Privacy Policy

Last updated: 15 September 2025

Alawyer GmbH ("the Company," "we," "us," or "our"), Herrengasse 28, 2nd Floor, 8010 Graz, Austria, operates aiawyer.com, an AI-assisted legal research and contract analysis platform for lawyers and legal teams at German-speaking law firms and corporate legal departments. This Privacy Policy describes how the Company collects, uses, retains, and protects personal data, and explains your rights under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Austrian Data Protection Act (Datenschutzgesetz, DSG).

1. Data Controller

Alawyer GmbH ("the Company"), Herrengasse 28, 2nd Floor, 8010 Graz, Austria, is the controller of personal data processed through aiawyer.com. Data-protection enquiries and rights requests may be sent to [email protected].

2. Personal Data We Process

The Service is a professional tool for licensed lawyers. In providing it, the Company processes these personal-data categories:

  • Account and identity data includes your name, professional email, law firm or organisation, professional role, and credentials supplied when you register or manage your account.
  • Uploaded legal documents: contracts, legal texts, and other materials submitted for clause analysis. They may contain third-party personal data, including natural persons named in commercial contracts. Processing occurs in-session, with deletion after session end unless archive mode is activated in your account settings.
  • Query and search data: natural-language case-law searches covering BGH, OGH, and Oberlandesgericht decisions.
  • AI analysis outputs: clause-analysis reports and case-law results produced during your session, retained in your account when archive mode is active.
  • Technical and usage data: IP address, browser, OS, pages visited, session duration, and server logs collected automatically on Service access.
  • Communications data: support requests, enquiries, and other messages you send us.
  • Payment data: handled by our payment processor under a separate data-processing agreement; full card details are not stored.

Important data handling commitment: Uploaded documents are processed solely on servers within the European Union. They are deleted when your session ends unless archive mode is enabled, and are never used to train or improve AI models operated by the Company or any third party.

3. Purposes and Legal Bases (Article 6 GDPR)

Purpose Legal basis
Contract analysis and legal research, the core Service Contract performance (Art. 6(1)(b))
Creating and managing accounts Contract performance (Art. 6(1)(b))
Handling support requests and enquiries Pre-contractual steps and legitimate interest (Art. 6(1)(b)/(f))
Service security, abuse and fraud prevention Legitimate interest (Art. 6(1)(f))
Meeting legal and regulatory obligations Legal obligation (Art. 6(1)(c))
Usage analytics, with your consent Consent (Art. 6(1)(a) and ePrivacy Directive)

4. Recipients and International Transfers

Personal data is shared only with processors operating under written Art. 28 GDPR data-processing agreements, including EU-hosted infrastructure providers for cloud hosting and encrypted storage, plus an email delivery service for transactional messages. Documents are processed only on servers within the European Union.

If a transfer of personal data outside the EU or EEA is ever required, we rely on Standard Contractual Clauses (Art. 46 GDPR) and apply any supplementary safeguards required following the Court of Justice of the European Union judgment of 16 July 2020 (Schrems II). We do not sell personal data or share it for third-party marketing purposes.

5. Retention

Personal data is kept only for as long as needed for the purposes stated:

  • Archive mode off: uploaded documents deleted at session end.
  • With archive mode on, uploaded documents remain until deletion or erasure is requested, up to 24 months from upload.
  • Account data remains while the account is active and for 24 months after closure, to meet legal and contractual obligations.
  • Support and enquiry records remain for 24 months after the final exchange.
  • Server and access logs remain for 90 days.
  • Where consent is given, analytics data remains for up to 13 months from collection.

6. Your GDPR Rights

Under Chapter III of the GDPR, you have the following rights:

  • Right of access (Art. 15): confirm whether we process your personal data and obtain a copy.
  • Right to rectification (Art. 16): correct inaccurate or incomplete data.
  • Right to erasure / right to be forgotten (Art. 17): request deletion of your data, subject to limited exceptions such as legal-obligation retention.
  • Right to restriction of processing (Art. 18): limit how we use your data in certain circumstances.
  • Right to data portability (Art. 20): receive a structured, machine-readable copy of data you have provided to us.
  • Right to object (Art. 21): object to processing based on legitimate interest, including for direct marketing without any further conditions.
  • Right not to be subject to solely automated decision-making (Art. 22): we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

To exercise any right, email [email protected]. We will respond within one month. For complex or numerous requests we may extend this by a further two months and will notify you of the extension.

Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Right to Lodge a Complaint

If you consider that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with your national supervisory authority. Our lead supervisory authority is the Österreichische Datenschutzbehörde (DSB), Barichgasse 40-42, 1030 Vienna, Austria (dsb.gv.at). You may also contact the supervisory authority in your EU or EEA country of residence or place of work.

8. Cookies and Tracking Technologies

Cookies and similar technologies are used as described in our Cookie Policy. Non-essential cookies require prior consent through the cookie banner. Strictly necessary cookies may be used without consent because the Service requires them to function.

9. Security

The Company applies risk-appropriate technical and organisational measures, including TLS 1.3 for data in transit, AES-256 for data at rest, role-based access controls, audit logs for document processing, and incident procedures meeting the 72-hour notification requirement under Art. 33 GDPR. These safeguards reflect the professional confidentiality obligations (Berufsrechtliche Verschwiegenheitspflichten) applicable to our law firm clients.

10. Changes to This Policy

This Privacy Policy may be revised. Material changes will show a new "Last updated" date at the top of this page, and renewed consent will be requested before the change where legally required.

11. Contact

Alawyer GmbH
Herrengasse 28, 2nd Floor
8010 Graz, Austria
Email: [email protected]
Phone: +43 316 720 4150