Privacy Policy

Last updated: May 17, 2026

This policy is provided as a working draft and should be reviewed by qualified counsel before being relied upon for live commercial relationships.

1. Who We Are

CDA Claims Intelligence ("Service") is operated by Second Life Software Consulting on behalf of cdanalytics.ai. Inquiries: info@secondlifesoftware.com.

2. What We Collect

• Account data: name, email address, hashed password, role, account preferences.
• Microsoft Outlook content: when you connect Outlook via OAuth, we read email messages from the folders you choose to monitor. This includes sender, recipients, subject, body, attachments metadata, received timestamp, and conversation context. We also store the OAuth access and refresh tokens (encrypted at rest) so we can re-fetch on your behalf.
• Knowledge base uploads: documents you upload (PDF / DOCX / TXT / CSV / MD) for AI retrieval, plus their extracted text and vector embeddings.
• Generated content: AI flags, draft documents, issue logs, and chat transcripts you create through the Service.
• Billing data: we do not store credit card numbers. Stripe stores payment instruments and we store a Stripe customer ID, subscription ID, plan, and a token-credit ledger.
• Usage data: request logs, error logs, AI token cost per request, and audit trail of user actions inside the app.

3. How We Use It

• Operate the Service: scan email, surface flagged items, generate drafts, answer questions, run the issue log.
• Bill you for usage and enforce token-balance limits.
• Notify you of relevant events (broken Outlook connection, flagged email, draft ready, payment failure) via in-app notifications and email.
• Debug issues and improve reliability (anonymized error logs only).
• Comply with legal obligations.

We do not sell your data, share it with advertisers, or use it to train any third-party AI model.

4. Subprocessors

To run the Service we share necessary data with these subprocessors. Each is contractually bound to use the data only to provide their service to us.

• OpenAI — sends email body excerpts and contract-spec text for AI analysis, embeddings, and chat completion. OpenAI does not use API-tier data to train models per their published policy.
• Microsoft Graph (Outlook) — your email content is fetched from Microsoft. We act as the OAuth client.
• Stripe — handles all payment-card processing.
• Render — hosts the backend API and PostgreSQL database (US region).
• Netlify — hosts the frontend web app.
• Resend — sends transactional email (password reset, notifications).
• Sentry — receives redacted backend error reports for debugging.

5. Retention

We retain Customer Data for the lifetime of your active account plus 30 days after termination, after which it is deleted from our primary stores. Backups may retain data for an additional 30 days before rotation. Audit logs and billing records may be retained longer where required for tax or legal compliance.

6. Security

• All traffic to and from the Service is encrypted in transit (HTTPS / TLS).
• Passwords are hashed with bcrypt and never stored in plain text.
• OAuth tokens for Microsoft Outlook are encrypted at rest.
• Access to production data is restricted to authorized engineers.
• We log and audit administrative actions.
• In the event of a confirmed data breach affecting your data, we will notify you within 72 hours.

7. Your Rights

You can:

• Access and export your data from the in-app settings or by request.
• Disconnect Outlook at any time from the Settings page.
• Delete your account by emailing info@secondlifesoftware.com. We will purge primary stores within 30 days.
• If you are a resident of the EEA, UK, or California, you may have additional rights under GDPR or CCPA — contact us to exercise them.

8. Cookies & Local Storage

We use a single first-party item in your browser's local storage to hold your authentication token. We do not use third-party tracking cookies or analytics that profile you across sites.

9. Children

The Service is not directed at children under 16 and we do not knowingly collect data from them.

10. International Transfers

The Service is hosted in the United States. By using the Service from outside the US, you consent to your data being transferred to and processed in the US.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be announced via the email on file with at least 14 days notice.

12. Contact

Questions or data-rights requests: info@secondlifesoftware.com.