Privacy Policy

LegalReview is operated by:

Email

hello@legalreview.ai

Managing Director

Daniel Filipe P. A. dos Santos

Register

Amtsgericht Charlottenburg, HRB 240764 B

Further provider details are available on our Imprint page.

For questions about privacy or your personal data, contact us at hello@legalreview.ai.

LegalReview is a business service and is not intended for private consumer use.

This Privacy Policy mainly applies to:

• people who visit our website;
• people who create or use a LegalReview account on behalf of an organisation;
• people who contact us;
• billing or administrative contacts at our customers; and
• people whose names or other personal data happen to appear in public documents monitored by LegalReview.

Because LegalReview is a business service, most personal data we process about account holders relates to their professional use of the service.

Visiting our website

When you visit LegalReview, our systems and hosting providers may process technical information such as:

• your IP address;
• the date and time of the request;
• pages requested;
• browser and device information;
• HTTP status information; and
• similar technical logs.

We use this information to provide the website, maintain security, troubleshoot problems and protect the service against abuse or attacks.

Legal basis: our legitimate interest in operating a secure and reliable service.

Your account

LegalReview uses your work email address to create and authenticate your account.

We may process:

• your email address;
• your email domain;
• your organisation membership;
• login and authentication information;
• sign-in timestamps; and
• basic account settings.

Accounts may be grouped into organisations based on their corporate email domain.

Depending on the organisation's configuration, users from the same company domain may be able to see the organisation's monitored documents and monitoring history.

We process this information to provide and administer LegalReview.

Where you use LegalReview on behalf of your employer or another organisation, our legal basis is our legitimate interest and the legitimate interest of that organisation in providing and administering the service.

Where you personally enter into the contract with us, processing necessary to provide the service may also be based on performance of that contract.

Providing the monitoring service

We process information about how your organisation uses LegalReview, including:

• which documents or URLs are monitored;
• when monitoring is enabled or disabled;
• previous versions of monitored documents;
• changes detected;
• monitoring and processing status;
• alert settings; and
• records of notifications that we send.

We use this information to provide the monitoring service, maintain the document history, send alerts and operate the product.

The same legal bases described above for your account apply.

Security and abuse prevention

We may process account activity, technical logs and related information where reasonably necessary to:

• protect accounts;
• prevent unauthorised access;
• investigate suspected abuse;
• diagnose technical problems; and
• protect LegalReview and our customers.

Legal basis: our legitimate interest in keeping the service secure and preventing misuse.

Enquiries and support

If you contact us, we process your contact details and the contents of your message so that we can respond and deal with your request.

Where your request concerns a contract with you personally, the processing may be necessary for that contract or steps requested before entering into it.

Otherwise, our legal basis is our legitimate interest in responding to enquiries and supporting users.

Billing and invoices

If your organisation uses a paid version of LegalReview, we may process:

• billing contact details;
• company and address information;
• tax or VAT information where required;
• invoice details;
• subscription information;
• payment status; and
• related accounting records.

At launch, subscriptions may be billed directly by invoice.

We use this information to administer paid subscriptions, collect amounts owed and comply with accounting and tax obligations.

Our legal basis is performance of a contract where you are personally the contracting party, our legitimate interest in administering our business relationship where you act for an organisation, and compliance with legal obligations where applicable.

If we introduce an external online payment provider in the future, we will update the relevant privacy information as appropriate.

LegalReview monitors documents published by third parties on publicly accessible websites.

These documents may occasionally contain personal data, for example the name or work contact details of:

• a data protection officer;
• a legal or privacy contact;
• a company representative; or
• a signatory.

LegalReview does not monitor these documents for the purpose of profiling those individuals.

The information is processed only because it forms part of the public document being monitored.

Processing may include:

• fetching the document;
• storing versions of it;
• comparing versions;
• identifying changes;
• analysing document text using automated systems or AI models; and
• generating descriptions of changes.

Our legal basis is our legitimate interest, and the legitimate interest of our customers, in monitoring publicly published business and legal documents for changes.

We try to minimise processing of personal information that is incidental to those documents.

Because this information appears incidentally across a potentially large and changing number of public documents, we do not normally contact each named individual separately. We make information about this processing publicly available in this Privacy Policy.

If you are named in a document monitored by LegalReview and have a question or objection about our processing of your information, contact hello@legalreview.ai.

LegalReview is intended to retrieve only publicly accessible pages. Our crawler identifies itself and is designed to respect website access restrictions, including robots.txt.

LegalReview may use artificial intelligence and other automated systems to clean, compare, classify or describe the contents of monitored documents.

The information sent to AI providers for this purpose is intended to be the content of the public documents being analysed.

We do not intentionally include account information such as your email address or organisation membership in prompts or document-analysis content sent to AI model providers.

However, a public document itself may contain personal data as described in section 4.

We use third-party service providers where necessary to operate LegalReview.

These may include providers for:

• hosting and cloud infrastructure;
• databases and storage;
• authentication;
• email delivery;
• security and error monitoring;
• customer support; and
• analytics, where you have consented to optional analytics.

Where a provider processes personal data on our behalf, we put appropriate data protection arrangements in place as required.

Our current provider information is available on our sub-processor page.

We may also share information with professional advisers, accountants or public authorities where reasonably necessary or legally required.

We do not sell personal data and do not provide personal data to third parties for their own advertising purposes.

Some service providers may process data outside the European Union or European Economic Area.

Where GDPR requires safeguards for such transfers, we use an applicable legal mechanism, such as:

• an adequacy decision;
• the EU Standard Contractual Clauses; or
• another legally recognised transfer mechanism.

The mechanism that applies depends on the provider and destination.

Where relevant, more information is available on our sub-processor page.

You may contact us if you would like further information about the safeguards used for an international transfer involving your personal data.

LegalReview may store or access information on your device where this is necessary to provide functionality you have requested, for example:

• keeping you signed in;
• maintaining security;
• storing session information; or
• remembering your privacy choices.

Strictly necessary technologies are used without consent where permitted by law.

Optional technologies, such as non-essential analytics, are used only after you have given consent where consent is required.

You can withdraw or change your consent choices at any time through the cookie or privacy settings available on the site.

We keep personal data only for as long as reasonably necessary for the purposes described in this Policy.

In general:

• account and organisation data is kept while the account or organisation remains active;
• monitoring history is kept while needed to provide the service or until it is deleted under the applicable product functionality;
• technical and security logs are kept for a limited period appropriate to security, troubleshooting and abuse prevention;
• support correspondence may be retained where reasonably necessary to maintain a record of the issue;
• consent records may be kept where necessary to demonstrate that consent was obtained; and
• invoice, accounting and tax records are kept for the applicable statutory retention period.

When an organisation is deleted, we aim to delete or anonymise service data within 30 days, except where:

• we are legally required to keep it;
• we reasonably need it to establish, exercise or defend legal claims;
• it forms part of security records that must temporarily be preserved; or
• immediate deletion is not technically possible from secure backup systems.

Data remaining in backups is not used for normal business purposes and is deleted or overwritten through our normal backup lifecycle.

Where information must be retained for legal reasons, we restrict its use to that purpose as appropriate.

Depending on the circumstances, GDPR gives you rights concerning your personal data, including the right to request:

• access to your personal data;
• correction of inaccurate information;
• deletion of your personal data;
• restriction of processing; and
• data portability where applicable.

Where processing is based on your consent, you can withdraw that consent at any time. Withdrawal does not affect processing that took place before you withdrew it.

Right to object

Exercising your rights

To exercise your rights, contact:

hello@legalreview.ai

We may need to confirm your identity before acting on a request.

We will respond without undue delay and normally within one month, subject to the extensions permitted under applicable data protection law.

Complaints

You also have the right to complain to a data protection supervisory authority.

Our competent authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

You may also contact the supervisory authority in the EU member state where you live or work, or where you believe an infringement occurred.

LegalReview uses automated processing, including AI systems, to analyse third-party documents and describe detected changes.

We do not use this processing to make decisions about account holders that produce legal effects or similarly significant effects on them.

Decisions about how your organisation responds to information provided by LegalReview remain with your organisation.

You need to provide a valid work email address to create and use a LegalReview account.

Without it, we cannot authenticate you or provide account-based features.

For paid subscriptions, we may also need billing information in order to issue invoices and administer the subscription.

There is generally no statutory requirement for you to create an account or provide this information simply to us, but we cannot provide the relevant service without the data needed to operate it.

We use reasonable technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, alteration and disclosure.

These measures may include access controls, encryption, authentication controls, backups and monitoring appropriate to the nature of the service.

No internet-based service can guarantee absolute security.

If you believe your LegalReview account or information has been compromised, contact us at hello@legalreview.ai.

We may update this Privacy Policy when LegalReview changes, when our providers or processing activities change, or when necessary to reflect legal requirements.

The current version will be published at this address with its last-updated date.

Where a change materially affects how we process account holders' personal data, we will take reasonable steps to inform affected users, for example by email or through the service.

Updates to our provider or sub-processor list may be published on that page without requiring a full revision of this Privacy Policy.