Privacy Policy

This Privacy Policy explains how Legalithm ("we", "our", "us") collects, processes, and protects your personal data when you visit our website at legalithm.com or use our services.

We are committed to protecting your privacy and processing your data in compliance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and applicable national data protection laws.

1. Data Controller

The data controller responsible for the processing of your personal data is:

2. What Data We Collect

2.1 Account Data

When you create an account, we collect:

• Email address
• Name (if provided)
• Password (stored as a secure hash, never in plain text)
• Account preferences and settings

2.2 Service Data

When you use our compliance platform, we process:

• Website URLs you submit for scanning
• Cookie scan results and compliance reports
• AI Act assessment inputs (descriptions of your AI systems)
• Generated compliance documentation (risk classifications, Annex IV reports)
• Consent management configuration and analytics

2.3 Usage Data

We automatically collect:

• Pages visited and features used (via PostHog, EU-hosted)
• Device type and browser information
• Anonymized interaction data for product improvement
• Error reports (via Sentry) to fix bugs and improve reliability

We do not collect IP addresses for analytics purposes. Our analytics tool (PostHog) is configured with IP anonymization enabled and is hosted in the EU (Frankfurt, Germany).

2.4 Developer Tools (CLI and MCP Server)

Our command-line tool (legalithm) and MCP server (legalithm-mcp-server) run on your machine. The rule engine ships with them, so risk classification, obligation lookup and Article 50 disclosure generation happen locally and send no source code, file contents, prompts or results to us or to anyone else. The check_record tool is the only one that makes a request, and only to fetch the Trust Center record whose public slug you pass it.

These tools also send an anonymous usage ping so we can tell whether anyone is using them. It is enabled by default and contains exactly three values:

• surface — which tool sent it (cli or mcp)
• command — the command or tool name invoked, e.g. classify
• repoHash — the first 16 hex characters of a SHA-256 hash of the working directory path, used only to count distinct projects. It is one-way: the directory name cannot be recovered from it, and it is not linked to any account.

No arguments, results, file paths, file contents, environment variables or account identifiers are transmitted. To disable it entirely, set either environment variable:

export DO_NOT_TRACK=1
export LEGALITHM_TELEMETRY=0

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in learning whether our developer tools are used at all. The ping carries no identifier tied to you, so we cannot link it to a person; if you would still rather send nothing, the opt-out above is immediate and needs no account.

2.5 AI Act Assessment Data (Free Tool)

If you use our free AI Act Readiness Assessment without creating an account, we collect:

• Your assessment answers (descriptions of your AI system)
• Your email address (only if you choose to provide it to receive results)
• A hashed identifier for abuse prevention (not your IP address)

Assessment data is automatically deleted after 90 days unless you create an account.

3. How We Use Your Data

We process your personal data for the following purposes:

4. AI Processing Disclosure

Legalithm uses artificial intelligence to analyze compliance requirements, classify AI system risks, and generate documentation. When you use our AI-powered features:

• Your AI system descriptions and regulatory queries are processed by third-party AI providers (OpenAI and Anthropic) to generate analysis and documentation.
• We never send your email address, name, or other personally identifying information to AI providers. Only the content you submit for analysis (system descriptions, questions) is processed.
• Our AI providers operate under Data Processing Agreements with zero data retention policies, your data is not used to train their AI models.
• International data transfers to AI providers (US-based) are protected by EU Standard Contractual Clauses (SCCs) as per GDPR Chapter V.

For more details about our AI usage, see our AI Transparency page.

5. Sub-Processors

We use the following third-party services to provide our platform. Each operates under a Data Processing Agreement (DPA). For our current operational register, see Sub-processor Register.

6. International Data Transfers

Your data is primarily stored and processed within the European Union. Where data is transferred to third countries (specifically the United States for AI processing and email delivery), we ensure appropriate safeguards are in place:

• EU Standard Contractual Clauses (SCCs) with all US-based providers
• Zero data retention agreements with AI providers (OpenAI, Anthropic)
• PII stripping before data leaves the EU where technically feasible

7. Data Retention

• Account data: Retained while your account is active, plus 30 days after deletion
• Scan results and reports: Retained while your account is active; deleted upon account deletion
• AI Act assessments: Retained while your account is active; public assessments expire after 90 days
• Usage analytics: Aggregated and pseudonymous data retained for up to 14 months
• Error logs: Retained for 30 days
• Database backups: Retained for 90 days, then automatically deleted

8. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

• Right of Access (Art. 15), Request a copy of all personal data we hold about you
• Right to Rectification (Art. 16), Correct inaccurate or incomplete data
• Right to Erasure (Art. 17), Request deletion of your personal data
• Right to Restriction (Art. 18), Restrict processing of your data
• Right to Data Portability (Art. 20), Receive your data in a structured, machine-readable format
• Right to Object (Art. 21), Object to processing based on legitimate interests
• Right to Withdraw Consent (Art. 7(3)), Withdraw consent at any time for consent-based processing

To exercise any of these rights, please contact us at pedram@legalithm.com or use our Privacy Request form. We will respond within 30 days as required by GDPR.

9. Cookies

We use cookies and similar technologies on our website. For full details, please see our Cookie Policy.

Essential cookies (authentication, security) are used based on our legitimate interest. Analytics cookies (PostHog) are only set after you provide consent through our cookie banner.

You can also review platform usage restrictions in our Acceptable Use Policy.

10. Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit (TLS 1.3) and at rest
• Row-level security (RLS) in our database ensuring data isolation between tenants
• Role-based access control (RBAC) with principle of least privilege
• Regular security audits and automated vulnerability scanning
• HSTS, CSP, and other security headers on all pages

11. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. For significant changes, we will send you an email notification.

13. Supervisory Authority

If you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.