Privacy policy

The controller is the operator: Paul Curcean, sole proprietorship, seat in Austria; contact: paulcurcean@protonmail.com. No data protection officer is appointed at this size.

• Contract uploads: processed only for the analysis, locally masked before any model call (personal identifiers are replaced by placeholders) and not persisted by default. Unsaved uploads, indexes and masking mappings are ephemeral and deleted after the session.
• Account data: email address, password hash, account status and plan, stored separately from contract content.
• Usage and quota metadata: for guests a per-UTC-day hashed anonymous device token (random cookie, never the raw IP) plus a hashed-IP abuse-guard counter per shared network; for accounts daily usage counters. Raw IPs are never logged or stored.
• Saved results: only when you explicitly choose Save; stored encrypted and deletable at any time.
• BYOK keys: provider keys you store are AES-256-GCM encrypted at rest, never logged, and only sent to the allowlisted endpoint of the respective provider.
• Contact form: email, optional organisation, topic and message are sent to the operator by SMTP and are not stored in an Aletura contact database.
• Follow-up questions: operate only on the validated result and are not durably linked to the original contract.

• Providing the analysis and the account: Art. 6(1)(b) GDPR (contract performance).
• Security, abuse and quota control: Art. 6(1)(f) GDPR (legitimate interest).
• Compliance with legal obligations (e.g. retention of saved results): Art. 6(1)(c) GDPR.

Mistral AI is used as a processor for the analysis. Aletura is configured for Mistral EU regional inference (endpoint https://api.eu.mistral.ai); no GDPR-compliance or end-to-end residency beyond that configuration is inferred from it. Before every model call, detected personal identifiers are masked locally and an outbound guard checks the prompt; model responses are validated for schema, canary leaks and disallowed fields. With BYOK, Aletura sends your key only to the allowlisted endpoint of the selected provider; no EU-residency claim applies to other providers.

The website uses Simple Analytics (cookie-less, no personal data, respects Do Not Track). IP addresses are not stored and no profiles are built.

• Unsaved contract content, indexes and masking mappings: deleted at session end or after a short TTL.
• Account and usage data: until account deletion; deleting the account cascades to linked saved results.
• Email-verification and password-reset links: valid 24 h resp. 30 minutes, single-use, stored as hashes.
• Saved analyses: until you delete them or delete the account.

You have the right to access, rectification, erasure, restriction of processing, data portability, the right to object and the right to withdraw consent, and the right to lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna). Any storage you triggered can be deleted by you at any time.

Encryption of transmitted and stored data (TLS, AES-256-GCM for keys and saved results), role and tenant separation, step-up password checks for sensitive account actions. Masking is pseudonymization with detection limits, not absolute protection.