Privacy Policy

Last Updated: September 18, 2026

This Privacy Policy explains how we collect and use personal data when you access or use our websites and services, including Augment.hr, KPD2025, Eulex.ai and any related domains, subdomains, applications, and pages we operate (together, the “Services”).

1. Professional use only

Our Services are designed for professional users (e.g., legal professionals) acting in a business or professional capacity. They are not intended for consumers in a consumer capacity and are not intended for children.

We do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data to us, please contact us and we will take appropriate steps to delete it.

2. Roles: Controller and Processor

2.1 When we act as a Controller

We act as a data controller for personal data we process for our own purposes, such as:

operating, maintaining, and securing the Services (including our websites);
administering invitation / beta access;
providing customer support where you contact us directly;
improving the Services through analytics and diagnostics (where applicable); and
complying with legal obligations and protecting our legal rights.

2.2 When we act as a Processor (Customer Tenant Data)

Where an organisation (e.g., your employer) provides you access to the Services, we process personal data within that organisation’s tenant on the organisation’s instructions (including account and profile data within the tenant, usage data, prompts, documents, and outputs) (“Customer Content”). In those cases, the organisation is the controller and we are the processor, and the organisation’s agreement with us (including any data processing terms such as a Data Processing Addendum) governs that processing.

If you submit a data subject request relating to Customer Content where we act as processor, we may refer you to the relevant controller and/or forward your request as appropriate.

3. Personal data we collect

3.1 Data you provide

Invitation / access request data (e.g., via “request invite” forms):

first name, last name, organisation, email address, position/title (used to validate professional eligibility and administer invite access).

Account and profile data (within a customer tenant):

name, email address, organisation, position/title;
account credentials (or authentication tokens if you use single sign-on).

Application and AI interaction data (within a customer tenant):

prompts and queries you submit;
documents/files you upload for analysis or drafting;
generated outputs;
ratings/feedback on outputs (where enabled);
timestamps and internal user identifiers.

Communications:

information you provide when you contact us (e.g., email content and metadata).

Please avoid submitting special category data (e.g., health data, biometric data, political opinions) and avoid uploading confidential third-party information unless you have a lawful basis and it is strictly necessary for your intended use. Where appropriate, we may remove, restrict, or delete such content for compliance and safety.

3.1.1 Contact forms (informational sites)

On informational sites (e.g., augment.hr), if you submit a contact form, we collect:

name and email address (to respond to your enquiry);
message content;
timestamp and IP address (for security).

This data is used solely to respond to your enquiry and is retained for 90 days, unless ongoing correspondence requires longer retention.

3.2 Data we collect automatically

Technical and log data:

IP address, user agent, device and browser information, and request logs;
IP address at registration and IP address of the most recent login.

Usage and diagnostic data:

feature usage and performance metrics, to keep the Services functioning, secure, and to improve reliability.

Cookies and similar technologies:

essential cookies required for sign-in/session management and core functionality;
analytics cookies on our application and certain other websites (where enabled by your preferences). Our marketing website (eulex.ai) does not use analytics cookies — see Section 12.

4. Single sign-on

If you choose to sign in using third-party identity providers (such as Google or LinkedIn), we receive personal data from them such as your name and email address, and any other information you authorise via the provider permissions (scopes). You can usually control what is shared via your provider account settings.

5. How we use personal data

We use personal data to:

provide and operate the Services, including account creation, authentication, and delivering requested functionality such as research responses, document drafting, and document analysis;
administer invitation/beta access and verify professional eligibility where relevant;
maintain security, prevent abuse, and troubleshoot, including monitoring, fraud prevention, and service integrity;
improve and develop the Services, including product analytics, diagnostics, and performance optimisation (where applicable);
provide customer support and respond to enquiries; and
comply with legal obligations and protect legal rights (e.g., enforcing terms, handling claims, responding to lawful requests).

We do not sell personal data. We do not use personal data for consumer advertising profiling.

We rely on the following legal bases under the GDPR (as applicable):

Performance of a contract (Article 6(1)(b)): to provide the Services under our Terms of Service and manage your account.
Legitimate interests (Article 6(1)(f)): to secure the Services, prevent abuse, administer invite access, improve functionality, and communicate regarding service matters.
Consent (Article 6(1)(a)): where required for non-essential cookies and where we send marketing communications (if applicable).
Legal obligation (Article 6(1)(c)): where we must retain or disclose data to comply with law.

Where we rely on legitimate interests, you may object as described in Section 11.

7.1 Service providers (processors)

We use third-party service providers to help us operate the Services, such as:

cloud hosting and infrastructure providers;
email and communications providers (business email and transactional/system email delivery);
analytics and monitoring providers (to understand usage and improve performance);
privacy-first website analytics (aggregated, cookieless statistics for our marketing website);
security, CDN, and DDoS/WAF providers (to protect the Services and users);
external AI model providers (to process prompts and generate outputs as described in Section 8); and
web retrieval providers (to retrieve public web results, when enabled, as described in Section 8).

These providers process personal data on our instructions and are required to protect it.

A list of our current subprocessors is available at: https://eulex.ai/legal/subprocessors.

7.2 Legal and safety disclosures

We may disclose personal data if required by law, regulation, court order, or where necessary to protect our rights, users, and the security of the Services.

8. AI processing and external providers

8.1 AI processing

Our application uses external AI providers to:

generate answers and drafts from your prompts and uploads; and/or
analyse documents you submit.

We take steps to minimise personal data where feasible and may apply anonymisation/pseudonymisation when appropriate. We apply contractual and technical controls intended to limit how external providers process Customer Content, including using available configuration options designed to reduce retention and restrict training where applicable.

You are responsible for ensuring you have appropriate rights and lawful basis to submit any personal data contained in prompts or documents, particularly where that data relates to third parties.

8.2 Web retrieval (Prompt Navigator)

The Services may automatically determine, based on the user’s prompt, whether web retrieval would be useful. Before any web search request is sent to a web retrieval provider, the user is presented with a toggle in Prompt Navigator and may disable web search. When disabled, no web retrieval requests are sent.

When web search is enabled, we send only an AI-revised and summarized query derived from the prompt and designed to remove personal data where feasible prior to transmission.

8.3 Prompt logging (Quality Assurance, if enabled)

Where a user enables “prompt logging” in their profile or account settings, we store prompt/output logs for quality assurance and troubleshooting, under strict internal access controls. If prompt logging is disabled, we do not store such prompt/output logs.

Prompt/output logs are retained for 30 days and automatically deleted thereafter, unless longer retention is required to investigate security incidents, prevent abuse, or comply with law.

8.4 MCP connector (AI assistant integrations)

We offer a Model Context Protocol (“MCP”) connector that lets you use Eulex legal research tools from third-party AI assistants that support MCP (for example Claude, ChatGPT, or Microsoft Copilot).

When you connect Eulex to an AI assistant via the MCP connector:

Authentication. You sign in with your Eulex account. We process your account identity (email address, user identifier, subscription tier) to authorise the connection and issue access tokens. Authentication is provided through our identity subprocessor (see the Subprocessor List).
Queries and tool calls. The AI assistant sends search queries and tool requests to our servers on your behalf. We process this content to return results from our legal databases. Depending on the feature, queries may be processed by the AI and search subprocessors listed in the Subprocessor List (for example, embedding, vector search, or semantic reranking providers).
What we do not access. The MCP connector only receives the tool requests the AI assistant sends to it. We do not receive or access your wider conversation history, memory, or files held by the AI assistant provider.
Usage accounting and logs. We maintain MCP usage counters to enforce account allowances. We keep operational logs of MCP requests (timestamps, tool names, request identifiers, account identifier, and error information) for service operation, security, and rate-limiting purposes, retained in line with the server-log retention periods in Section 10.
The assistant provider is a separate controller. Your use of the AI assistant itself (Claude, ChatGPT, Copilot, or another MCP client) is governed by that provider’s own terms and privacy policy.

You may disconnect the MCP connector at any time in the AI assistant’s settings, and you may revoke issued tokens by contacting us or, where available, from your account settings.

9. International transfers

We aim to store and process data in the European Economic Area (EEA). Some service providers may process personal data outside the EEA depending on their infrastructure and the nature of the service (for example, certain web retrieval, analytics, monitoring, or security services).

Where personal data is transferred internationally, we implement appropriate safeguards, which may include:

Standard Contractual Clauses (SCCs);
reliance on an adequacy decision where applicable; and/or
additional technical and organisational measures.

10. Data retention

We retain personal data only as long as necessary for the purposes described in this Policy, unless a longer period is required by law.

Indicative retention periods:

Customer tenant data (where we act as Processor): retained for the duration of the customer service relationship. Upon termination or expiry for a customer account, we delete or return Customer Personal Data in accordance with the applicable data processing terms (generally within 30 days), unless retention is required by law.
Prompt logging (if enabled): 30 days, then automatic deletion (see Section 8.3).
Server logs: typically 30 days.
Backups: retained for up to 90 days; deletion may be delayed until backups rotate.
Contact form enquiries (informational sites): 90 days unless ongoing correspondence requires longer retention.
Business communications and contractual records: retained in accordance with our record-keeping needs and legal obligations, and as necessary to establish, exercise, or defend legal claims.
Invoice/billing data (if/when applicable): retained as required by applicable accounting and tax laws.

Subject to applicable law, you may have the right to:

access your personal data;
rectify inaccurate or incomplete data;
erase your personal data;
restrict processing;
data portability;
object to processing (including where based on legitimate interests);
withdraw consent (where processing is based on consent).

How to exercise your rights: contact us at [email protected].

Identity verification: we may request reasonable information to verify your identity.

Response times: we aim to respond within 30 days; in complex cases we may extend to 60 days where permitted by law. We generally provide information through the same channel your request was received, unless agreed otherwise.

You also have the right to lodge a complaint with a supervisory authority.

12. Cookies

Marketing website (eulex.ai). Our public marketing website uses Simple Analytics, a privacy-first analytics provider. Simple Analytics sets no cookies, does not store IP addresses, and does not collect personal data or track individual visitors — it records only aggregated, anonymous statistics (such as page views, referrers, and country-level information). Because this involves no cookies, no storage of or access to information on your device, and no processing of personal data, it does not require consent, and we do not display a cookie banner on the marketing website. Analytics data is processed within the European Union. The cookie-based analytics and the cookie preferences tool described below apply to our application and certain other websites, not to the marketing website.

On our application and certain other websites, we use cookies and similar technologies to:

enable core functionality (e.g., sign-in/session cookies);
remember preferences; and
run analytics (where enabled).

We provide a cookie preferences tool/banner where you can accept or reject non-essential cookies (such as analytics). You can also manage cookies through your browser settings. Disabling certain cookies may affect functionality.

13. Payments

If you use a paid plan, payments are handled by a third-party payment processor, such as Stripe. We process billing and subscription information needed to administer your account and meet accounting obligations. We do not store full payment card details.

The MCP connector provides access under your existing account. It does not initiate purchases or subscriptions, collect payment details, or direct users to checkout or subscription upgrades. MCP usage counters and operational logs are processed as described in Sections 8.4 and 10.

14. Security

We implement appropriate technical and organisational measures designed to protect personal data, including (as appropriate):

encryption in transit and at rest;
multi-factor authentication (MFA) for administrative access;
segregation of environments and databases;
access controls and logging.

We maintain incident response procedures and will notify relevant parties and authorities where required by law.

15. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will post the updated version and update the “Last updated” date above.

16. Contact

Privacy contact: [email protected]

Security contact: [email protected]