.

• Photographs.

• Scanned files.

• Text.

• Annexes.

• Signed documents.

• Attachments.

• Information provided through forms.

• Information provided through private links.

• Landlord information.

• Tenant information.

• Guarantor information.

• Representative information.

• Property information.

• Financial or contractual information.

• Signatures contained in documents.

• Instructions provided to RobyContracts.

• Other files or content that you choose to provide.

The content of these documents may include your Personal Data or Personal Data of third parties.

RobyContracts does not determine what information you choose to include in your contracts or documents.

When you provide Personal Data of third parties, you are responsible for having the rights, authorizations, and legal bases necessary for that processing.

6. Information Generated from Content

To provide RobyContracts features, we may generate and store information derived from Content, including:

• Extracted text.

• Information obtained through automated processing.

• Metadata.

• Extracted structured data.

• Names of parties.

• Dates.

• Contract values.

• Rent amounts.

• Deposits.

• Guarantees.

• Identifiers.

• Property-related information.

• Information necessary to complete contracts.

• Results of calculations used by certain features.

• Processing results.

• Drafts.

• Generated contracts.

• Generated DOCX documents.

• Generated PDF documents.

• Document history.

• History of certain actions performed on the contract.

• Content generated with the assistance of artificial intelligence.

These representations and results are used to provide RobyContracts’ contract preparation, renewal, generation, administration, and storage features.

7. Information Provided Through Private Links

Certain features may allow the Customer to generate a private link so another person can provide information necessary to complete a contract.

Depending on the configuration and the information requested by the Customer, RobyContracts may process:

• Name.

• Email address.

• Identification number.

• Contact information.

• Contractual information.

• Property-related information.

• Landlord information.

• Tenant information.

• Guarantor information.

• Representative information.

• Responses provided through the form.

• Other information lawfully requested by the Customer through that feature.

The person who receives the private link does not become a RobyContracts Customer merely by receiving or using that link.

When we process this information on behalf of a Customer organization, that organization determines the purposes of the processing and RobyContracts acts as Processor under the applicable DPA: it Processes that information only on the organization’s instructions and for the purposes stated in the DPA, and does not disclose, assign, or transfer it to other persons, not even for retention, except to authorized Subprocessors to the extent necessary to provide the Service, on the organization’s instruction, or where a competent authority requires it.

8. Signed Contracts

RobyContracts may allow the Customer to upload a final or signed copy of a contract back to the Service.

That file may contain:

• Names.

• Identification numbers.

• Contractual information.

• Signatures.

• Certificates or visible representations embedded in the document.

• Dates.

• Information about the parties.

• Other information contained in the file.

RobyContracts stores the file provided by the Customer according to the applicable retention lifecycle.

When the document has been signed using an external tool, RobyContracts does not, merely because the file was uploaded, claim to have performed or cryptographically validated the signature.

9. Technical, Activity, and Security Data

We may collect technical data reasonably necessary to operate, protect, maintain, and diagnose the Services, including, where applicable:

• IP address.

• Browser and user agent.

• Device.

• Language.

• Date and time.

• Authentication events.

• Relevant Account activity.

• MFA-related events.

• Permission changes.

• Errors.

• Processing times.

• Results of automated processes.

• Security events.

• Information about scheduled-task execution.

• Events related to deletion and restoration.

• Events related to Archive or Trash.

• Other technical logs related to Service operation.

Not all of this data is retained for the same period.

Retention periods are described later in this Policy.

10. Analytics

RobyContracts may use analytics tools to understand in aggregate how the Services are used, identify problems, and improve the product.

These tools currently may include Vercel Analytics and Google Analytics.

In addition, RobyContracts itself counts the public pages that are opened, without cookies or lasting identifiers. It stores the page, the language, the site the visitor came from, and a random marker that lives in the browser tab and disappears when the tab is closed. It stores no IP addresses or Account data, is not used inside the Account, and does not require consent.

Optional analytics are enabled only after the applicable choice is made through RobyContracts’ consent mechanism when such consent is required.

Depending on the tool and configuration, analytics information may include:

• Pages visited.

• Navigation events.

• Device.

• Browser.

• Technical data.

• Approximate region.

• Dates and times.

• Technical or pseudonymous identifiers used by the tool.

We do not need to analyze the content of your contracts to perform general website-navigation analytics.

11. Communications, Support, and Feedback

When you communicate with RobyContracts, we may process:

• Your email address.

• Name.

• Content of your messages.

• Support requests.

• Comments.

• Feedback.

• Information voluntarily provided about cancellations.

• Information voluntarily provided about refunds.

• Information related to payment disputes.

• Information necessary to investigate a specific issue.

When we optionally request information such as the reason for a cancellation or refund, providing that information is voluntary.

Help assistant. If you use the assistant on the site or in the app, we keep the text of your question, the topic, the page and the language, to improve the assistant and the experience. We don't keep your name, your account or your IP address with the question. We delete these questions after 180 days. Don't write personal data or details of your contracts in the assistant.

12. Contractual Evidence and Consents

RobyContracts maintains records intended to demonstrate the formation, administration, and performance of the contractual relationship.

These records may include:

• Account identification.

• Email address used.

• Name.

• Organization.

• Legal document accepted.

• Version of the document.

• Language.

• Date and time of acceptance.

• Archived copy of or reference to the accepted text.

• Cryptographic hash of the document.

• DPA acceptance, where applicable.

• Statement of authority to act on behalf of an Organization.

• Acceptance or withdrawal of certain consents.

• Cancellation instruction.

• Account or Organization closure instruction.

• Deletion instructions.

• Relevant refund events.

• Relevant dispute-related events.

• Evidence of certain legal or contractual actions.

• Other information reasonably necessary to evidence the legal relationship.

These records are separate from Customer Content.

Closing an Account or deleting contracts does not necessarily mean that this contractual evidence is immediately deleted.

13. How We Use Personal Data

We use Personal Data only for legitimate purposes related to RobyContracts.

The specific legal basis may vary depending on the jurisdiction and circumstances of the processing.

14. Marketing

Setup guidance and usage tips about RobyContracts that we send after you create an account are not marketing. They explain how to use the service you just opened, they carry an unsubscribe link that stops them with one click, and unsubscribing from them does not stop security, account, billing or renewal messages.

RobyContracts may send newsletters, information about new features, offers, promotions, or other commercial communications where you have provided the applicable consent.

You may withdraw that consent at any time through the unsubscribe mechanism included in the communications, where available, or by writing to:

support@askroby.io

Withdrawing marketing consent does not prevent RobyContracts from sending communications necessary for:

• Security.

• Account matters.

• Billing.

• Renewal.

• Payment recovery.

• Cancellation.

• Archive.

• Trash.

• Deletion.

• Support.

• Contractual or legal compliance.

15. Artificial Intelligence

RobyContracts uses external artificial intelligence providers for certain functions, which may include:

• Document reading.

• Information extraction.

• Classification.

• Field structuring.

• Contract understanding.

• Contract preparation or renewal.

• Content generation.

• Instruction processing.

• Other automated functions related to the Services.

Depending on the operation, the relevant provider may receive:

• Documents or portions of documents.

• Images.

• Text.

• Contract excerpts.

• Structured fields.

• User instructions.

• Data necessary to complete a contract.

• Other information strictly necessary to complete the request.

RobyContracts does not use Customer contracts or documents to train or fine-tune its own models.

In addition, what we send to artificial intelligence providers is not used to train their models: to read contracts we only use providers that do not collect what is sent.

Artificial intelligence requests containing Customer Content are configured to require collection and retention restrictions compatible with RobyContracts’ privacy architecture, including no-data-collection and zero-retention requirements where the feature and provider support them.

RobyContracts uses an architecture intended to prevent requests containing Customer Content from being sent through routes incompatible with those restrictions.

16. Current Artificial Intelligence Providers

Providers currently used may include:

OpenRouter.

Acts as an artificial intelligence gateway and request-routing system.

Google.

Certain Google models may be used for document reading, extraction, and processing functions.

17. Automated Processing and Automated Decision-Making

RobyContracts uses automated processing and artificial intelligence for functions such as:

• Information extraction.

• Classification.

• Structuring.

• Identification of parties.

• Identification of dates.

• Identification of contract values.

• Contract preparation.

• Document generation.

• Calculations related to certain contractual functions.

• Document organization.

This type of automation does not mean that RobyContracts is itself making a legal decision about an individual.

RobyContracts does not use its artificial intelligence features to make decisions, based solely on automated processing, that independently produce legal effects or similarly significant effects on users.

RobyContracts also does not perform profiling for that purpose.

18. Information from Official Sources

Certain features may use public or official information to perform calculations or complete functionality, for example data or indices published by official bodies.

Public or official information used to perform a function does not necessarily constitute Personal Data.

When such information is combined with identifiable contractual information, the result may form part of Customer Content and become subject to this Policy.

19. Special or Sensitive Categories of Personal Data

RobyContracts does not require you to provide special or sensitive categories of Personal Data in order to use the general features of the Service.

However, the Customer may choose to provide contracts or documents containing sensitive information.

Depending on the document, this may include, for example:

• Financial information.

• Visible biometric information embedded in documents.

• Information relating to minors.

• Health information.

• Disability information.

• Beliefs.

• Affiliations.

• Other categories protected by applicable law.

When the Customer provides information of this nature, the Customer is responsible for determining that it has a valid legal basis and that processing through RobyContracts is appropriate and lawful.

RobyContracts processes such data only to the extent necessary to provide the Services and in accordance with applicable instructions.

20. Minors

You must be at least 18 years old to purchase RobyContracts on your own behalf.

A person under 18 may use RobyContracts when their parent or legal guardian has created the Account or expressly authorized its use in accordance with the available mechanisms.

RobyContracts does not systematically verify identity or age.

Accordingly, we cannot guarantee that a minor will never provide false information about their age or use an Account without the required authorization.

If you are a parent or legal guardian and believe that a minor is using RobyContracts without the required authorization, you may write to:

support@askroby.io

RobyContracts may investigate the situation and take appropriate measures, including restriction or closure of the Account where appropriate.

21. Personal Data Providers and Recipients

RobyContracts uses technology providers to provide the Services.

Current principal providers include:

See the functions and locations of current subprocessors.

The legal role of each provider may vary.

Not all recipients necessarily act as subprocessors of Customer Content.

In particular, Polar acts as Merchant of Record with respect to the relevant transactions.

22. Emails and Document Titles

Certain transactional communications may require our email provider to process information associated with an Account.

This may include:

• Email address.

• Name.

• Type of notification.

• Identifiers.

• Necessary billing information.

• Renewal or deletion dates.

• Number of Contract Uses remaining.

• Where required by the purpose of the message, certain contract or document names or titles displayed in the notification.

We limit the content transmitted to what is necessary for the relevant communication.

23. Operational and Administrative Alerts

RobyContracts may use technical messaging mechanisms to send internal alerts related to operational events.

When such alerts relate to an Account, we seek to minimize the Personal Data transmitted.

For example, a refund event may be represented using a specific event identifier together with limited information such as the amount, type, and status of the operation.

Where not necessary, these internal alerts should not include:

• Customer name.

• Email address.

• Contract titles.

• Contract content.

• Information extracted from documents.

Additional details may be consulted, when necessary, within authenticated RobyContracts administrative systems.

24. Legal Communications and Requests from Authorities

RobyContracts may disclose Personal Data where necessary to:

• Comply with a valid legal obligation.

• Respond to an order from a competent authority.

• Investigate fraud or unlawful activity.

• Protect the security of the Services.

• Protect the rights of RobyContracts, the Customer, or third parties.

• Establish, exercise, or defend claims.

We will evaluate requests received and limit the information provided to what is reasonably necessary where permitted by law.

25. Business Transfer or Succession

If RobyContracts reorganizes, is incorporated into a future company, sells a substantial portion of the business, merges, or transfers the Services to a legitimate successor, certain Personal Data may form part of the transaction.

Where applicable, such information will be transferred subject to confidentiality and protection obligations consistent with this Policy and applicable law.

26. We Do Not Sell Your Personal Data

RobyContracts does not sell users’ Personal Data.

The use of technology providers to deliver the Services does not constitute a sale of Personal Data by RobyContracts.

27. International Processing

RobyContracts uses infrastructure and providers that may process information in the United States and other jurisdictions.

We do not identify a specific technical region in this Policy because provider architectures may evolve.

Where an operation is subject to specific international-processing or international-transfer requirements, RobyContracts will apply the mechanisms required by the applicable law.

Where GDPR or UK GDPR applies and it is legally necessary, these mechanisms may include adequacy decisions, standard contractual clauses, addenda, or other valid mechanisms.

For transfers to the United States, RobyContracts relies on the data processing agreements of Supabase, OpenRouter, and Resend, which form part of their terms of service and incorporate the European Commission’s standard contractual clauses. For other providers, their own terms and privacy policies apply.

The use of a provider located outside Ecuador does not by itself mean that every operation must receive the same legal classification.

Each relationship is structured according to applicable law and the role performed by the provider.

28. Security

RobyContracts applies technical and organizational measures designed to protect Personal Data according to the risks of the processing.

These measures include:

• Encryption of data in transit through HTTPS/TLS.

• Encryption at rest provided by our infrastructure providers.

• Secure credential storage through hashing mechanisms managed by the authentication provider.

• Authentication.

• Authorization.

• Database-level access policies.

• Logical separation between Accounts and Organizations.

• Multi-factor authentication.

• Restrictions on privileged access.

• Operational and error logs.

• Automated checks of Account isolation.

• Operational checks of Service availability.

No Internet-connected system can guarantee absolute security.

29. Multi-Factor Authentication

RobyContracts requires multi-factor authentication to access protected information.

Users are given an initial period of approximately four days to configure the required second factor.

After that period ends, access to protected content may be restricted until configuration is completed.

30. Human Access to Content

RobyContracts’ automated systems necessarily process contracts and documents in order to provide the Service.

RobyContracts does not routinely read Customer contracts or documents as part of ordinary human operations.

Ordinary administration and support interfaces are not designed to allow routine reading of contractual content.

However, persons with privileged access to certain infrastructure may technically access information where necessary to:

• Respond to an authorized support request.

• Investigate a technical issue.

• Respond to a security incident.

• Maintain or recover infrastructure.

• Comply with a valid legal obligation.

• Perform an intervention expressly authorized by the Customer.

Where a separate agreement with a Customer expressly authorizes human access for testing, implementation, diagnosis, or support, such access may take place in accordance with that agreement.

Exceptionally, when a failure reported by a Customer cannot be diagnosed without the affected document, the person responsible for RobyContracts may enter the minimum necessary fragment into Claude Code, the programming assistance tool from Anthropic with which the platform is developed. For this purpose an account with training disabled is used; Anthropic retains that content for up to thirty (30) days, the local record is deleted within the same period, and the use is not routine. This tool is listed in the subprocessor directory.

31. Security Incidents

RobyContracts maintains mechanisms designed to identify, investigate, and respond to incidents that may affect Personal Data.

When a Personal Data breach occurs and applicable law requires notification, RobyContracts will make the relevant communications to affected individuals, Customers, or competent authorities within the legally applicable requirements.

32. Retention of Active Content

While a contract, template, file, or document remains active and there is a valid storage entitlement under the Service, RobyContracts retains the content reasonably necessary to provide the applicable features.

RobyContracts may retain the original files provided by the Customer while the content remains within its applicable lifecycle.

This may include:

• Original contracts.

• DOCX templates.

• PDFs.

• Attachments.

• Generated documents.

• Generated DOCX files.

• Generated PDFs.

• Final signed documents uploaded by the Customer.

• Extracted information.

• Structured data.

• Information provided through private links.

• Metadata.

• Document history.

The Customer must retain outside RobyContracts any copies it needs to keep permanently for commercial, legal, regulatory, accounting, or archival reasons.

RobyContracts should not be considered the sole permanent archive for the Customer’s contracts.

33. Post-Subscription Period

Canceling a Subscription does not immediately delete Customer Content.

When the Customer voluntarily cancels a Subscription, the Customer retains the already-paid period until its end date.

When that paid period ends, a six-calendar-month Post-Subscription Period begins.

During that period, the Customer may continue accessing its Active Contracts and other Content subject to that period.

Previously accumulated and still-valid Contract Uses may continue to be used during the Post-Subscription Period.

If the Customer has valid Contract Uses, the Customer may continue processing contracts using the available features.

There is no additional retention period after the Hard Deletion Deadline merely because a contract or process was started shortly before the deadline.

When the applicable exact date and time are reached:

• Contract Uses subject to that period expire.

• Content subject to that deadline becomes unavailable.

• The applicable permanent deletion process begins.

34. Failed Renewals and Payment Recovery

When a renewal charge fails:

• New Contract Uses associated with that renewal are not granted while payment remains incomplete.

• During the first seven days, the Customer maintains normal access in accordance with Service rules.

• Polar may continue its payment-recovery process.

If payment remains outstanding at the end of those seven days, RobyContracts begins the six-month Post-Subscription Period.

During that period, the Customer maintains access to Customer Content subject to the period and may use previously accumulated and still-valid Contract Uses.

Polar may continue attempting to collect the renewal in accordance with its payment-recovery process unless the payment succeeds, the Customer cancels, or that process ends.

If a later recovery succeeds, the Subscription may return to active status, the Contract Uses associated with that renewal may be issued, and the retention lifecycle of active content will be adjusted according to the applicable rules.

35. USD 3 Individual Purchases and Retention

A valid individual purchase of a Contract Use generates one Contract Use subject to the applicable commercial rules.

An unused individual use may expire six calendar months after purchase.

An individual purchase may also establish or extend the retention of Active, non-archived Content until at least six calendar months after the purchase.

A new purchase never shortens a later retention date that already applies.

The purchase does not automatically extend the retention period of contracts that are already archived.

36. Archive

RobyContracts allows contracts to be placed in an Archive area.

When a contract is archived:

• A maximum retention period of six calendar months begins.

• The contract may remain visible.

• The contract may remain downloadable.

• An applicable deletion date is displayed or calculated.

The Customer may restore a contract before deletion.

Upon restoration:

• The Archive-specific deletion date no longer applies.

• The contract returns to the Active Content retention lifecycle.

Restoration does not automatically grant a new six-month period merely because the contract was restored.

An earlier deletion deadline applicable under the Post-Subscription Period, Account closure, or another deletion rule takes precedence over a later Archive date.

37. Trash

When the Customer deletes a contract, template, or other content eligible for recovery, that content may enter Trash for a maximum period of 30 days.

While there, RobyContracts may offer:

• Restore.

• Delete permanently now.

Content in Trash does not form part of the normal active workflow.

When restored:

• If the content was Active before deletion, it returns to Active status.

• If it was archived, it returns to Archive and remains subject to the lifecycle that previously applied.

Trash does not pause or extend an earlier deletion deadline.

The earliest valid date controls.

38. Permanent Deletion of Individual Content

When you select a function equivalent to Delete permanently now, the relevant content is no longer subject to the ordinary Trash recovery period and enters the permanent deletion process.

Once final deletion has been completed:

• The content is no longer available.

• It cannot be restored through normal RobyContracts features.

• RobyContracts does not provide an individual recovery service using internal or infrastructure copies.

RobyContracts does not create or maintain separate backups of Customer documents. It cannot restore permanently deleted content from a RobyContracts backup.

Certain providers may retain residual technical copies for periods controlled by their own architectures, obligations, or recovery mechanisms.

39. Closing an Account or Organization

Closing an Account or Organization is different from canceling a Subscription.

When a duly authorized person confirms closure:

• RobyContracts cancels any active billable Subscription where applicable.

• All unused Contract Uses associated with the Account or Organization are forfeited.

• Access ends.

• Contracts and other Customer Content become unavailable from the Customer’s perspective.

• Archive and Trash cease to operate as recovery periods.

• The Post-Subscription Period ceases to protect the content.

• Deletion of the relevant Content begins.

• Closure is irreversible from the perspective of normal RobyContracts use.

Invited users lose access to the content of the closed Organization.

An independent personal Account belonging to an invited user may continue to exist if it is not part of the closure.

Before closure, the Customer must independently retain any information it wishes to keep.

RobyContracts does not guarantee that every technical copy held by every provider will disappear at the exact moment closure is confirmed.

Technical deletion processes may continue after the Account has ceased to be available.

40. Refunds

RobyContracts may process information necessary to administer refund requests, including:

• Relevant payment.

• Purchase date.

• Number of uses purchased.

• Uses consumed.

• Uses remaining.

• Potentially refundable proportion.

• Amount.

• Refund status.

• Polar identifiers.

• Reason for the refund when voluntarily provided by the Customer.

RobyContracts does not provide a separate satisfaction guarantee for the first Subscription payment, without prejudice to mandatory rights established by law or actions by Polar as Merchant of Record under its own policies.

Certain individual purchases may be subject to a First Contract Guarantee under the Terms of Service.

RobyContracts may also administer partial refunds of unused Contract Uses in accordance with the applicable rules.

Polar remains the principal source of information regarding the financial amount actually refunded and any corresponding tax adjustments.

41. Disputes and Chargebacks

When Polar or another provider reports a payment-related dispute, RobyContracts may process:

• Payment identifier.

• Order.

• Amount.

• Dispute status.

• Date.

• Account information.

• Related Contract Uses.

• Subscription status.

• Evidence reasonably necessary to administer or respond to the dispute.

An open dispute does not, by itself, result in immediate Account closure.

While the dispute remains pending, RobyContracts may mark the payment as DISPUTE_PENDING or use an equivalent status.

If the dispute is resolved in favor of the Customer and the payment is ultimately reversed, RobyContracts may remove entitlements or unused Contract Uses attributable to that payment and modify the Subscription status where appropriate.

If the dispute is resolved in favor of Polar or RobyContracts, the corresponding entitlement may continue or be restored.

Confirmed fraud, abuse, repeated abusive chargebacks, or other material violations may result in additional measures under the Terms of Service.

42. Information We May Retain After Closure or Deletion

Closing an Account or deleting Customer Content does not mean that RobyContracts must immediately delete all evidence that a contractual relationship existed.

We may retain only the minimum information necessary to:

• Demonstrate which person or Account accepted particular legal documents.

• Demonstrate which version was accepted.

• Demonstrate the date and time of acceptance.

• Evidence an instruction to close or delete.

• Demonstrate performance of certain operations.

• Maintain evidence of payments and refunds.

• Manage disputes.

• Comply with tax or accounting obligations.

• Manage fraud or security.

• Comply with regulatory obligations.

• Establish, exercise, or defend rights or claims.

This retention does not mean that RobyContracts retains contracts, templates, signed documents, extracted data, or other Customer Content in order to continue providing the Service after the applicable deletion.

43. Retention Periods

RobyContracts uses different retention periods depending on the purpose of the information.

43.1. Contractual and Legal Evidence

Minimum records necessary to demonstrate:

• Acceptance of Terms.

• Privacy Policy.

• DPA.

• Authority to represent an Organization.

• Relevant consents.

• Withdrawals.

• Account closure.

• Deletion instructions.

• Refunds.

• Disputes.

• Other relevant contractual events.

May be retained for up to ten years from the event or from the end of the relevant relationship, where such retention is reasonably necessary to establish, exercise, or defend rights or claims.

44. Tax and Accounting Information

Records that must be retained for tax, accounting, or documentary purposes may be retained for up to seven years, or for a different period required by applicable law.

45. Security and Relevant Activity Logs

Identifiable records related to:

• Security.

• Access.

• Authentication.

• MFA.

• Significant Account events.

• Organization events.

• Relevant administrative activity.

Are generally retained for up to twelve months.

46. Technical and Diagnostic Logs

Detailed technical logs primarily intended for diagnosis, such as:

• Processing attempts.

• Processing times.

• Automated calls.

• Ordinary errors.

• Technical events.

Are generally retained for up to ninety days.

47. Automated Processes and Cron Jobs

Summary results of scheduled tasks and operational checks may be retained for up to twelve months.

Detailed technical logs relating to those executions are generally retained for up to ninety days.

48. Analytics

Analytics data that remains identifiable or pseudonymized is generally retained for up to fourteen months.

Records of RobyContracts’ own count of public pages described in Section 10 are deleted after fourteen months.

Information that has been genuinely aggregated or anonymized so that it no longer reasonably identifies an individual may be retained for longer periods.

49. Support and Communications

Support communications, comments, and other correspondence are retained for as long as necessary to address the request and perform reasonable follow-up.

Where a communication becomes relevant evidence of a dispute, fraud matter, incident, or contractual relationship, it may be retained for the period applicable to that purpose.

Questions asked to the help assistant are deleted automatically after 180 days.

50. Exceptions to Ordinary Retention Periods

The periods described above may be extended for specific information where necessary to:

• Comply with a legal obligation.

• Respond to a request from an authority.

• Investigate a security incident.

• Investigate or prevent fraud.

• Address a dispute.

• Establish, exercise, or defend a claim.

• Maintain evidence subject to a specific legal hold.

When the reason justifying additional retention no longer exists, the information will be deleted, blocked, or anonymized as appropriate.

51. No Separate Document Backup

RobyContracts does not create or maintain separate backups of Customer documents. If a document is lost from primary storage, RobyContracts cannot restore it from its own backup. Archive and Trash are features within primary storage, not independent backups.

Infrastructure providers may retain technical copies under their own processes. RobyContracts does not offer those copies as a Customer recovery service.

When you delete a contract, a file or your Account, RobyContracts removes it immediately from its database and its file storage. What each provider publicly says about the copies it keeps (checked on September 27, 2026):

• Supabase (database and files): files are not part of the database backups, and its documentation offers no backups to projects on the plan RobyContracts uses.

• Vercel (application hosting): keeps request logs for 1 hour on the plan RobyContracts uses. It does not store your contracts.

• Resend (email): keeps sent emails and their logs for 30 days, and its backups for 7 days.

• OpenRouter (artificial intelligence): does not store the content of requests unless logging is turned on, which RobyContracts does not do; it keeps usage data such as amount of text, model and cost. RobyContracts only accepts model providers that do not keep what is sent.

• Polar (payments): keeps purchase data for as long as the law requires, for example for tax reasons. It publishes no fixed period.

Each provider sets and publishes these periods; they may change, and RobyContracts cannot verify or shorten them.

The Customer is responsible for retaining its own copies of any document or information it needs to keep.

52. Cookies and Similar Technologies

RobyContracts uses technologies necessary to:

• Maintain sessions.

• Authenticate users.

• Protect the Service.

• Remember certain essential preferences.

• Enable necessary application functionality.

These strictly necessary technologies may be used without consent where applicable law permits.

RobyContracts’ own count of public pages described in Section 10 does not use cookies or other lasting identifiers.

RobyContracts also uses or may use optional analytics technologies.

These currently may include:

• Vercel Analytics.

• Google Analytics.

Where consent is required, these optional tools remain disabled until the user makes the applicable choice.

You may accept, reject, or modify the available options using RobyContracts’ consent mechanism.

53. Your Rights

Depending on applicable law and the specific circumstances, you may have the right to request:

• Information about processing.

• Access to your Personal Data.

• Rectification or updating.

• Deletion.

• Objection to processing.

• Restriction or suspension.

• Portability.

• Withdrawal of previously given consent.

• Other rights recognized by applicable law.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Certain actions may be performed directly through features available in the Account.

For other requests, you may write to:

support@askroby.io

54. Requests Relating to Data Controlled by Another Customer

When RobyContracts processes Personal Data on behalf of a company, professional, or other Customer acting as Controller, certain requests relating to that data must be resolved by that Customer.

If we receive a request directly concerning information that we process solely on behalf of another Controller, we may:

• Direct the individual to the relevant Controller.

• Forward the request to the Customer.

• Assist the Customer where appropriate.

55. Identity Verification for Rights Requests

RobyContracts does not systematically verify the identity or age of all users.

However, when someone requests access, modification, deletion, or another action concerning Personal Data, we may request information reasonably necessary to confirm that the person is entitled to make the request.

This verification is limited to what is reasonably necessary according to the risk associated with the request.

56. Complaints to Authorities

If you believe that the processing of your Personal Data violates applicable law, you may file a complaint with the competent authority.

In Ecuador, the Personal Data protection authority is the Superintendencia de Protección de Datos Personales.

Where another law applies, you may also have the right to contact the appropriate authority in your jurisdiction.

57. Changes to This Policy

RobyContracts may update this Policy as the following evolve:

• The Services.

• Technology.

• Providers.

• Processing practices.

• Features.

• Retention lifecycles.

• Legal obligations.

When we make non-material changes, we may update the Policy and its “Last Updated” date and provide reasonable notice where appropriate.

When a change is material, we will seek to communicate it clearly.

If applicable law requires new consent or renewed express acceptance, RobyContracts will request that action before carrying out the processing that requires it.

RobyContracts may retain prior versions of this Policy and evidence of versions accepted or communicated.

58. Data Protection Officer

RobyContracts has not currently appointed a Data Protection Officer or DPO.

Questions relating to privacy or Personal Data protection may be directed to:

support@askroby.io

The need to appoint a Data Protection Officer will be reassessed if the legal structure, activities, scale, or nature of the processing performed by RobyContracts changes.

59. Contact

Controller: José Córdova.

RUC: 1707017693001.

Operating commercially under the brand: RobyContracts.

Privacy, support, security, and legal email: support@askroby.io.

Address: Quito, Pichincha, Ecuador.

Telephone: +593 99 061 2230.