Legalica Privacy Policy & Data Protection

1. INTRODUCTION AND LEGAL FRAMEWORK

Legalica OÜ ("Legalica," "we," "us," or "our") processes personal data in accordance with this Privacy Policy and Data Governance document ("Policy").

1.1 Applicable Legal Framework

This Policy is designed with reference to the following regulations and frameworks:

1.2 Scope Across 324 Jurisdictions

Legalica operates across 324 jurisdictions and 187+ languages. While this Policy is designed for global compliance, the GDPR serves as the baseline standard for all processing activities. Where local laws provide stronger protections, those stronger protections apply. Users in all Supported Jurisdictions retain the rights granted by their local data protection laws, even if such rights exceed those described herein.

2. DATA CONTROLLER INFORMATION

2.1 Controller Identity

2.2 Data Protection Contact

Legalica has assessed the appointment criteria of Art. 37 GDPR and has not formally appointed a Data Protection Officer at this stage; data-protection inquiries are handled centrally at the address above. This page will be updated if a DPO is appointed.

2.3 Lead Supervisory Authority

Rationale for Estonian Lead Authority: Legalica's main establishment is in Estonia. Under GDPR Article 56, the supervisory authority of the main establishment serves as the lead authority for cross-border processing. Data subjects in all EU Member States may lodge complaints with the Estonian DPA or their local supervisory authority.

2.4 EU Establishment

Legalica OÜ is established in the European Union (Republic of Estonia). No representative under GDPR Art. 27 is required, as Art. 27 applies only to controllers and processors not established in the Union.

3. CATEGORIES OF PERSONAL DATA COLLECTED

4. COLLECTION METHODS

5. LEGAL BASIS FOR PROCESSING

Legitimate Interests Assessment (LIA): Available upon request at privacy@legalica.app. We have conducted balancing tests ensuring our legitimate interests do not override your fundamental rights.

6. PURPOSES OF PROCESSING

6.1 Primary Purposes

• Platform Services: Authentication, query processing, AI response generation, document drafting, KYC/UBO tools, Google Workspace sync;
• Subscription Administration: Activation and management of paid access based on purchase confirmations from the Merchant of Record; refund handling;
• Security: Unauthorized access monitoring, fraud detection, integrity maintenance;
• Support: Inquiry response, troubleshooting, onboarding;
• Communication: Essential service notifications, marketing (with consent only);
• Legal Compliance: Tax/accounting records, legal request response, Terms enforcement;
• Platform Improvement: Anonymized usage pattern analysis only.

6.2 What We Do NOT Do

• Use your data to train any AI models (contractually prohibited across the entire AI Cascade);
• Sell your data to any third party;
• Use your data for advertising profiling;
• Share data with third parties for their marketing;
• Use advertising cookies or marketing pixels (e.g., Meta Pixel, Google Ads tags) — we do not operate any;
• Automated decision-making producing legal or similarly significant effects (GDPR Art. 22).

7. ROLE: CONTROLLER VS. PROCESSOR

8. GOOGLE CLOUD INFRASTRUCTURE AND DATA PROCESSING

8.1 Infrastructure Provider as Key Subprocessor: Google LLC is Legalica's primary Infrastructure Provider and subprocessor. All Customer Data is stored, processed, and transmitted through Google Cloud Platform services. The following Google services process Customer Data:

8.2 Google's Role and Obligations: Google LLC processes Customer Data under the Google Cloud Data Processing Addendum (cloud.google.com/terms/data-processing-addendum), which incorporates:

• EU Standard Contractual Clauses (2021/914), Modules Two and Three;
• GDPR Article 28 processor obligations;
• EU-US Data Privacy Framework certification;
• Subprocessor governance with 30-day notice for new subprocessors.

8.3 Data Flow Architecture

User → Legalica Platform (application layer)
         ↓
    Google Cloud Platform (infrastructure layer)
         ↓
    ├─ Cloud Firestore (database — EU)
    ├─ Firebase Auth (authentication — EU)
    ├─ Cloud Storage (files — EU)
    ├─ Cloud Functions (transient compute — us-central1)
    └─ Vertex AI / Third-Party LLMs (AI inference)

8.4 Data Location and Residency:

• Primary data location: Google Cloud europe-west3 (Frankfurt, Germany) — all persistent storage;
• Serverless compute: Cloud Functions execute transiently in us-central1 (Iowa, USA); no Customer Data is persisted there (see Section 3.7 of the Terms of Service);
• AI inference: processed via a multi-provider AI Cascade (Google Vertex AI/Gemini → Moonshot AI/Kimi → Groq/Meta Llama → local models via Ollama). EU-based processing is used for the primary provider; fallback providers in the US and China operate under the transfer mechanisms in Section 9 and zero-data-retention terms. Locally executed models involve no external data transfer at all;
• An automated cross-region backup is planned but not yet implemented; see Section 11.7 of the Terms of Service.

8.5 Google's Limitations: Per the Google Cloud Terms of Service: (a) Google has no obligation to assess Customer Data for legal compliance; (b) Google's notification of a Data Incident is not an acknowledgment of fault; (c) Google disclaims warranties and limits liability per its own terms; (d) Google may process data in any country where it maintains facilities unless a data location commitment is in place.

Legalica has configured all persistent data storage within the EU (europe-west3). Transient compute and certain Third-Party LLM API calls route to endpoints outside the EU; such transfers are protected as described in Section 9.

9. INTERNATIONAL DATA TRANSFERS

9.1 EU Transfers: All intra-EU transfers are permitted under GDPR Chapter V without additional safeguards.

9.2 Transfers to Third Countries (Non-EU): Transfers to the United States, China, and other third countries are conducted via:

9.3 Transfers to China (Moonshot AI): When the primary and secondary cascade routes are unavailable, User Input may be processed by Moonshot AI (Beijing Moonshot AI Technology Co., Ltd.) on servers outside the EU. This transfer relies on transient-processing (zero-retention) terms and a contractual no-training prohibition; execution of the EU Standard Contractual Clauses (2021/914) and finalization of the supporting Transfer Impact Assessment are in progress and are tracked for completion before this fallback route is relied upon in production. Only the prompt and minimal context necessary for the response are transmitted. Users and Enterprise customers who prefer EU-only processing may request EU-only cascade routing (which disables the China fallback) via privacy@legalica.app.

9.4 Transfer Impact Assessment (TIA): Legalica has conducted a TIA for third-country transfers. A summary is available upon request at privacy@legalica.app.

9.5 Government Access: If Legalica or a subprocessor receives a government access request: (a) we will notify you unless prohibited by law; (b) we will challenge the request if grounds exist; (c) we will disclose only the minimum required by law.

10. PROCESSING DETAILS (GDPR ARTICLE 28)

10.1 Subject Matter: Processing of Personal Data submitted by Controller and Authorized Users through the Platform.

10.2 Duration: Duration of Controller's Platform use plus applicable retention periods.

10.3 Nature and Purpose:

10.4 Controller Warranties: Controller warrants: (a) all necessary consents obtained; (b) appropriate notices provided to Data Subjects; (c) no violation of Applicable Law; (d) no submission of Personal Data in violation of data protection obligations.

11. PROCESSOR OBLIGATIONS

11.1 Documented Instructions: Legalica processes Personal Data only on documented instructions from the Controller, unless required by Union or Member State law.

11.2 Confidentiality: All persons authorized to process Personal Data are bound by confidentiality obligations.

11.3 Security Measures:

11.4 Subprocessor Engagement: Legalica may engage subprocessors per Section 15. At least 14 days' notice for new subprocessors. Legalica remains fully liable for subprocessor performance.

11.5 Data Subject Rights Assistance: Legalica assists Controller in responding to Data Subject rights requests under GDPR Chapter III.

11.6 Compliance Assistance: Legalica assists Controller with: Art. 32 (security), Art. 33 (breach notification), Art. 34 (communication), Art. 35 (DPIA), Art. 36 (prior consultation).

11.7 Return or Deletion: Upon termination, Legalica will delete or return all Personal Data per Controller's choice, unless storage is required by law.

11.8 Audit Rights: (a) Once per calendar year upon 30 days' notice; (b) additional audits after a breach, material non-compliance, or supervisory authority order; (c) audit scope limited to systems relevant to Controller's data; (d) Legalica cooperates and provides access.

11.9 Documentation: Legalica makes available all information necessary to demonstrate compliance with Art. 28 GDPR.

12. AI ACT TRANSPARENCY OBLIGATIONS

Legalica is a deployer of general-purpose AI (GPAI) models within the meaning of Regulation (EU) 2024/1689 (AI Act). Legalica ensures its AI-related processing complies with:

• (a) Art. 50 (Transparency): users are informed that they interact with an AI system (the Platform is expressly presented and operated as an AI system), and AI-generated documents exported from the Platform carry an AI-content notice;
• (b) Arts. 53–55 (GPAI obligations): these obligations rest with the providers of the underlying models (Google, Moonshot AI, Groq/Meta, open-source model authors), not with Legalica as deployer;
• (c) Human oversight by design: every AI Output is subject to user review; nothing is auto-filed or auto-sent;
• (d) DPIA support: documentation and assistance for DPIAs involving AI processing, including assessments of automated decision-making risks, algorithmic bias, and data subject rights.

13. DATA BREACH NOTIFICATION

14. NO-TRAINING COVENANT

15. SUBPROCESSORS AND INFRASTRUCTURE CHAIN

15.1 Current Subprocessors: The current list of subprocessors is maintained on the Subprocessors page, which forms part of this Policy. Summary:

Note — payments: Creem (Armitage Labs OÜ, Estonia), our Merchant of Record, is not a subprocessor: it processes buyer payment data as an independent controller (see Section 7.4) and is therefore listed separately, not in the subprocessor table above.

15.2 Infrastructure Chain Disclosure

Full processing chain for a typical user query:

1. User submits query → Legalica application (Cloud Functions, us-central1 — transient)
2. Authentication check → Firebase Authentication (Google, EU)
3. Data retrieval → Cloud Firestore (Google, EU)
4. AI processing → AI Cascade: Vertex AI/Gemini (EU) → Kimi/Moonshot (China) → Groq/Llama (US) → Ollama (local)
   Each provider queried sequentially; fallback on failure. Zero-data retention enforced.
5. Response storage → Cloud Firestore (Google, EU)
6. Document attachment → Cloud Storage (Google, EU)
7. Purchase/payment → Creem checkout (Merchant of Record, independent controller)

15.3 Subprocessor Changes: At least 14 days' advance notice for new subprocessors (30 days for Infrastructure Provider changes). Objections may be raised to privacy@legalica.app. If unresolved, Controller may terminate with pro-rata refund.

16. STANDARD CONTRACTUAL CLAUSES

16.1 Incorporation: Where Customer Data is transferred to a third country without an adequacy decision, EU SCC 2021/914 are incorporated by reference:

• Module Two: Controller to Processor
• Module Three: Processor to Subprocessor

16.2 SCC Specifications:

16.3 Annexes:

• Annex I.A (Parties): Data Exporter: [Customer]; Data Importer: Legalica OÜ
• Annex I.B (Processing): As described in Section 10
• Annex I.C (Supervisory authority): Andmekaitse Inspektsioon
• Annex II (Security measures): As described in Section 11.3
• Annex III (Subprocessors): As described in Section 15 and on the Subprocessors page

17. COOKIE TYPES AND PURPOSES

Legalica uses a minimal set of cookies and similar technologies. We do not use advertising cookies, marketing pixels, or cross-site tracking technologies of any kind.

17.1 Strictly Necessary (Essential): Cannot be disabled. No consent required (Directive 2002/58/EC, Art. 5(3) exemption).

17.2 Performance & Analytics: Consent required. Disabled by default until you accept.

Google Analytics is configured with IP anonymization and is used only for aggregate usage measurement (page views, session counts). The analytics cookies (_ga, _ga_*) are set only after you consent via the cookie banner. If you do not consent, no analytics cookies are set or read; Google may then receive only anonymous, cookieless "pings" (functional and aggregate, non-identifying information such as browser type and country) used to produce aggregate statistical modeling. Google Analytics data is not used for advertising, and no Google Ads, Google Signals, or remarketing features are enabled.

17.3 Functionality and Preferences: We do not use functionality cookies. Interface preferences (such as your language selection) are stored in your browser's local storage or in your account settings — not in cookies — and are not transmitted to third parties. Such storage is limited to what is strictly necessary to provide the service you request.

18. CONSENT MANAGEMENT

19. FIRST-PARTY VS. THIRD-PARTY COOKIES

20. RETENTION SCHEDULE

20.1 Account Information

20.2 User Input and AI Output

20.3 Corporate Intelligence

20.4 Google Workspace Data

All synced data retained only during active sync period. Deleted upon Google Workspace disconnect or account deletion.

20.5 Payment and Billing

20.6 Logs and Analytics

21. DELETION PROCEDURES

21.1 User-Initiated Deletion: Individual documents and conversations deleted immediately upon user action.

21.2 Account Deletion:

21.3 Automated Deletion: Session data: immediately after session ends; Cached data: per TTL (typically 30 days); Expired tokens: upon expiration; Orphaned files: 30 days after parent deletion.

21.4 Legal Holds: Data may be retained beyond standard periods for: litigation hold, court order, legal claims, regulatory audit.

22. USER RIGHTS

22.1 GDPR Rights:

Response time: one month (Art. 12(3) GDPR), extendable by two further months for complex or numerous requests, with notice. Identity verification required before processing.

22.2 Rights Under Other Jurisdictions:

23. BANNER TEXTS AND SETTINGS PANEL

23.1 Primary Banner (Default): The banner is a compact notice (open-source Klaro consent manager), themed in the Platform's neutral grey palette:

• Title: Cookies
• Body: "We use essential cookies to run the site and — with your consent — Google Analytics for aggregate statistics. If you decline, no analytics cookies are set and only anonymous, cookieless measurement applies. No advertising cookies." — followed by a link to this Policy
• CTAs (equal prominence): [Accept] [Reject] — plus a "Settings" link
• Link: Privacy Policy

23.2 Settings Panel Title: Cookie settings

23.3 Category Descriptions for Panel:

• Essential: Necessary for the website to function (authentication, security, consent record). Always active; cannot be switched off.
• Google Analytics: "Aggregate usage measurement (GA4) with IP anonymization. The _ga / _ga_* cookies are set only after your consent; without consent, no analytics cookies are set or read and only anonymous, cookieless pings apply. No advertising features (no Google Ads, no Google Signals, no remarketing)." [Toggle: OFF by default]

23.4 After Your Choice: The notice closes immediately and does not reappear for 365 days. You can change or withdraw your choice at any time via "Cookie Settings" in the footer — withdrawing is as easy as accepting (GDPR Art. 7(3)). On withdrawal, the analytics cookies are deleted automatically and Google is instructed to stop analytics storage.