1. Who is responsible
The controller for the personal data described here is Dober Security ApS, Silkeborgvej 43, 1., 8000 Aarhus C, Denmark, CVR 46829034. Write to privacy@gelex.eu about anything in this policy.
Data protection officer. Our corpus includes court decisions, some of which concern criminal offences (Art. 10 GDPR). Publishing them at scale is a core activity, so we treat Art. 37(1)(c) as requiring a data protection officer. We are in the process of appointing one; their name and contact will be published here. Until then, privacy@gelex.eu reaches the person responsible for data protection.
When your organisation uses Gelex, the questions, documents, matters, drafts and transcripts its members put into the service are processed on the organisation's behalf. For those the organisation is the controller and we are its processor, under the data processing agreement.
People named in the court decisions we publish: see the separate notice on personal data in judgments.
2. What we process, why, and on what basis
| Data | Why | Legal basis |
|---|---|---|
| Account: name, email, language, organisation and role, and your sign-in methods (passkey, password hash, authenticator app) | To give you an account and sign you in securely | Contract, Art. 6(1)(b) |
| Sign-in with Google or Microsoft, if you choose it: your name, email address and that provider's account identifier | To sign you in. Used for nothing else. | Contract, Art. 6(1)(b) |
| Usage metadata per request: who, when, which kind of tool, which corpus documents were read, jurisdictions, timing, token counts, outcome | To count usage against your plan, run the service, and show your organisation its usage | Contract, Art. 6(1)(b) |
| Audit log: security-relevant events (membership, role and key changes, "a question was asked" without its text, staff support access), with a hashed IP address | To keep the service and your organisation's account secure and accountable | Legitimate interest in security, Art. 6(1)(f) |
| Billing: organisation name, billing address, VAT number and its check against the EU VIES register, invoices, and overage owed for a usage period that closed before a billing country was set | To charge for paid plans, apply VAT correctly and keep accounts | Contract and legal obligation, Art. 6(1)(b) and (c) |
| Referrals: who referred which organisation, and whether it became a paying customer | To grant the referral credit | Contract, Art. 6(1)(b) |
| Quote requests: name, email, organisation and your message | To answer and prepare an offer | Steps before a contract, Art. 6(1)(b) |
| Cancellation and withdrawal requests (consumers) | To carry them out and prove that we did | Legal obligation, Art. 6(1)(c) |
| Notices about content (takedown or correction requests, objections): the notifier's name, email and statement | To handle the notice and answer it, as the Digital Services Act requires | Legal obligation, Art. 6(1)(c) |
| Email you send us | To answer you | Legitimate interest, Art. 6(1)(f) |
| Customer content: transcripts (only if your organisation turns them on), matters, drafts, uploaded documents, electronic signatures on drafts, documents sent for signing with each signer's name, email address, answer and the network address they signed from, the organisation's own templates and who wrote and approved them, which changes in the law were mailed to which member about a matter, and the keys that link the placeholders for people's names in a matter to those names, held apart from the AI | To provide the features your organisation uses | Processed for your organisation under the DPA |
What we do not store. Unless your organisation turns transcripts on, we never store the text of a question or an answer. The connected AI model receives the question and the source texts it needs to answer; we keep only the metadata above.
We do not train AI models on your data. We have no AI model of our own. Answers come from the model your organisation connects.
Google and Microsoft user data. When you sign in with Google or Microsoft, we receive only the data in the table row above. We use it only to create and sign in your account. We do not share it, use it for advertising, or use it to train models. Google and Microsoft act as independent controllers for their own sign-in.
3. The AI you connect
You choose the AI model that answers. If you connect one by API key, your questions and the source texts are sent to that provider under your own agreement with it. The provider is your processor, not ours, and its own privacy terms apply. If you use our MCP connector inside your own assistant, that assistant's provider receives what you type there, under its terms. See AI transparency.
4. Who receives data
A small number of processors help us run the service. They are listed, with their locations, on the subprocessors page. We do not sell personal data and do not share it for advertising. We disclose data to authorities only where the law requires it.
Our staff. Staff can open an organisation's account in the staff console only after a second-factor sign-in. To help with a support case, a staff member can look at the service as one of your members. That view is read-only, lasts 15 minutes by default and 30 at most, needs a stated reason, and is recorded in your organisation's own audit log.
5. Where data is stored
The service and its server backups are hosted by Hetzner in its Nuremberg data centre in Germany; the location of an off-site backup copy will be stated here once it is set up. Transactional email is sent through Migadu, a Swiss company. Switzerland is recognised by the European Commission as giving adequate protection. We use no US-owned cloud provider, and we do not transfer personal data outside the EU/EEA except to a country with such a decision.
6. How long we keep it
- Question, answer and source text: never stored, in the database or in logs, unless your organisation turns transcripts on.
- Transcripts: kept only while your organisation has them on. They are kept for the period it sets and then deleted; if it sets no period, they stay until it or you delete them. Turning transcripts off stops new ones from being saved; earlier ones stay until their period ends or they are deleted.
- Account data: while the account exists. Deleting your account erases your sign-in and pseudonymises what remains in usage and audit records.
- AI provider keys: deleted when the connection or organisation is removed; a replaced key is deleted at once.
- Data exports: generated when you ask, and never stored.
- Usage metadata: 24 months.
- Closed organisations: their content (matters, drafts, documents, transcripts, invitations, sessions and member links) is deleted 30 days after the organisation closes. So is the account of every member who belongs to no other organisation: their name, email and sign-in. Its invoices and audit log stay as stated here.
- Audit log: 5 years after the organisation is closed. It is kept to prove what happened on the account, and is not deleted with the rest of the organisation's data.
- Unfinished sign-in attempts: 24 hours. They hold no personal data beyond a return address in the app.
- Expired sessions and invitations: 90 days.
- Quote requests: 2 years. Content notices: 3 years after the decision. Consumer cancellation and withdrawal requests: 5 years.
- Server logs: 30 days. They never carry question text, and the web server keeps no access log.
- Invoices: 5 years after the end of the financial year, as the Danish Bookkeeping Act requires.
- Outgoing mail sent in the company's name: the address it went to, its subject and text, and why it was sent, kept in our outbox for 2 years after it was sent, rejected or failed; our email provider keeps delivery logs under its own policy.
- Backups: daily backups are kept for 30 days and month-end backups for 12 months. Data deleted from the service therefore disappears from backups within 12 months at most. Backups are kept on our server in Germany and only restored to recover the service; the off-site copy, once made, is encrypted.
7. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. Two of these you can do yourself in the app, under Settings → Your data: download your data and delete your account. For anything else, write to privacy@gelex.eu. We answer within one month.
Where we rely on legitimate interest, you may object at any time. You may complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or to the authority where you live.
8. Do you have to give us data?
An account needs a name and an email address; without them we cannot provide the service. Billing data is required by law for paid plans. We make no decisions about you based solely on automated processing that have legal or similarly significant effects.
9. Security
Sign-in supports passkeys and authenticator apps. Connections are encrypted. AI provider keys your organisation saves are encrypted and never shown again. Transcripts are encrypted under a key specific to your organisation. The audit log is append-only, and its export is signed so it can be verified. Report a vulnerability to security@gelex.eu (see our disclosure policy).
10. Changes
We update this policy when what we do changes, and we tell account holders by email before a material change takes effect.
Changelog
- , version 1: First version.