This agreement is between your organisation (“you”) and Aleksei Zhavoronkov, an individual entrepreneur registered in Georgia under identification number 329328491, Grigolaantkari village, Dusheti region, Georgia (“we”). It forms part of our terms of use and applies from the moment your organisation accepts them. It governs the personal data in the content your organisation puts into jurispraxis.
Where this agreement and the terms of use differ on the protection of personal data, this agreement applies. Where the standard contractual clauses in Annex 4 and this agreement differ, the clauses apply.
1. Roles
For the content your organisation uploads, writes and makes in the app — files, questions, answers, drafts and tables — your organisation is the controller and we are its processor.
For your members’ accounts, for billing and for the security of the service, we are the controller. Our privacy notice covers that data, and this agreement does not.
Annex 1 specifies the processing: its subject matter and purpose, whose data, which data and for how long.
2. Your instructions
We process your content only on your documented instructions. The terms of use, this agreement and what your members do in the app are your instructions. A further instruction must be in writing.
If we believe that an instruction breaks the GDPR or another data protection law of the Union or a Member State, we tell you at once and we need not follow it until you confirm or change it.
If a law requires us to process your content in another way, we tell you before we do so, unless that law forbids it.
You make sure that you have a legal basis, and every right and consent you need, to give us the personal data in your content and to let us process it under this agreement. You give us only the personal data the service needs; a message to our support, for example, needs none from your files.
3. Confidentiality
Each person we allow to reach your content is bound to keep it confidential, by contract or by law. We allow a person to reach it only where the service needs it.
We know that your content can be covered by your professional duty of confidentiality. We use it for no purpose of our own. We do not use it to train AI models, and we do not let a sub-processor do so. We do not sell it, and we do not combine it with data from any other source.
4. Security
We take the technical and organisational measures in Annex 2. They meet Article 32 GDPR for the risks of the content a law firm keeps. We may change a measure, but never so that the level of protection goes down.
5. Sub-processors
You give us a general authorisation to engage sub-processors. Annex 3 lists the ones we use today.
We tell your organisation’s owner by email at least 30 days before we add or replace a sub-processor. You can object in writing within those 30 days, on reasonable grounds of data protection. We then look for a solution with you. If we find none, you can end the contract before the change applies.
We bind each sub-processor, by a written contract, to data protection duties that are at least as strict as ours in this agreement. We stay liable to you for the work of each sub-processor.
6. Requests from the people in your files
The app lets your members find and delete your files, chats, drafts and tables, and export chats and drafts as Word documents and the text of each file. If a person asks us, not you, to exercise a right under the GDPR about your content, we send the request to you without delay and do not answer it ourselves. Where you need more help to answer a request, we give it.
7. Personal data breaches
If a personal data breach reaches your content, we tell your organisation’s owner without undue delay, and at the latest within 48 hours after we become aware of it. We tell you what happened, which data and how many people it concerns as far as we know, what it may lead to, and what we do about it. What we do not yet know, we send as soon as we know it.
We help you meet your duties to notify the supervisory authority and the people concerned.
8. Impact assessments
We give you the information you need for a data protection impact assessment of your use of jurispraxis, and for a prior consultation of the supervisory authority where one is needed. [A pre-filled DPIA your organisation can reuse — to write.]
9. When the contract ends
Before your organisation’s account ends, your members can export your chats and drafts and the text of your files. After it ends, we delete your content within 30 days, unless a law of the Union or a Member State requires us to keep it. Copies in backups are deleted when those backups expire, within 6 days.
We confirm the deletion in writing if you ask.
10. Proof and audits
We make available the information you need to show that we meet Article 28 GDPR: this agreement, its annexes, the current list of sub-processors and our sub-processors’ certifications (for example, the SOC 2 reports of Railway and Requesty, where they allow us to share them).
If that information is not enough, you may have an audit done once a year by an independent auditor bound to confidentiality. You tell us at least 30 days before. The audit must not reach the data of our other customers, and you pay for it. A supervisory authority, or a personal data breach, can justify an audit at another time.
11. Transfers outside the EEA
Your content is stored in the European Union. We run the service from Georgia, which has no adequacy decision. When we reach your content from Georgia, that is a transfer. For it, you and we agree the standard contractual clauses of the European Commission (Decision (EU) 2021/914), Module Two (controller to processor), with the choices in Annex 4. We keep a transfer impact assessment for Georgia and give it to you on request.
A sub-processor outside the EEA receives your content only under an adequacy decision of the European Commission or under the standard contractual clauses. Annex 3 names the basis for each.
12. Requests from public authorities
If a public authority asks us for your content, we tell you, unless the law forbids it. We give only what a binding order requires. We challenge an order where there are reasonable grounds to think it is unlawful. This applies in Georgia as in any other country.
13. Liability
The liability rules of the terms of use apply to this agreement.
14. Our representative in the Union
Under Article 27 GDPR, our representative in the European Union is Elena Gostishcheva, Rua Frederico de Brito, Nº 9, 3º D, 1750-065 Lisboa, Portugal. You and the supervisory authorities can address it on any question about this agreement.
15. Duration and changes
This agreement runs as long as we process your content, and ends when we have deleted it. We change it in the same way as the terms of use: we tell you at least 30 days before a material change, and you can end the contract before the change applies. A change that a law or a supervisory authority requires can apply sooner.
Annex 1 — Specification of the processing
Controller. Your organisation, as named in its account.
Processor. Aleksei Zhavoronkov, individual entrepreneur, Georgia. Contact: hello@jurispraxis.ai.
Subject matter and purpose. jurispraxis is an AI workspace for legal research and drafting, on public legal sources and on your organisation’s own documents. We store your content, search it together with public legal sources and process it with AI models, only to provide the service to your organisation under the terms of use.
People whose data is processed. The people your content names or describes, and your members as its authors.
Personal data. Names, contact details and any other personal data in the files, questions, drafts and tables your members put into the service, and the labels the service gives to the names it finds. Your content can hold special categories of data and data about criminal convictions and offences; your organisation decides what it uploads.
Duration. While your organisation uses the service. Your content stays until your members delete it, or until 30 days after your organisation’s account ends. Backups of the database are kept for 6 days.
Where. Stored in Amsterdam, the Netherlands. Processed by the sub-processors in Annex 3, where Annex 3 says. Reached from Georgia to operate and support the service.
Annex 2 — Security measures
These are the technical and organisational measures we take to protect your content. We may change a measure, but never so that the level of protection goes down. More detail is available on request.
Hosting
- Your content is stored and processed in Amsterdam, the Netherlands, on Railway’s platform (EU West). Your files are processed on our own services there; no third party receives your files.
- A request to an AI model goes through Requesty’s gateway in Frankfurt, and only to a provider in Annex 3. Requesty keeps no copy of a request.
Text sent to AI models
- Before text goes to an AI model, the service replaces the names of people and companies that it finds in your files and questions with labels, and puts the names back in the answer. If the name detection fails, the text is not sent.
- A name that appears only in other text a member writes, such as a skill or a table question, is replaced only if the service has found it in your files or questions.
- No sub-processor may use your content to train a model. An AI model provider may keep a request, with its labels, in a cache for up to 24 hours.
Access control
- Passwords are stored only as salted hashes. An email address must be confirmed before the first sign-in.
- Two-factor authentication is available to each member, and its secrets are stored encrypted. [An organisation cannot yet require it for its members.]
- A session lasts 7 days and is extended while it is used; signing out ends it.
- Sign-up, sign-in, password reset and two-factor attempts are limited in number, and sign-up, sign-in and password reset pass a bot check.
- Every read is limited to the member’s organisation. Inside it, a file, chat or table is private, shared with named members or open to the organisation, and the owner and the admins can reach all of it. Only the author, the owner or an admin can delete it.
Transmission and storage
- The app, the api and the site answer over HTTPS only. The internal services that work on your content are reached only on the platform’s private network and refuse a request without our internal secret. The private network is encrypted, and none of these services has a public address.
- The database and the file storage are encrypted at rest by the hosting platform.
Logging
- Security logs carry the request, its status and time, the IP address, the user agent, the user id and the organisation id. They stay in the EU and are deleted after 30 days. [Some lines also carry search text, file names and short parts of model output — to remove.]
Availability
- The database is backed up every day, and each backup is kept for 6 days.
Deletion
- Deleting a chat, a draft, a table or a file deletes it. Nothing is kept in a deleted state. A quote of a deleted file that a chat or table holds stays until that chat or table is deleted.
- When the account ends, we delete the content within 30 days.
People and suppliers
- The operator opens content only to repair a fault or when your organisation asks for support.
- The operator’s access to the hosting platform needs two-factor authentication.
- Each sub-processor is bound by a written contract to data protection duties at least as strict as ours.
- We review these measures once a year, and after each personal data breach.
Annex 3 — Sub-processors
The current list is the sub-processor list.
Annex 4 — Standard contractual clauses
The clauses of Decision (EU) 2021/914, Module Two, apply to the transfer in section 11, with these choices.
| Clause | Choice |
|---|---|
| 7 — docking clause | [not used] |
| 9(a) — sub-processors | Option 2, general written authorisation; notice at least 30 days before a change |
| 11(a) — independent dispute resolution | Not used |
| 13 — supervisory authority | The authority of the Member State where your organisation is established; for an organisation in the Netherlands, the Autoriteit Persoonsgegevens |
| 17 — governing law | The law of the Netherlands |
| 18 — courts | The courts of [Amsterdam], the Netherlands |
Annex I.A — parties. Data exporter: your organisation, as named in its account, controller. Data importer: Aleksei Zhavoronkov, individual entrepreneur, identification number 329328491, Grigolaantkari village, Dusheti region, Georgia, processor; contact hello@jurispraxis.ai; representative in the Union: Elena Gostishcheva, Rua Frederico de Brito, Nº 9, 3º D, 1750-065 Lisboa, Portugal.
Annex I.B — the transfer. As in Annex 1. The transfer is remote access from Georgia to data stored in the Netherlands, to operate and support the service.
Annex I.C — supervisory authority. As in Clause 13 above.
Annex II — measures. Annex 2 of this agreement.
Annex III — sub-processors. Annex 3 of this agreement.