We share data only to the extent necessary to deliver the service, with the following sub-processors:
Research queries and uploaded documents may be processed by external AI providers — do not enter confidential data or the personal data of third parties into them.
Providers we deliberately do not use. To protect the confidentiality of your queries we never route your data to AI providers that require opting in to training on customer input, in particular Mistral (La Plateforme / Codestral) and OpenCode Zen. You can also record a binding opt-out from AI-model training in your account settings.
Some of our sub-processors are based outside the European Economic Area, in particular in the United States (e.g. Google LLC for AI models, Stripe, Inc. for payments). Such transfers take place on the basis of the European Commission's adequacy decision for the EU–US Data Privacy Framework and/or the Standard Contractual Clauses (Art. 46 GDPR), which provide an adequate level of data protection.
Account data — for as long as the account exists. Proof-of-purchase records — for the period required by tax law (generally 5 years). After account deletion, data is deleted or anonymized, except for data whose retention is required by law.
You have the right to access your data, rectify it, erase it, restrict its processing, port it, and to object and to lodge a complaint with the competent data protection authority. You can export your data and delete your account yourself in the account panel. To exercise other rights, contact the Controller.
The Service uses a necessary session cookie (to keep you signed in). We do not use marketing cookies without consent.
Passwords are stored only as a hash (scrypt). We apply login-attempt rate limiting and secure sessions.