What we do
with your documents.

Who is responsible, and how to reach us

Quoqo, Inc., a Delaware corporation in the United States, operates LeaseSift and decides how it works. For your account and billing data, Quoqo, Inc. is the controller (the “Data Fiduciary” under India's DPDP Act). For the contents of the lease documents you upload, you decide what to upload and why, and Quoqo, Inc. processes them on your instructions — we act as your processor (or “Data Processor”) for that material.

Quoqo, Inc. maintains a registered agent and a virtual registered office in Delaware. It has no other premises and no staff in the United States; the people who build and operate LeaseSift are in India and access data from there.

Contact for anything in this policy, including requests about your personal data and grievances: hello@quoqo.com.

We have not appointed a Data Protection Officer, and we do not claim one. Requests sent to the address above reach the people who run the service.

What we collect

Account and organisation data

• your email address, your name and your organisation's name, taken at signup;
• a bcrypt hash of your password — never the password itself;
• your role (admin or member), whether your account is active, and when your email address was verified;
• invitations you send or receive: the invited address, the role, who invited them, and when it was accepted, revoked or expired.

Microsoft sign-in and Marketplace subscriptions

If you configure a Microsoft Marketplace purchase, we receive your Microsoft tenant and object identifiers, profile name and an email claim. We bind the verified subscription to its beneficiary's Microsoft identity. An email claim alone does not link an existing LeaseSift account. We also store the subscription identifier, purchased plan, quantity, paid term, fulfillment status and lifecycle-operation records needed to manage access. Purchase tokens and sign-in codes are processed during setup; short-lived encrypted cookies protect that setup flow. They are not stored as billing database records.

Documents and what we derive from them

• the original files you upload, exactly as uploaded, together with their filenames;
• the full text extracted from them;
• the lease abstract: extracted terms, dates, options and obligations, with the evidence passages quoted from your document that each finding was drawn from;
• the counsel review: findings, risks, obligations, clause issues and citations, which also quote your document;
• anything else derived on request — comparisons, redline suggestions (which hold the original and suggested clause text), defined terms, deadlines, playbook assessments, and answers from the chat and portfolio-search features;
• notes, obligation notes and other free text you write in the workspace.

Commercial leases routinely name individuals — tenants, guarantors, agents, signatories, contacts. Where they do, that personal data is part of the document content above, and we handle it as your processor.

Usage and audit records

• an audit trail of review decisions: which field was changed, its previous and next value, who changed it, when, and whether the change was manual, automatic or an undo;
• obligation and date events: confirmations, dismissals and status changes;
• activity records naming a document and an action;
• counsel review events, including when a review was started and when a citation was clicked;
• an append-only billing ledger: every package or credit granted, consumed, released or refunded, with the amount, currency and payment reference;
• share links you create, including when they were last viewed and how many times;
• security events, which record the event type, the endpoint, your IP address and your browser's user-agent string — for example a failed login or a rejected request;
• an acceptance record: when you accepted this policy, the Terms and the Data Processing Schedule, which version you accepted, whether you did so at signup, on an invitation or from the dashboard after they changed, and the IP address and user-agent string at that moment. Accepting a later version adds a record; it does not replace the earlier one;
• a record of every deletion made in the product or by us on request: who asked, when, why, and how many files and records were removed.

The audit trail deliberately keeps the values it records, which means it contains document-derived content as well as who did what.

Payment data

We never receive, see or store your full card number. Payment is taken on Stripe's own hosted checkout page for direct purchases: we create a session and send your browser to Stripe, and your card details are entered there. Stripe also collects your billing address and, where you give one, your tax identification number (a GSTIN for Indian businesses).

What comes back to us and is stored is limited to: your Stripe customer and subscription identifiers, the subscription status and period end, and the amount, currency and price identifier of each purchase. We send Stripe your email address, your organisation identifier, and the invoice note that goes on your invoice.

For Microsoft Marketplace subscriptions, Microsoft collects payment and manages invoices, renewals, cancellation and Marketplace refund requests. We exchange subscription and plan identifiers, beneficiary tenant/object identifiers and fulfillment/lifecycle status with Microsoft to verify the purchase and manage access. Lease documents and findings are not sent to Marketplace billing APIs. Microsoft's identity, commerce and Azure hosting/AI services have distinct purposes; document processing through Azure is described below.

What we do not collect

We do not use analytics for advertising, build advertising profiles, or sell or rent personal data. Public-page measurement is described in the Cookies and analytics section below. Lease documents, account forms and workspace activity are excluded from this measurement.

Why we process it, and on what basis

Clause 7 of the Terms of Service states what may and may not be derived from your material. Your documents are not used as a training corpus, and neither are the verbatim evidence passages cited from them.

Who else processes your data

These are every third party that receives customer data from LeaseSift. Each one is here because the code that sends to it was read, and each is configured on the live service.

“Region not specified by us” means we have not chosen or been told a specific processing region for that provider and will not guess at one. Ask us and we will find out for your account.

We have not agreed zero-retention or no-training terms with the model providers, and we do not claim to have done so. If that matters to your organisation, raise it before you upload anything.

Our own staff can access your content where it is necessary to operate the service, to support you or to investigate a fault. Platform operator accounts have access across organisations for that purpose. Ordinary customer accounts do not: each organisation's data is isolated at the database level (see Security below).

We may also disclose data where we are legally required to, and to a successor if the business is sold, under the same commitments.

We will update this list before adding a sub-processor that receives customer data.

International transfers

LeaseSift is international by construction, and you should assume your data crosses borders:

• the direct-purchase seller is in the United States; for a Marketplace purchase, the seller is identified in the Marketplace order and contract;
• the people who operate and support the service are in India and access data from there;
• the application, database and cache are in Azure Central India, and the configured Foundry AI deployments, for lease workflows and search, are in South India;
• the document store's bucket carries an APAC location hint;
• external model providers, payment, identity, email and error-reporting services can process data internationally in regions we have not specified.

Our processing of personal data on your behalf is governed by the Data Processing Schedule, which forms part of the Terms of Service and is accepted with them, so every customer is covered by it without signing anything. We have not put standard contractual clauses in place and have not appointed a representative in the European Union. We say so rather than imply protections we have not put in place. If your organisation needs a particular transfer mechanism or additional documentation, write to hello@quoqo.com before you upload anything.

How long we keep it, and what deletion does

We keep your data for as long as your account exists, and we do not delete it on a schedule. There is no automatic expiry of documents, abstracts, reviews or audit records. Password-reset links, unused signup links and our one-hour analysis cache lapse by themselves.

What the product deletes

An administrator of your organisation can delete an uploaded document. That removes the original file from storage, the text extracted from it, every lease abstract built from it with its dates, obligations and evidence passages, the counsel reviews and review history, the deadlines, defined terms and search embeddings, any saved comparison or generated report that names it, and any share link that points at it. It cannot be undone.

If that document was sent to Quoqo Counsel for a counsel review, the deletion reaches that copy too: the file we sent, the text it extracted, the review it produced and the passages it quoted are destroyed there as part of the same operation. If we cannot reach Counsel at the time, the deletion fails and says so rather than reporting a success it did not achieve, and it resumes when you or we run it again.

An administrator can also erase a user. Erasure overwrites that person's email address, name and password, destroys their sessions and any outstanding reset or invitation links, and transfers the documents, abstracts and reviews they owned to a colleague you name, so your organisation does not lose access to its own lease file. The record of the work they did survives, carrying an internal identifier that no longer corresponds to any name or address.

Any member can still delete individual items from the workspace — a saved analysis, a note, a deadline, a redline session, a conversation. Deleting a saved analysis removes that record and not the underlying document.

Asking us to delete an account or an organisation

Write to hello@quoqo.com and tell us what you want removed. We will erase the whole organisation — every document and original file, every abstract, review, evidence passage, deadline, embedding, batch, report, conversation and share link, and every user account and session — and confirm when it is done, with a count of what was destroyed. We will action such a request promptly.

What erasing a user does not do

Erasure removes the identifiers. It does not remove context: a review decision is attached to the lease it was made on, so while your organisation still exists its own administrators may be able to work out who made a given correction from the date and the document. It does not reach free text — a note, a message or a lease may name anybody. And our security event records keep what we observed at the time, including the email address used in a failed sign-in attempt.

What survives deletion

• Billing and tax records — invoices, payments, credit notes and the package ledger, kept for as long as company law requires. They are append-only by design and our systems are not permitted to delete them.
• Security event records, including IP addresses, kept indefinitely so that we can investigate abuse. There is no schedule on which they expire.
• A record of the deletion itself — who asked, when, why, and how much was destroyed — kept indefinitely as the evidence that we honoured the request. It holds no document content.
• A record of which version of these terms was accepted, and when. When we delete an organisation we keep the fact that someone in it accepted a named version of the Terms, the Privacy Policy and the Data Processing Schedule on a given date. We remove the IP address and browser we recorded alongside it, and the link to the person, so what is left says that the organisation agreed to a version on a date and nothing about who. We keep it for the same reason we keep the invoices: it is the record of what was agreed while we were being paid.
• An empty organisation record — its identifier and its billing references, with the name and all content removed. It survives because the billing records above refer to it.
• De-identified metadata already derived under clause 7 of the Terms, which by then no longer identifies you, a party or a property.
• Backups held by our hosting provider, which age out on that provider's cycle rather than on demand.
• Records held by Stripe or Microsoft, which we do not delete from their systems.
• Some traces at Quoqo Counsel, our review sub-processor. Deleting a document, or an organisation, now destroys the copy it held: the file we sent it, the text it extracted, the review it produced and every passage it quoted from your lease. Three things are outside that reach. Its own record that a review ran at a given time survives, holding no part of your document. The text was read by the model provider it uses, which we do not control. And its database backups age out on its hosting provider's cycle rather than on demand. And where no identifier for the copy was recorded — everything deleted before we built this, and the occasional upload interrupted before we could note what it produced — we cannot point at it to destroy it; write to us and we will ask them to remove it.

Security

These are measures we have actually implemented. We claim no certification of any kind — LeaseSift holds no SOC 2 report and no ISO certification, and has not been independently audited.

• Passwords are stored as bcrypt hashes. Login takes the same time whether or not an address has an account, so accounts cannot be enumerated by timing.
• Email verification is required before an account exists at all. Registering creates nothing and reserves nothing; the account and its password are created only when the emailed link is used.
• Sessions last 30 days and can be ended by signing out, which destroys the session, and are destroyed for every session when a password is reset.
• Invitation and password-reset links are single-use, time-limited and stored only as hashes, so a stolen database row is not a working link.
• Tenant isolation is enforced in the database, not only in application code. The application connects as a restricted role that cannot bypass row-level security, and every request pins its organisation for the duration of a single transaction, so a query cannot see another organisation's rows. The lease and billing tables force those policies even against the table owner.
• Documents are private. The object store issues no public or pre-signed URLs; a file is served only through a route that checks your session first. Where your organisation is set to keep documents private to their uploader, that is enforced in the query.
• Your original files are encrypted where they are stored. Every object in our Cloudflare bucket, and its metadata, is encrypted at rest with AES-256. Cloudflare does this to all objects automatically and holds the keys; it is not a setting we turn on, and there is no way to turn it off. We do not hold a separate key of our own, so Cloudflare can read those files and so can anyone who obtains our bucket credentials.
• Database and cache storage. Azure Database for PostgreSQL encrypts database storage, backups and temporary files at rest. Azure Managed Redis encrypts persistence disks when persistence is used, but does not encrypt data in memory. We do not add application-level encryption to extracted document text, findings or cached analysis. Provider-managed storage encryption does not prevent access by an authorized service operator or someone who compromises valid application credentials.
• Transport. Traffic to the site and the named providers uses TLS. Our Azure PostgreSQL server requires secure transport and our Azure Managed Redis database is configured for encrypted client connections.
• The session cookie is HttpOnly, Secure and SameSite=Lax, so scripts cannot read it and it is not sent on cross-site POSTs.
• Requests are rate-limited, logins and signups are throttled, and cross-site requests to sensitive routes are rejected.
• Error reports are scrubbed before they leave, as described above, specifically so that lease contents cannot escape in a stack trace.

Session tokens are held in our database in a form that can be used to identify the session. No system is perfectly secure, and we do not promise that yours cannot be broken into. If we discover a breach affecting your data we will tell you and, where required, the relevant authority, without undue delay.

Your rights

Write to hello@quoqo.com to exercise any of these. We will ask you to verify who you are, and will respond within the period required by the law that applies to your request. There is no charge.

Some of this you do not have to ask us for. An administrator of your organisation can delete a document, and everything derived from it, and can erase a user, from inside the product. What that does and does not remove is set out under how long we keep it. Erasing a whole organisation is a request to us.

Under India's Digital Personal Data Protection Act, 2023

If you are in India, you have the right to:

• access a summary of the personal data we hold about you and how it is processed, and the identities of the parties it has been shared with;
• correct, complete, update or erase your personal data;
• nominate another person to exercise these rights on your behalf if you die or become incapacitated; and
• a grievance process. Send grievances to the address above. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

We have not appointed a named grievance officer; the address above is the contact for this purpose. Where we act as a Data Processor for lease content on a customer's instructions, we will pass a request about that content to that customer and assist them in answering it.

Under the GDPR

If the GDPR applies to you, you have the right to:

• access your personal data and receive a copy;
• rectify inaccurate data and complete incomplete data;
• erase your data, where one of the grounds in Article 17 applies;
• restrict or object to processing, including processing carried out on the basis of our legitimate interests;
• portability — to receive the data you gave us in a structured, commonly used, machine-readable format; and
• complain to your supervisory authority.

We do not carry out automated decision-making that produces legal or similarly significant effects about you. LeaseSift analyses documents; a person in your organisation decides what to do about the result.

As noted above, we have no EU representative and no standard contractual clauses in place today. Our commitments as processor are in the Data Processing Schedule.

Cookies and analytics

Analytics disclosure updated 21 September 2026.

The service uses the essential cookies below. On public pages, we also use Cloudflare Web Analytics for cookie-free traffic and performance measurement. If you select “Allow analytics”, Google Analytics 4 measures public-page visits using optional cookies. It remains off until you allow it, and declining does not affect the service. We keep advertising storage and personalization disabled.

Blocking the session cookie will stop you signing in. Optional Google cookies (_ga and _ga_*) last up to 180 days. Your analytics choice is stored in this browser for 180 days. You can change it using “Analytics preferences” on any public page; declining removes Google Analytics cookies and stops further Google measurement.

Google receives the public page URL and title, referring site origin, cookie identifiers, and browser/device information for visitors who opt in. Cloudflare receives public page and referrer information and performance measurements. Requests expose your IP address to the receiving provider. Query strings and fragments are excluded from reported page URLs. No document text, lease findings, user IDs, email addresses, form entries or authenticated workspace events are sent by these analytics integrations.

Providers: Google Analytics privacy information and Cloudflare privacy information. These providers may process data internationally. Google Analytics event-level retention is initially set to two months; aggregated reports can remain longer.

Children

LeaseSift is a business product and is not directed at children. We do not knowingly create accounts for, or collect personal data from, anyone under 18. If you believe a child has given us personal data, write to hello@quoqo.com and we will delete it.

A note on what LeaseSift produces

Findings, abstracts, counsel reviews and reports are not legal, tax or accounting advice. They are produced substantially by automated systems, which make mistakes. Review the governing documents and obtain advice from a qualified professional before relying on anything LeaseSift produces. Clause 3 of the Terms of Service sets this out in full.

Changes to this policy

We may update this policy. The current version and its date are at the top of this page.

Contact

For anything in this policy, including access, correction, erasure and grievances, write to hello@quoqo.com, or by post to Quoqo, Inc., Delaware, United States.