Privacy Policy

1. Who is responsible

ClaimReadiness is an independent informational tool. Use the Contact us page for questions about these notices or how your information is handled.

2. Data and the service flow

The Contact us form separately collects your name, email and message to respond to your request, using necessary pre-contract steps or our legitimate interest in answering service enquiries as applicable. It does not accept attachments. Contact messages are stored in a separate support inbox, become eligible for deletion after 30 days subject to legal obligations, and are not used for advertising. When email delivery is configured, messages are forwarded to the support inbox using Resend; email providers can retain their own delivery records. Please do not send claim documents or sensitive records through this form.

Before payment, policy PDFs and images are read in your browser. The application holds extracted text, filenames, incident details and compressed optional images in memory. Immediately before checkout it writes a temporary tab-session draft so those details survive the Stripe redirect. Original policy files are not uploaded to ClaimReadiness for extraction.

After payment is verified, your browser sends extracted policy text, incident details and compressed evidence images to ClaimReadiness's serverless report function, which passes them to OpenAI to generate the report. The function returns the report to your browser. Application code does not write claim documents, images, narratives or generated reports to the project database or a file bucket. Providers can still process data in transit and retain data under their own arrangements; ‘no saved claims’ does not mean ‘no personal data is processed.’

Stripe receives payment, billing and receipt information you provide on its checkout page. ClaimReadiness receives checkout status and references, and records the notice version/hash, server acceptance time and the affirmative agreement flags in Stripe metadata. The database also preserves public legal-notice snapshots so the exact accepted terms can be retrieved by their version and hash; these snapshots do not contain a purchaser’s claim information. Security tables hold hashed payment-use markers, processing state, attempts/times and keyed IP-hash rate-limit counters. These hashes are treated as pseudonymous security data, not guaranteed anonymous data.

Hosting and access providers, including Cloudflare and the ChatGPT Sites access layer, may receive IP addresses, request metadata, authentication information and security events. This private Site requires ChatGPT sign-in, administered by that platform. We do not intentionally log claim request bodies or report text. The service is for adults 18 and over and is not directed to children. Contact the operator if you believe a child has supplied data so any available records can be assessed and removed as required.

3. Purposes and legal bases

We process your necessary service inputs, create checkout and generate/deliver your requested report to take steps at your request and perform the purchase contract. We use proportionate security and fraud-prevention metadata for legitimate interests in protecting the service and limiting repeat paid requests. Applicable legal obligations can require payment, tax or dispute records. Optional browser speech processing is enabled only after a separate, withdrawable choice; that choice is not required for typing, purchasing or other core use.

We do not ask you to consent to analytics or advertising as a condition of purchase. Acknowledging this notice is not an agreement to optional tracking. Do not provide special-category information, medical information, government identifiers or unnecessary third-party information. The service is not designed to process health claims. When material concerns another person, the operator must separately assess a lawful basis and any indirect-collection notice duties; your acceptance does not automatically provide that person’s consent. Only necessary data should be used, with any legitimate-interest basis documented through a necessity and balancing assessment. The operator must assess an appropriate additional legal condition before any intended sensitive-data use; accepting Terms is not such a condition.

4. Providers and international processing

OpenAI provides the commercial model API. Stripe provides hosted payments. Cloudflare and ChatGPT Sites provide hosting, security and, while private, access control. Their roles can differ by activity: some act as processors for the service and some handle payment, fraud, platform accounts or legal obligations independently. Our configuration does not establish a zero-data-retention agreement with any provider.

OpenAI can retain data for abuse monitoring and other purposes subject to its current terms and applicable account settings. ClaimReadiness requests report generation with response storage disabled; this does not establish a zero-data-retention agreement. See https://developers.openai.com/api/docs/guides/your-data .

Processing can occur outside your country, including the United States. We have not represented that all data stays in the EU or that every provider has identical retention terms. Use the Contact us page to ask about applicable provider processing arrangements.

5. Optional speech and tracking

If you enable speech recognition, your browser may send audio to its own speech provider, which may include Google, Apple or another browser/OS provider. ClaimReadiness does not record or upload audio to its own server; it receives the transcript in the browser. Browser permissions and the provider's terms also apply. Typing is available without speech consent. Turning the feature off stops an active recognition session and prevents a new one; it cannot retract data the provider already processed.

No analytics, advertising pixel, cross-site marketing tracker, remote font service or third-party JavaScript SDK is installed by ClaimReadiness. OCR scripts and language data are served from this Site and OCR language caching is disabled. Optional services stay off until allowed. The Cookies & Privacy Choices notice explains browser storage and preference controls. Payment and hosting providers have their own necessary processing when their services are used.

6. Your rights and how to contact us

Depending on your location and the applicable law, you may request access, a copy/portability, correction, deletion, restriction, or object to particular processing, and withdraw optional consent. Some US residents may have additional appeal or opt-out rights. ClaimReadiness does not sell personal information, share it for cross-context behavioural advertising, or use it for advertising profiles. Global Privacy Control is respected by keeping those uses off. We make no solely automated decision that determines coverage, eligibility, payment or another legal entitlement.

Use the Contact us page for support and privacy requests. Explain the right you wish to exercise and, if relevant, provide a Stripe receipt/reference. We may ask for proportionate verification but will not require a full claim file merely to verify a privacy request. Requests are handled within the period required by applicable law, ordinarily one month for an EEA GDPR request, with any lawful extension explained. Some transaction/security records may be retained where a legal obligation or legitimate exception applies; we will explain an applicable refusal and any appeal route.

You can remove the tab draft using your browser’s site-storage controls. We cannot retrieve a draft or report that exists only on your device. Browser vendors, Stripe and other independent controllers can have their own rights channels. EEA residents may complain to their competent supervisory authority, including in their country of residence, workplace or the alleged violation. You may also contact an applicable US regulator. A complaint to us is not a prerequisite to exercising a legal right.

7. Retention, security and notice changes

The separate Data Retention notice gives the local draft lifetime, payment-marker and rate-limit cleanup rules, external-provider limitations and deletion controls. We use access controls, transport security and bounded server requests, but no system or browser is guaranteed secure. Do not use a shared device without clearing your session. We will assess and make any legally required breach notifications after an incident. Material changes to processing require a notice update and a new optional choice where necessary; a new notice does not silently authorise a new use of old claim content.