Legalica Privacy Policy & Data Protection

1. INTRODUCTION AND LEGAL FRAMEWORK

[...] OÜ ("Legalica," "we," "us," or "our") processes personal data in accordance with this Master Privacy & Data Governance Policy ("Policy").

1.1 Applicable Legal Framework

This Policy complies with the following regulations and frameworks:

1.2 Scope Across 324 Jurisdictions

Legalica operates across 324 jurisdictions and 187+ languages. While this Policy is designed for global compliance, the GDPR serves as the baseline standard for all processing activities. Where local laws provide stronger protections, those stronger protections apply. Users in all Supported Jurisdictions retain the rights granted by their local data protection laws, even if such rights exceed those described herein.

2. DATA CONTROLLER INFORMATION

2.1 Controller Identity

2.2 Data Protection Officer

2.3 Lead Supervisory Authority

Rationale for Estonian Lead Authority: Legalica's main establishment is in Estonia. Under GDPR Article 56, the supervisory authority of the main establishment serves as the lead authority for cross-border processing. Data subjects in all EU Member States may lodge complaints with the Estonian DPA or their local supervisory authority.

2.4 Representative in the EU

For non-EU data subjects requiring an EU point of contact: [...] OÜ serves as the EU representative per GDPR Article 27.

3. CATEGORIES OF PERSONAL DATA COLLECTED

4. COLLECTION METHODS

5. LEGAL BASIS FOR PROCESSING

Legitimate Interests Assessment (LIA): Available upon request at dpo@legalica.app. We have conducted balancing tests ensuring our legitimate interests do not override your fundamental rights.

6. PURPOSES OF PROCESSING

6.1 Primary Purposes

• Platform Services: Authentication, query processing, AI response generation, document drafting, KYC/UBO tools, Google Workspace sync;
• Payment: Subscription fee processing, billing, invoicing, dispute handling;
• Security: Unauthorized access monitoring, fraud detection, integrity maintenance;
• Support: Inquiry response, troubleshooting, onboarding;
• Communication: Essential service notifications, marketing (with consent only);
• Legal Compliance: Tax/accounting records, legal request response, Terms enforcement;
• Platform Improvement: Anonymized usage pattern analysis only.

6.2 What We Do NOT Do

• ❌ Use your data to train any AI models (contractually prohibited);
• ❌ Sell your data to any third party;
• ❌ Use your data for advertising profiling;
• ❌ Share data with third parties for their marketing;
• ❌ Automated decision-making with legal effects.

7. ROLE: CONTROLLER VS. PROCESSOR

8. GOOGLE CLOUD INFRASTRUCTURE AND DATA PROCESSING

8.1 Infrastructure Provider as Key Subprocessor: Google LLC is Legalica's primary Infrastructure Provider and subprocessor. All Customer Data is stored, processed, and transmitted through Google Cloud Platform services. The following Google services process Customer Data:

8.2 Google's Role and Obligations: Google LLC processes Customer Data under the Google Cloud Data Processing Addendum (google.com/.../data-processing-addendum), which incorporates:

• EU Standard Contractual Clauses (2021/914), Modules Two and Three;
• GDPR Article 28 processor obligations;
• EU-US Data Privacy Framework certification;
• Subprocessor governance with 30-day notice for new subprocessors.

8.3 Data Flow Architecture

User → Legalica Platform (application layer)
         ↓
    Google Cloud Platform (infrastructure layer)
         ↓
    ├─ Cloud Firestore (database)
    ├─ Firebase Auth (authentication)
    ├─ Cloud Storage (files)
    ├─ Cloud Functions (processing)
    └─ Vertex AI / Third-Party LLMs (AI inference)

8.4 Data Location and Residency:

• Primary data center: Google Cloud europe-west3 (Frankfurt, Germany)
• Backup/DR location: Google Cloud europe-west2 (London, UK)
• AI inference: Processed via a multi-provider AI Cascade (Google Gemini → Moonshot AI/Kimi → Groq/Meta Llama → Ollama). EU-based providers are preferred; US-based providers operate under SCC 2021/914 and zero-data retention agreements. Ollama runs locally within the application layer with no external data transfer.
• Users may request Swiss or US data residency for Enterprise accounts.

8.5 Google's Limitations: Per the Google Cloud Terms of Service: (a) Google has no obligation to assess Customer Data for legal compliance; (b) Google's notification of a Data Incident is not an acknowledgment of fault; (c) Google disclaims warranties and limits liability per its own terms; (d) Google may process data in any country where it maintains facilities unless a data location commitment is in place.

Legalica has configured all primary data storage and processing within the EU (europe-west3). However, certain Third-Party LLM API calls may route to US-based endpoints. Such transfers are protected by SCC 2021/914 and the EU-US Data Privacy Framework.

9. INTERNATIONAL DATA TRANSFERS

9.1 EU Transfers: All intra-EU transfers are permitted under GDPR Chapter V without additional safeguards.

9.2 Transfers to Third Countries (Non-EU): Transfers to the United States and other third countries are conducted via:

9.3 Transfer Impact Assessment (TIA): Legalica has conducted a TIA for all third-country transfers. A summary is available upon request at dpo@legalica.app.

9.4 Government Access: If Legalica or Google receives a government access request: (a) we will notify you unless prohibited by law; (b) we will challenge the request if grounds exist; (c) we will disclose only the minimum required by law.

10. PROCESSING DETAILS (GDPR ARTICLE 28)

10.1 Subject Matter: Processing of Personal Data submitted by Controller and Authorized Users through the Platform.

10.2 Duration: Duration of Controller's Platform use plus applicable retention periods.

10.3 Nature and Purpose:

10.4 Controller Warranties: Controller warrants: (a) all necessary consents obtained; (b) appropriate notices provided to Data Subjects; (c) no violation of Applicable Law; (d) no submission of Personal Data in violation of data protection obligations.

11. PROCESSOR OBLIGATIONS

11.1 Documented Instructions: Legalica processes Personal Data only on documented instructions from the Controller, unless required by Union or Member State law.

11.2 Confidentiality: All persons authorized to process Personal Data are bound by confidentiality obligations.

11.3 Security Measures:

11.4 Subprocessor Engagement: Legalica may engage subprocessors per Section 15. At least 14 days' notice for new subprocessors. Remains fully liable for subprocessor performance.

11.5 Data Subject Rights Assistance: Legalica assists Controller in responding to Data Subject rights requests under GDPR Chapter III.

11.6 Compliance Assistance: Legalica assists Controller with: Art. 32 (security), Art. 33 (breach notification), Art. 34 (communication), Art. 35 (DPIA), Art. 36 (prior consultation).

11.7 Return or Deletion: Upon termination, Legalica will delete or return all Personal Data per Controller's choice, unless storage is required by law.

11.8 Audit Rights: (a) Once per calendar year upon 30 days' notice; (b) additional audits after a breach, material non-compliance, or supervisory authority order; (c) audit scope limited to systems relevant to Controller's data; (d) Legalica cooperates and provides access.

11.9 Documentation: Legalica makes available all information necessary to demonstrate compliance with Art. 28 GDPR.

12. AI ACT PROCESSOR OBLIGATIONS

Legalica ensures AI processing activities comply with:

• (a) Art. 50 (Transparency): Necessary documentation regarding AI system transparency provided;
• (b) Art. 52 (GPAI obligations): Compliance with applicable obligations for general-purpose AI models;
• (c) Art. 10 (Data governance): Appropriate data governance where high-risk AI systems are applicable;
• (d) Art. 14 (Human oversight): Meaningful human oversight maintained;
• (e) DPIA support: Documentation and assistance for DPIAs involving AI processing, including assessments of automated decision-making risks, algorithmic bias, and data subject rights.

13. DATA BREACH NOTIFICATION

14. NO-TRAINING COVENANT

15. SUBPROCESSORS AND INFRASTRUCTURE CHAIN

15.1 Current Subprocessors:

15.2 Infrastructure Chain Disclosure

Full processing chain for a typical user query:

1. User submits query → Legalica application (Firebase Cloud Functions, us-central1)
2. Authentication check → Firebase Authentication (Google, EU)
3. Data retrieval → Cloud Firestore (Google, EU)
4. AI processing → AI Cascade: Gemini → Kimi/Moonshot → Groq/Llama → Ollama (local)
   Each provider queried sequentially; fallback on failure. Zero-data retention enforced.
5. Response storage → Cloud Firestore (Google, EU)
6. Document attachment → Cloud Storage (Google, EU)
7. Email notification → Postmark / SendGrid (US, if enabled)

15.3 Subprocessor Changes: At least 14 days' advance notice for new subprocessors (30 days for Infrastructure Provider changes). Objections may be raised to dpo@legalica.app. If unresolved, Controller may terminate with pro-rata refund.

16. STANDARD CONTRACTUAL CLAUSES

16.1 Incorporation: EU SCC 2021/914 are incorporated by reference:

• Module Two: Controller to Processor
• Module Three: Processor to Subprocessor

16.2 SCC Specifications:

16.3 Annexes:

• Annex I.A (Parties): Data Exporter: [Customer]; Data Importer: [...] OÜ
• Annex I.B (Processing): As described in Section 10
• Annex I.C (Supervisory authority): Andmekaitse Inspektsioon
• Annex II (Security measures): As described in Section 11.3
• Annex III (Subprocessors): As described in Section 15

17. COOKIE TYPES AND PURPOSES

17.1 Strictly Necessary (Essential): Cannot be disabled. No consent required.

17.2 Performance & Analytics: Consent required. Disabled by default.

Note: Google Analytics runs with IP anonymization.

17.3 Functionality: Consent required. Disabled by default.

17.4 Targeting & Marketing: Consent required. Disabled by default.

18. CONSENT MANAGEMENT

19. FIRST-PARTY VS. THIRD-PARTY COOKIES

20. RETENTION SCHEDULE

20.1 Account Information

20.2 User Input and AI Output

20.3 Corporate Intelligence

20.4 Google Workspace Data

All synced data retained only during active sync period. Deleted upon Google Workspace disconnect or account deletion.

20.5 Payment and Billing

20.6 Logs and Analytics

21. DELETION PROCEDURES

21.1 User-Initiated Deletion: Individual documents and conversations deleted immediately upon user action.

21.2 Account Deletion:

21.3 Automated Deletion: Session data: immediately after session ends; Cached data: per TTL (typically 30 days); Expired tokens: upon expiration; Orphaned files: 30 days after parent deletion.

21.4 Legal Holds: Data may be retained beyond standard periods for: litigation hold, court order, legal claims, regulatory audit.

22. USER RIGHTS

22.1 GDPR Rights:

Response time: 30 days (extendable to 60 for complex requests). Identity verification required before processing.

22.2 Rights Under Other Jurisdictions:

23. BANNER TEXTS AND SETTINGS PANEL

23.1 Primary Banner (Default):

• Title: We Use Cookies
• Body: We use cookies to provide and improve our services, analyze usage, and enhance your experience. Essential cookies are always active. You can customize your preferences or accept all cookies.
• CTAs: [Accept All] [Customize] [Essential Only]
• Footer: [Cookie Policy] [Privacy Policy]

23.2 Detailed Banner (Alternative):

• Title: Your Privacy Matters
• Body: Legalica uses cookies for essential functions, analytics, preferences, and (with consent) marketing. You choose which categories you accept. Read our Cookie Policy for details.
• CTAs: [Accept All] [Customize Preferences] [Reject Non-Essential]

23.3 Settings Panel Title: Cookie Preferences — Manage your cookie consent preferences

23.4 Category Descriptions for Panel:

• Essential: "These cookies are necessary for the website to function and cannot be switched off. They are set in response to actions you take, such as logging in or setting privacy preferences." [Toggle: ON, disabled]
• Performance & Analytics: "These cookies help us understand how visitors interact with our website by collecting and reporting information anonymously. All information is aggregated." [Toggle: OFF by default]
• Functionality: "These cookies enable enhanced functionality and personalization, such as remembering your language preference and theme." [Toggle: OFF by default]
• Targeting & Marketing: "These cookies may be set by our advertising partners to build a profile of your interests and show you relevant ads on other sites." [Toggle: OFF by default]

23.5 Consent Confirmation Messages:

• Accept All: "Thank you! All cookies have been accepted. You can change your preferences at any time through Cookie Settings."
• Essential Only: "Your preferences have been saved. Only essential cookies are active. You can change this at any time."
• Custom Saved: "Your cookie preferences have been saved successfully."

23.6 DNT Response: "We have detected that your browser has 'Do Not Track' enabled. We respect this preference and have automatically disabled non-essential cookies. You can manually adjust below."