Privacy notice

Who is the controller

the operator of this instance is the data controller for accounts and workspaces on this CounterPartinstance. Contact the Data protection contact.

What we process

• Account data — email address, display name, workspace membership, role.
• Contract content — reference and response documents uploaded for analysis, plus parsed text and semantic chunks.
• Review activity — analysis runs, findings, reviewer notes, checklists, signed decisions and audit-log entries.
• Operational logs — sign-in events, error traces and health metrics needed to run the service.

Legal basis

We rely on the contract to provide the workspace (Art. 6(1)(b) GDPR), and on legitimate interest (Art. 6(1)(f)) to keep the service secure and auditable. Uploaded documents are processed on behalf of your organization under a Data Processing Agreement.

How long we keep it

• Uploads and derived analyses: retained for the workspace's contractual retention period, then deleted on request or on workspace closure.
• Signed decision records and audit logs: retained for 7 years to preserve the integrity of the decision trail.
• Account data: kept while the account is active and deleted within 30 days of a verified deletion request.

Your rights

Reviewers can export their workspace data and request account deletion from Settings → Privacy & Data. You also have the right to access, rectify, restrict, port or object to processing, and to lodge a complaint with a supervisory authority. Requests are handled within 30 days.

Sub-processors

The current list of sub-processors (hosting, database, AI model providers) is maintained on the Data Processing page. We notify workspace admins before adding a new sub-processor.

Security

See the Security overview for the technical and organisational measures in place on this instance.