Effective: June 27, 2026 · Version 1.2 · Data Controller: Klause AI
Klause AI ("we", "us", "our") operates klauseai.com and the AI-powered legal document analysis platform accessible from it (the "Service").
For GDPR / UK GDPR purposes, Klause AI is the data controller.
For CCPA/CPRA purposes, Klause AI is the business.
For Brazil LGPD purposes, Klause AI is the controlador.
General enquiries: hello@klauseai.com
Privacy / GDPR: privacy@klauseai.com
Data Protection Officer: dpo@klauseai.com
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Email address | Authentication, product emails | Contract Art. 6(1)(b) | Until account deletion |
| Password hash (encrypted) | Authentication | Contract Art. 6(1)(b) | Until account deletion |
| Subscription status | Feature gating (Free/Pro/Business) | Contract Art. 6(1)(b) | Until account deletion |
| Stripe customer ID | Payment linkage | Contract Art. 6(1)(b) | 7 years (tax law) |
| Analysis history (Pro) | Dashboard — view past analyses | Legitimate interest Art. 6(1)(f) | Until deleted by user |
| Marketing consent flag | Product update emails | Consent Art. 6(1)(a) | Until withdrawn |
When you submit a document, the following data flow occurs:
Important: On free-tier AI models, some underlying providers may use API inputs to improve their models — this is standard practice for free-tier AI. Pro tier uses commercial models under strict data-processing agreements that prohibit training on your data.
Uploaded files (Pro): PDF and DOCX files are stored temporarily on Vercel Blob storage (encrypted at rest) and automatically deleted within 24 hours.
| Service | Purpose | Data shared |
|---|---|---|
| Vercel | Hosting, serverless functions, file storage | All web traffic; uploaded files (temporary) |
| Supabase | Database and authentication | Email, subscription status |
| Stripe | Payment processing | Email, payment amount, billing country. Card data never reaches us. |
| OpenRouter | AI model routing and inference | Document text (for analysis only — see Section 3) |
| Upstash Redis | Rate limiting | Hashed IP address; usage counter only |
| Resend | Transactional email | Email address only |
| Vercel Analytics | Anonymized page metrics | Page URL, country. No personal data. No cross-site tracking. |
We do not sell your data. We do not share it for advertising. All processors are bound by Data Processing Agreements (DPAs) under GDPR Article 28 where required.
Personal data of EEA/UK residents may be transferred to the US when processed by Vercel, Supabase, Stripe, or OpenRouter. Transfers are safeguarded by:
For questions about data residency options for enterprise customers, contact privacy@klauseai.com.
| Data type | Retention period | Reason |
|---|---|---|
| Contract / document text | Zero — never stored | Privacy by design |
| Uploaded files (Pro) | 24 hours maximum | Vercel Blob auto-deletion |
| Hashed IP / usage counter | 24 hours | Rate limiting only |
| Account data (email, status) | Until account deletion + 30 days | Operational necessity |
| Analysis history (Pro) | Until deleted by user or account closure | Service feature |
| Financial / payment records | 7 years | Legal / tax obligation |
| Marketing consent records | Until withdrawn + 6 months | Compliance evidence |
| Support correspondence | 3 years | Dispute resolution |
To exercise any right, email privacy@klauseai.com. We respond within 30 days (GDPR/UK GDPR) or 45 days (CCPA).
Request a copy of all personal data we hold about you (Subject Access Request).
Request correction of inaccurate or incomplete personal data.
Request deletion of your personal data, subject to legal retention obligations.
Receive your data in a structured, machine-readable format (JSON/CSV).
Object to processing based on legitimate interests or for direct marketing.
Limit how we use your data while a dispute is resolved.
Withdraw marketing or analytics consent at any time without affecting prior lawful processing.
Lodge a complaint with your national supervisory authority (ICO, CNIL, BfDI, etc.).
California residents have rights to: know what data is collected, delete personal information, opt-out of sale (we do not sell data), correct inaccurate information, and limit use of sensitive personal information. We do not discriminate for exercising CCPA rights. Submit requests to privacy@klauseai.com.
Categories collected: Identifiers (email); Internet activity (page views, usage count); Commercial information (subscription, payment records). No sensitive personal information per CPRA §1798.121.
UK residents' rights are as described in Section 8. Complaints to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.
Brazilian users have rights to: confirmation of processing, access, correction, anonymization/blocking/deletion, portability, information about sharing, and review of automated decisions. Our LGPD officer: dpo@klauseai.com. Complaints to the ANPD.
UAE users have the right to access, correct, and delete personal data. Requests to privacy@klauseai.com.
We comply with Australian Privacy Principles 1, 3, 6, 11, and 12. Complaints to the OAIC at oaic.gov.au.
We collect, use, and disclose personal information only with your knowledge and consent. Access and correction requests to privacy@klauseai.com. Complaints to the Office of the Privacy Commissioner of Canada.
German users benefit from GDPR and BDSG protections. EU representative for GDPR: dpo@klauseai.com. Complaints to your state Datenschutzbehörde.
Klause AI is not directed to children. We do not knowingly collect data from anyone under 16 (EU), 13 (US/UK), or 18 (UAE). If you believe a child has provided data, contact privacy@klauseai.com immediately for prompt deletion.
Material changes will be communicated by email to registered users at least 14 days before taking effect, and by a notice on klauseai.com for 30 days. Continued use after changes constitutes acceptance.
Data Controller: Klause AI
General: hello@klauseai.com
Privacy / GDPR requests: privacy@klauseai.com
Data Protection Officer: dpo@klauseai.com
Response time: 5 business days (target) · 30 days (statutory maximum)
Supervisory authorities: ICO (UK) · Your national DPA (EU) · FTC (US) · OAIC (Australia) · OPC (Canada) · ANPD (Brazil)