Last Updated: 30 July 2026
These Terms of Service ("Terms") form a legally binding agreement between ClauseCast Ltd and the Customer. Please read them carefully before accessing or using the Service.
1. Parties, eligibility and acceptance
1.1 Provider: ClauseCast Ltd is registered in England and Wales under company number 17289539, with registered office at 124 City Road, London, United Kingdom, EC1V 2NX ("ClauseCast", "we", "us", "our").
1.2 Customer: These Terms apply to the business, firm or professional person obtaining access to the Service ("Customer", "you", "your").
1.3 Business users aged 18 or over: The Service is provided only for professional or business use by persons aged at least 18. You confirm that you are not using the Service as a consumer and have authority to bind the Customer.
1.4 Acceptance: You accept these Terms by creating an account, ticking the acceptance box, executing an Order Form or using the Service. If you do not agree, you must not use the Service.
1.5 Contract documents: An agreed order form, proposal or checkout description ("Order Form") may specify the plan, fees, term and usage limits. If there is a conflict, the Order Form takes priority for those commercial details, followed by these Terms.
2. The Service and AI processing
2.1 Service: ClauseCast provides a technology platform that uses natural-language processing, statistical methods and machine-learning models to analyse information about English contract disputes and produce a probabilistic output ("Output").
2.2 Google Gemini: The Service uses the paid Gemini Developer API to process submitted narratives, extracted document text, evidence notes and related context. Google is an authorised subprocessor for this purpose. The current integration uses the Generate Content API and does not request Google Search grounding, Google Maps grounding, the Gemini File API or explicit context caching.
2.3 Gemini logging: ClauseCast’s Gemini project logging is enabled with a seven-day retention setting. The project may therefore store prompts, responses and related metadata for that period. Google may separately retain limited information for abuse monitoring and required legal or regulatory disclosures. ClauseCast has not obtained approval for Gemini zero data retention.
2.4 Changes: ClauseCast may update the Service and its dependencies. ClauseCast will not materially reduce paid core functionality during an agreed fixed term without reasonable notice, except where necessary for security, law, provider changes or urgent risk management.
3. Plans, credits and fees
3.1 Commercial terms: Any fees, included credits, service period, renewal and cancellation terms are those stated in the applicable Order Form or other written agreement. ClauseCast does not currently provide self-service online checkout or use a payment provider.
3.2 Credits: Unless the Order Form says otherwise, one credit is consumed when a unique evaluation completes and produces an Output. A clarification question does not consume a credit.
3.3 Expiry: Credits are usage entitlements, have no cash value and do not roll over or remain available beyond the period stated in the Order Form.
3.4 Payment: Fees are payable as stated in the Order Form. ClauseCast may suspend access for overdue amounts after giving any notice required by the contract or law.
3.5 Taxes: ClauseCast Ltd is not currently VAT-registered and does not currently charge VAT. If VAT registration later becomes required, ClauseCast may charge VAT on future taxable supplies as required by law and will provide the appropriate invoice information.
4. Data handling
4.1 Processing purpose: ClauseCast processes submitted case narratives, documents and related legal facts ("Input Data") to authenticate the Customer, operate and secure the Service, generate clarification questions and produce the requested Output.
4.2 Application storage: The current application processes uploaded files and case content transiently during each authenticated request. The application does not deliberately save Input Data, uploaded files, extracted text, document evidence ledgers, proprietary model features or Outputs to Firestore or application object storage. The web framework or cloud runtime may use short-lived memory or temporary request buffering while receiving and parsing an upload; the application closes each upload after reading it and does not reuse that temporary copy after the request. Firestore, configured in London (europe-west2), stores account-access status, the authenticated user identifier, credit balance, limited evaluation timestamps, short-lived evaluation-reservation metadata and one-time refinement-token metadata. Refinement-token records contain no case text or model features and are deleted when used; unused records are intended to expire under a Firestore TTL policy. Scheduled backups and point-in-time recovery are disabled; Firestore still supports access to document versions from within the preceding hour.
4.3 Browser context and targeted retrieval: During an evaluation or clarification flow, the active page may keep conversation history, a compact document evidence ledger and temporary references to files the user successfully uploaded. These values are held only in page memory and are not written by this application to localStorage, IndexedDB or another persistent browser store. If the model requests a document item, the page may re-send the session files to an authenticated retrieval endpoint, which transiently extracts and searches them without sending the complete files to Gemini for that search. Only bounded matching passages are returned for recalculation. Resetting or refreshing the page, signing out or closing the browser process clears the page-held references.
4.4 Processor retention: Input Data and generated material may remain temporarily in Gemini project logs for seven days and in limited abuse-monitoring, infrastructure, security or diagnostic records according to applicable provider settings and contracts. Google Cloud’s globally located _Default log bucket is configured for 30 days and its globally located mandatory _Required administrative/system audit bucket for 400 days. Data Read, Data Write and Admin Read audit logging is disabled, and no additional log sinks or exports are configured. ClauseCast does not intend either bucket to contain case bodies or document text. The Service is not offered as zero-retention.
4.5 No training by ClauseCast: ClauseCast will not use Customer Input Data to train or fine-tune ClauseCast’s proprietary model without the Customer’s separate written agreement. Under Google’s paid-service terms, Google states that paid-service prompts and responses are not used to improve its products by default.
4.6 Privacy documents: Further information appears in the Privacy Notice and Schedule 1.
5. Customer obligations
5.1 Lawful submission: The Customer warrants that it has the rights, authority and lawful basis required to submit Input Data and instruct ClauseCast and its subprocessors to process it. Where required, the Customer must identify an applicable special-category or criminal-offence processing condition.
5.2 Confidentiality and privilege: The Customer is responsible for deciding whether submission may affect confidentiality, legal professional privilege, non-disclosure duties or court obligations. ClauseCast does not warrant that use of an AI or technology provider preserves privilege in every jurisdiction or circumstance.
5.3 Data minimisation: The Customer must remove unnecessary identifiers and anonymise or pseudonymise information where practicable. It must not submit data that is irrelevant, unlawfully obtained or not authorised for disclosure.
5.4 Account security: The Customer must protect account credentials, use the Service only through authorised users and notify ClauseCast promptly of suspected unauthorised access.
5.5 Prohibited use: The Customer must not misuse the Service, bypass safeguards, introduce malicious material, infringe rights, breach law, use the Service for consumer-facing access or permit use by anyone under 18.
5.6 Regulated legal users: Unless the Customer’s authorised compliance or information-security function has approved identifiable use, a law firm or regulated legal professional must use the Service only with anonymised or appropriately pseudonymised commercial case material. The Customer must not upload raw client matter files, privileged communications, witness evidence, or unnecessary special-category or criminal-offence information without a documented assessment and appropriate authority. The Customer remains responsible for confidentiality, privilege, professional duties, supervision and all advice or decisions made using an Output.
6. Intellectual property
6.1 ClauseCast IP: ClauseCast and its licensors retain all rights in the Service, software, interfaces, models, prompts, system architecture, methodologies and underlying data or features. The Customer receives only a limited, non-exclusive, non-transferable right to use the Service during the contract term.
6.2 Customer Data: As between the parties, the Customer retains its rights in Input Data and grants ClauseCast the limited rights needed to provide, secure and support the Service.
6.3 Outputs: Subject to payment and third-party rights, ClauseCast assigns to the Customer any rights ClauseCast may hold in the Customer-specific Output. This does not transfer rights in the Service, underlying models, methods or generally applicable know-how.
7. No legal advice and predictive limitations
7.1 Technology provider: ClauseCast is not a law firm, is not regulated by the Solicitors Regulation Authority and does not provide legal representation, legal advice or a legal opinion. Use of the Service does not create a solicitor-client relationship.
7.2 Statistical estimate: An Output is a probabilistic estimate based on submitted information, historical patterns and model assumptions. It may be inaccurate, incomplete, biased or unsuitable for a particular matter.
7.3 Missing factors: The Service cannot reliably account for all matters, including judicial discretion, procedural decisions, witness credibility, advocacy, disclosure, evidence not submitted, settlement dynamics or changes in law.
7.4 Independent review: The Customer must conduct its own legal, evidential, commercial and financial due diligence and obtain advice from appropriately qualified professionals. The Output must not be the sole or primary basis of a litigation, funding, underwriting, settlement or comparable decision.
7.5 Costs risk: Courts have discretion over costs. An unsuccessful party may be ordered to pay some or all of another party’s costs, but the result depends on applicable rules and circumstances. ClauseCast does not predict or accept responsibility for costs orders.
8. Warranties
8.1 Reasonable care: ClauseCast will provide the Service with reasonable care and skill consistent with a technology service of this kind.
8.2 Exclusions: Except as expressly stated and to the maximum extent permitted by law, the Service and Outputs are provided “as is” and “as available”. ClauseCast does not warrant uninterrupted availability, error-free operation or the accuracy, completeness or fitness of any Output for a particular purpose.
9. Liability
9.1 Unexcludable liability: Nothing limits or excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any liability that cannot lawfully be limited.
9.2 Excluded losses: Subject to clause 9.1, ClauseCast is not liable for loss of profit, revenue, business, contracts, opportunity, anticipated savings, goodwill, data, funding returns, litigation outcomes or adverse costs orders, or for indirect or consequential loss.
9.3 Cap: Subject to clause 9.1, ClauseCast’s aggregate liability arising from events in any contract year is limited to the fees paid or payable by the Customer for the Service in the 12 months preceding the event giving rise to the claim.
9.4 Customer decisions: ClauseCast is not liable for a decision made in reliance on an Output contrary to clause 7.4.
10. Suspension and termination
10.1 Suspension: ClauseCast may suspend access where reasonably necessary for security, suspected misuse, legal compliance, non-payment, provider restrictions or material breach.
10.2 Termination: Either party may terminate as stated in the Order Form. Either party may terminate immediately for an irremediable material breach or a remediable material breach not corrected within 30 days after written notice.
10.3 Effect: On termination, access ends and accrued payment obligations remain due. Clauses intended by their nature to survive, including confidentiality, data protection, intellectual property, liability and governing law, continue.
11. General
11.1 Confidentiality: Each party must protect the other’s confidential information and use it only for the contract, except where disclosure is authorised or required by law.
11.2 Assignment: The Customer may not assign the contract without ClauseCast’s written consent. ClauseCast may assign it as part of a restructuring, financing or transfer of the relevant business, provided this does not materially reduce the Customer’s rights.
11.3 Entire agreement: The contract documents form the entire agreement about the Service and replace prior statements on the same subject, without excluding liability for fraud.
11.4 Severability and waiver: An invalid provision will be adjusted or severed to the minimum extent necessary. Delay in enforcing a right is not a waiver.
11.5 Third-party rights: A person who is not a party has no right to enforce the contract under the Contracts (Rights of Third Parties) Act 1999.
12. Governing law, jurisdiction and contact
12.1 Law: The contract and any non-contractual obligations arising from it are governed by the law of England and Wales.
12.2 Jurisdiction: The courts of England and Wales have exclusive jurisdiction, unless an Order Form expressly provides otherwise.
12.3 Notices and support: Notices and enquiries to ClauseCast may be sent to admin@clausecast.com and, for formal legal notices, to its registered office. Notices to the Customer may be sent to the account or contractual contact address.
Schedule 1: Data Processing Agreement
This Schedule applies where ClauseCast processes personal data contained in Customer Input Data as processor on behalf of the Customer.
1. Roles and instructions
1.1 Roles: For Customer Personal Data in Input Data, the Customer is controller and ClauseCast is processor. ClauseCast remains an independent controller for its own account, billing, contract, security and legal-compliance information.
1.2 Instructions: ClauseCast will process Customer Personal Data only on documented instructions, including these Terms, an Order Form, the Customer’s use of the Service and other written instructions accepted by ClauseCast. If UK law requires ClauseCast to process Customer Personal Data outside those instructions, ClauseCast will inform the Customer of that legal requirement before processing unless the law prohibits the information on important grounds of public interest.
1.3 Unlawful instructions: ClauseCast will inform the Customer if, in its reasonable opinion, an instruction infringes applicable data protection law, unless prohibited from doing so.
2. Details of processing
- Subject matter and nature: receiving case narratives and documents; transiently extracting, structuring and searching text; generating evidence notes and clarification questions; computing a statistical probability; providing support and securing the service.
- Purpose: providing the evaluation requested by the Customer.
- Duration: during each request and clarification flow, plus seven-day Gemini project logging and any limited periods in authorised security, abuse-monitoring or diagnostic systems. Cloud Run request, container and system metadata may be retained in the global
_Default log bucket for 30 days; specified administrative and system audit records are retained in the global mandatory _Required bucket for 400 days. Data Access audit logging and additional log exports are disabled. Account-level records continue for the contract and applicable legal retention periods.
- Data subjects: Customer users, parties to disputes, witnesses, employees, officers, advisers and other people mentioned in submitted material.
- Data types: identity and contact details, employment or professional details, contractual and financial information, correspondence, allegations, evidence, and any special-category or criminal-offence data the Customer chooses and is authorised to submit.
3. Confidentiality and security
3.1 Confidentiality: ClauseCast will ensure that persons authorised to process Customer Personal Data are subject to confidentiality obligations.
3.2 Security: ClauseCast will implement appropriate technical and organisational measures taking account of the state of the art, costs, processing scope and risks. Current measures include encryption in transit, cryptographically verified JWT authentication, Kinde permission checks, a server-side access allowlist, transactional credit enforcement, one-time refinement tokens, request and file-size limits, transient document processing, restricted database storage, response no-cache controls and data-minimised application logging.
4. Subprocessors
4.1 General authorisation: The Customer generally authorises ClauseCast to appoint subprocessors needed to provide the Service.
4.2 Current subprocessors: Current relevant providers include Kinde Australia Pty Ltd for passwordless email authentication, with the ClauseCast Kinde business configured in its UK—London region; ClauseCast’s contracted email-delivery provider for sending authentication messages; Google Cloud for Cloud Run hosting and Firestore credit records in europe-west2 (London), together with operational infrastructure and logging; and Google for the paid Gemini Developer API. The current public list and processing descriptions are available at /subprocessors.html.
4.3 Equivalent obligations: ClauseCast will impose data-protection obligations on each subprocessor as required by applicable law and remains responsible for the subprocessor’s performance of those obligations to the extent required by law.
4.4 Changes: ClauseCast will give at least 30 days’ prior written notice of a new or replacement subprocessor where reasonably practicable. Shorter notice may be given where an urgent security, legal or provider event makes 30 days impracticable. The Customer may raise a reasonable data-protection objection during the notice period. The parties will work in good faith to resolve it; if no reasonable solution is available, either party may terminate the affected Service.
5. Assistance and breaches
5.1 Rights requests: Taking account of the nature of processing, ClauseCast will provide reasonable assistance for Customer responses to data-subject requests.
5.2 Compliance assistance: ClauseCast will provide reasonable information and assistance concerning security, breach notification, data protection impact assessments and prior consultation, taking account of the information available to ClauseCast.
5.3 Personal data breaches: ClauseCast will notify the Customer without undue delay and, where reasonably practicable, within 48 hours after becoming aware of a personal data breach affecting Customer Personal Data. ClauseCast will provide the information reasonably available at the time, issue material updates as the investigation progresses, and reasonably assist the Customer’s response.
6. Return, deletion and audit
6.1 Return or deletion: At the end of the affected Service, ClauseCast will, at the Customer’s choice, return or securely delete all Customer Personal Data and delete existing copies unless UK law requires storage. Data remaining temporarily in authorised logs, archives or provider systems will be placed beyond ordinary use, protected by continuing confidentiality and security controls, and deleted on the applicable documented deletion cycle. ClauseCast will not retain such data for another purpose.
6.2 Audits: ClauseCast will make available information reasonably necessary to demonstrate compliance and permit proportionate audits or inspections on reasonable notice, normally no more than once in any 12-month period unless a personal data breach, regulator request or substantiated compliance concern justifies an additional audit. Audits are subject to confidentiality, security, cost allocation, protection of other customers and ClauseCast intellectual property.
7. International transfers
ClauseCast will ensure that a restricted transfer is covered by an applicable lawful transfer mechanism and safeguards, including adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses where appropriate. On request, ClauseCast will provide further information or a copy or summary of relevant safeguards where disclosure is permitted.
Schedule 2: Technical and Organisational Measures
ClauseCast maintains measures proportionate to the current Service and the risks of processing. These measures are reviewed when the Service or its providers materially change.
- Access control: passwordless authentication through Kinde; issuer, audience, authorised-client and RS256 signature verification; Kinde permission enforcement; and a separate server-side account allowlist before private API access is granted.
- Transport security: HTTPS/TLS for browser, Cloud Run and provider communications.
- Application security: restricted production CORS origin, request validation, file-signature and upload size limits, PDF page and DOCX expansion limits, source-IP request rate limiting, authenticated account access controls, one-time refinement tokens, transactional credit enforcement and untrusted-document instruction controls.
- Data minimisation: transient document parsing and targeted retrieval; only bounded matching extracts are used for a retrieval-assisted recalculation; no deliberate persistence of case narratives, uploaded files, extracted text, evidence ledgers, proprietary model features or outputs in Firestore; Firestore is limited to account-access records, credits, limited evaluation timestamps, short-lived evaluation-reservation metadata and refinement-token metadata.
- Logging controls: application logs are designed not to record case bodies or document text; Data Read, Data Write and Admin Read audit logging and additional log exports are disabled; known retention periods are described in the Privacy Notice.
- Regional configuration: Cloud Run and Firestore are configured in
europe-west2 (London), and Kinde in its UK—London data region. Provider support, telemetry, security and Gemini processing may occur elsewhere under applicable transfer safeguards.
- Resilience and deletion: Cloud Run provides managed service resilience; Firestore scheduled backups and point-in-time recovery are disabled; data is deleted or expires through the documented application and provider retention cycles.
- Incident management: ClauseCast will investigate suspected security incidents, contain and remediate confirmed incidents, preserve proportionate evidence, and notify affected Customers in accordance with Schedule 1.
- Supplier management: subprocessors are selected and contracted subject to applicable data-protection obligations, and material changes are handled under Schedule 1.
ClauseCast does not claim an external information-security certification, independent penetration-test assurance or a zero-retention architecture unless separately confirmed in writing.
