Privacy Policy
What we collect, why, who else touches it, and how to get it back or have it deleted.
Last updated 25 August 2026
Not ready to publish. These details are still blank in lib/legal.ts: registered entity name, company number, registered address, contact email, privacy contact email. Fill them in before taking a live payment.
1.Who is responsible
The controller of your personal data is [ TO BE COMPLETED ] of [ TO BE COMPLETED ]. For anything in this policy, write to [ TO BE COMPLETED ].
2.What we collect
- Account data — your name, email address, and sign-in events. Handled by Clerk; we never see or store your password.
- What you ask — the questions you put to the service, any facts you supply when it asks a clarifying question, the memos it returns, and anything you save to a scratchpad.
- Billing data — your credit balance and ledger, which packs you bought, and when. Card numbers are entered on Stripe’s hosted page and never reach our servers.
- Technical data — request metadata and page views, through Vercel’s cookieless analytics. No advertising or cross-site tracking cookies are set.
Think before you type. A legal question often carries facts about real people. Only include what the question actually needs — the service answers questions of law perfectly well when names and identifying details are replaced with descriptions. If you are an advocate, your professional duty of confidentiality applies to what you put here.
3.Why we may use it
- To perform our contract with you — running your account, answering your questions, taking payment, keeping the credit ledger accurate.
- Legitimate interests — keeping the service secure, preventing fraud and abuse, and understanding in aggregate how it is used so it can be improved. We balance these against your rights and use the least data that works.
- Legal obligation — tax and accounting records, and responding to lawful requests.
4.Who else processes it
We use the following processors. Each is bound by a data processing agreement and may use the data only on our instructions.
| Processor | What for | Where |
|---|---|---|
| Clerk | Account creation, sign-in, and session managementName, email address, authentication events | United States |
| Neon | Application database — accounts, conversations, creditsAccount records, questions asked, memos produced, credit ledger | European Union |
| Vercel | Application hosting and cookieless traffic analyticsRequest metadata, IP address (transiently), page views | United States / global edge |
| Stripe | Payment processing, and merchant of record for credit purchasesName, email, billing country, payment details (never seen by us) | United States / European Union |
| Anthropic | The language models that read the corpus and draft your memoThe question you ask and the source passages retrieved for it | United States |
The one that deserves spelling out: answering your question means sending it to a language model. Your question, and the passages of legislation and case law retrieved for it, are transmitted to Anthropic’s API for processing. Anthropic does not train its models on data submitted through that API. We do not sell personal data, and we do not use your questions to train any model of our own.
5.Transfers outside the EEA
Some processors above are established in the United States. Those transfers are made under the European Commission’s Standard Contractual Clauses, or under the EU–US Data Privacy Framework where the recipient is certified, together with supplementary technical measures such as encryption in transit and at rest.
6.How long we keep it
- Account and content — for as long as your account is open. If you close it, we delete or anonymise within 90 days.
- Billing and tax records — for as long as tax law requires, which in the Republic of Cyprus is generally six years, regardless of account closure.
- Security logs — a short rolling window, then discarded.
7.Your rights
Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable form. Where we rely on consent you may withdraw it at any time. Write to [ TO BE COMPLETED ] and we will respond within one month.
If you are not satisfied, you may complain to the Office of the Commissioner for Personal Data Protection in the Republic of Cyprus, or to the supervisory authority where you live.
8.Cookies
We set only what the service needs to function: a session cookie from Clerk so that you stay signed in, and your interface preferences. Vercel’s analytics are cookieless. There is no advertising, profiling, or cross-site tracking, which is why you are not asked to consent to any.
9.Security
Data is encrypted in transit and at rest. Access to production systems is restricted and authenticated. No system is perfectly secure; if a breach affects your rights we will notify you and the supervisory authority as the GDPR requires.
10.Children
The service is not intended for anyone under 18 and we do not knowingly collect their data.
11.Changes
We will post any change here and update the date above. If a change is significant we will tell you by email.