Privacy Policy

How You Can Use LeaseCraft

Information We Collect

From Every Visitor

• Analytics Data: Page views, browser type, and general location (country/region), collected by Google Analytics through Google Tag Manager using cookies
• Session Data: Cookies to keep the site working properly and to remember your sign-in
• Form Data: The answers you enter in a questionnaire and the document built from them. They are sent to our servers as you fill in the questionnaire, encrypted in transit (HTTPS) and encrypted at rest when configured. Your answers may also be kept in your browser’s own storage so you can pick up where you left off.
• Contact Messages: If you write to us through the contact form, your name, your email address and your message are emailed to our support inbox so we can reply. The site does not keep a copy. The support inbox is a mailbox hosted by Google (Gmail).
• Purchases Without an Account: For a document bought without signing in, we keep a keyed one-way fingerprint of the email address used at checkout (not the address itself), deleted with the document or when the document is saved to an account, so that you can ask us to email a secure link to your purchased documents to that address. When you ask for such a link, your request keeps the same fingerprint and the list of documents the link opens, and is deleted after 30 days. To find purchases made before we kept this fingerprint, the address you enter is also looked up in the checkout records of our payment processor, Stripe; we do not store the address you enter.

When You Create an Account

• Account Info: Your email address, whether it is verified, your display name (if any), and a sign-in identifier, received from Microsoft Entra External ID. Your password is handled by Microsoft; LeaseCraft never receives or stores it.
• Membership & Billing: Your Stripe customer and subscription references, your membership status and renewal date. Card details are held by Stripe, not by LeaseCraft.
• Your Documents: The documents you create or unlock while signed in, and the answers they were built from

Server Logs

Like most websites, our servers automatically record:

• IP addresses (for security and abuse prevention)
• Pages visited and response times
• Browser and device information

Server logs are used for security monitoring and are not linked to personal identities for anonymous users.

Service Providers

We use these providers to run LeaseCraft. They process data on our behalf, only to provide their service:

• Microsoft Azure (Azure Container Apps, Azure Database for PostgreSQL, Azure Blob Storage): hosts the site, the database and the document files
• Microsoft Entra External ID: account sign-in
• Stripe: membership payments, billing and the billing portal
• Microsoft Azure Communication Services: emails we send you, such as a sign-in confirmation or a secure link to your purchased documents, and the messages you send us through the contact form
• Google (Gmail): hosts our support mailbox, which holds what you email us and the messages you send us through the contact form
• Google Analytics and Google Tag Manager: site usage statistics
• AI provider (Microsoft Azure OpenAI): when you use an AI-assisted feature, such as the legal assistant chat or clause suggestions, what you type is sent to the provider to produce a response. When a document includes text you wrote yourself or our automated checks flag it for review, sections of the document and your answers may be sent to Microsoft Azure OpenAI for an automated review.

How We Protect Your Data

Cookies We Use

You can block or delete analytics cookies in your browser settings; the site keeps working without them.

What We Never Do

Your Privacy Rights

You have full control over your data:

You can cancel your membership’s renewal at any time from your account page: choose “Cancel membership”, or “Manage membership” to open Stripe’s billing portal.

Data Retention

• Drafts: Unfinished questionnaires and unpaid drafts are auto-deleted after 7 days
• Documents made without signing in: Unpaid documents are deleted after 7 days; paid documents are stored securely for 30 days for re-download, then removed from our system (this covers documents bought individually before the membership; downloading now needs an account)
• Documents created while signed in: Linked to your account and not deleted on a timer, paid or unpaid; the automatic deletions above do not apply to them. They stay listed on your account page, including after your membership ends, until you delete your account or ask us to delete them. Each document you unlock can be downloaded for 30 days after you unlock it, and reopened from your account at any time while your membership is active. Once that window has passed and you have no active membership, it is listed as “Download period ended”. To delete your whole account and every document in it, choose “Delete my account and documents” on your account page; to delete a single document, email leasecraft.net@gmail.com
• Deleting your account: Removes your account record (email address, name and the link to your sign-in), every document in your account with its answers and its PDF and Word files, your saved drafts and our record of your membership. An active membership is cancelled at Stripe first, immediately, so you are not charged again; if Stripe cannot be reached, nothing is deleted and you are told. What remains: Stripe’s own payment records and our log of the payment notifications Stripe sent us (event identifiers and dates, no document content), our record of your agreement to receive documents electronically, kept as proof of that agreement (your account number, the numbers and types of the documents unlocked under it, the exact wording you agreed to and the dates; no email address and no document content), the backups and server logs described below for the periods given, messages you emailed to support, and your sign-in itself, which Microsoft Entra External ID holds; email us to have the sign-in removed as well
• Backups: Data we delete, on the schedules above or because you asked, can remain for up to 7 days in encrypted database backups (Azure Database for PostgreSQL backups and point-in-time restore) and in Azure Blob Storage’s soft-delete copies of document files, and is then permanently removed.
• Payments: We never store card details — Stripe processes payments securely. Stripe keeps its own payment records, including after you delete your account.
• Session cookies: Expire after 24 hours of inactivity
• Browser storage: Questionnaire answers kept in your browser are used for 24 hours after you last had the questionnaire open; after that the questionnaire starts empty and the old answers are deleted the next time you open one. You can remove them sooner with Clear Session Data above, Delete my data, or by clearing your browser’s site data
• Server logs: Kept for up to 30 days, then deleted (security audit logs up to 400 days)

Children's Privacy

LeaseCraft is designed for adults conducting legal and business transactions. We do not knowingly collect information from anyone under 18 years of age.

Changes to This Policy

We may update this policy occasionally. Significant changes will be announced on the website. Your continued use after changes indicates acceptance.