This Privacy Policy explains how WorkMesh Inc. ("WorkMesh", "we", "us") collects and processes personal data when you visit contractsphere.ai, request a demo, apply to our design-partner cohort, subscribe to the benchmark report newsletter, or otherwise interact with ContractSphere.ai. It applies to the marketing website and is separate from the Data Processing Addendum (DPA) that governs personal data we process on behalf of our customers.
Who we are
WorkMesh Inc. is the data controller for personal data processed via this website. You can reach our privacy team at privacy@contractsphere.ai.
What we collect
- Demo request form — name, work email, company, role, company size, annual contract volume, and optional consent to receive product updates.
- Design-partner application form — name, work email, company, role, annual contract volume, target go-live timeline, weekly time commitment, co-design appetite, and an optional free-text description of the problem you are trying to solve.
- Newsletter subscription (footer) — work email only. Used to send the Life Sciences Contract Operations Benchmark report and occasional product field notes. Explicit opt-in.
- Email preferences and unsubscribe pages — when you click a one-click unsubscribe link in our email, we process the signed token (containing your email and the audience identifier) to record your opt-out. When you use our preference center, your selected subscription states.
- Communication content — emails and messages you send us.
- Technical data — IP address, browser, referrer, UTM parameters, pages visited, derived from server logs and (with consent) analytics cookies. We also process a Cloudflare Turnstile token to verify form submissions are not automated.
Why we process it
| Purpose | Lawful basis (GDPR) |
|---|---|
| Responding to a demo request and coordinating the meeting | Legitimate interest / steps prior to contract |
| Evaluating design-partner cohort applications and corresponding with applicants | Legitimate interest / steps prior to contract |
| Sending the benchmark report newsletter and other marketing updates after explicit opt-in | Consent |
| Processing unsubscribe and preference-management requests | Legal obligation (CAN-SPAM, PECR) / Consent withdrawal |
| Site security, bot mitigation (Turnstile), fraud and abuse prevention | Legitimate interest |
| Analytics on aggregated site usage | Consent (where required) |
| Compliance with legal obligations | Legal obligation |
Who we share it with (sub-processors)
We work with a small number of vendors who process personal data on our behalf. They are bound by written data protection terms and only process data on our documented instructions.
| Sub-processor | Purpose | Processing location |
|---|---|---|
| Cloudflare, Inc. | Hosting (Cloudflare Pages), CDN, security (Turnstile bot protection, WAF, DDoS mitigation), Workers KV storage of demo submissions. | Global edge network (USA HQ) |
| Resend, Inc. (using Amazon SES infrastructure) | Transactional email — confirmation emails for demo requests and internal notifications. Marketing email — benchmark report newsletter delivery, audience-list management, and one-click unsubscribe handling (RFC 8058 List-Unsubscribe header). | USA |
| Microsoft Corporation | Business email (Microsoft 365) — receiving and responding to demo requests, privacy queries, security reports, and customer correspondence. | USA / EU (per tenant) |
We do not sell personal data. We will update this list when sub-processors change. If you would like to be notified of changes, contact privacy@contractsphere.ai.
International transfers
Where personal data leaves the EEA, UK, or Switzerland, we rely on the EU Standard Contractual Clauses (or the UK IDTA / Swiss equivalent) together with supplementary measures.
How long we keep it
Demo request data and design-partner application data are retained for up to 24 months from your last interaction if the conversation does not lead to a customer relationship. Marketing opt-in data (benchmark report subscribers and similar lists) is retained by our email service provider, Resend, until you unsubscribe — which you can do via the one-click link in every email, our hosted unsubscribe page, our preference center, or by emailing privacy@contractsphere.ai. Server logs are retained for up to 90 days.
Your rights
Subject to the laws of your jurisdiction, you may request access, correction, deletion, restriction, portability, or object to processing. EU/UK residents have the right to lodge a complaint with their supervisory authority. California residents have rights under the CCPA/CPRA, including the right to know, delete, correct, and to limit the use of sensitive personal information; we honor the Global Privacy Control (GPC) signal. To exercise any right, contact privacy@contractsphere.ai.
Children
The site is not directed to children under 16. We do not knowingly collect data from children.
Changes
We may update this policy from time to time. Material changes will be highlighted on this page.