Privacy notice
Privacy notice
Who processes what, why, and what you can do about it. [legal entity name] is the controller for the data described here.
This notice covers data we process as a controller — the accounts of the people who use Lawpatch. Data we process on a customer’s behalf as a processor — the scan signals and findings belonging to their workspace — is covered by the data processing addendum.
What we process
| Data | Why | Lawful basis | Retention |
|---|---|---|---|
| Google account e-mail, display name, account identifier | Authentication and showing who is in a workspace. We do not send marketing e-mail. | Performance of a contract (Art. 6(1)(b) GDPR / KVKK Art. 5(2)(c)) | Until you delete your account from the team page |
| Workspace, project and membership records | Running the product you signed up for | Performance of a contract (Art. 6(1)(b) GDPR / KVKK Art. 5(2)(c)) | Until the workspace is deleted — deletion is immediate |
| Scan metadata and findings (repository-relative paths, line numbers, rule identifiers, analysis), and text you enter: the project description, answers to open questions, triage notes | Producing and storing the report you asked for | Performance of a contract (Art. 6(1)(b) GDPR / KVKK Art. 5(2)(c)) | Until the customer deletes the project or workspace — deletion is immediate |
| Precedent search queries | Finding matching decisions | Performance of a contract (Art. 6(1)(b) GDPR / KVKK Art. 5(2)(c)) | Not stored; sent to the model provider to compute a search embedding |
| IP address and request metadata | Rate limiting, a daily ceiling on the analysis one address can cause, abuse prevention, diagnosing faults | Legitimate interests in keeping the service available and secure (Art. 6(1)(f) GDPR / KVKK Art. 5(2)(f)) | Rate-limit and daily usage counters hold a keyed hash of the address, never the address, and are deleted within a week of their window closing; hosting logs follow our host's retention |
| An invited colleague's e-mail address | Recording the invitation so the colleague joins the workspace when they first sign in. We do not e-mail them. | Legitimate interests of the inviting organisation (Art. 6(1)(f) GDPR / KVKK Art. 5(2)(f)) | Until the invitation is claimed or withdrawn, or the workspace is deleted |
| Usage analytics: page views, clicks without their text, scroll depth, time on page, public-page session replays with inputs and images masked, a random browser id and, once signed in, the account identifier | Understanding which pages people use and where they get stuck, so we can improve the site | Consent (Art. 6(1)(a) GDPR / KVKK Art. 5(1)), asked for before anything is collected and withdrawable at any time | Session replays expire after Mixpanel's replay retention period (30 days by default); event history is kept until we delete the analytics project |
What we deliberately do not process
- Your source code. Detection runs on your machine. Only derived signals leave it. Files made to hold credentials —
.env, private keys, credential JSON — are never opened, and anything shaped like a secret is withheld before a scan is sent. - Advertising identifiers, and analytics without your agreement. There is no advertising network and no tracking pixel. Product analytics (Mixpanel) runs only if you allow it; see Cookies and analytics below.
- Special categories of data. Nothing in the product asks for them and nothing in the pipeline is designed to hold them.
How stored data is protected
Everything in the database is encrypted at rest by our database provider. On top of that, the most sensitive text — counsel’s notes, drafts and decisions, legal and engineering briefs, risk-acceptance rationale and the details of audit entries — is encrypted by us with AES-256-GCM under a key held only by our servers, so a copy of the database alone does not reveal it. Notifications are deleted 90 days after they are read, and after a year in any case.
Cookies and analytics
We set no advertising cookies. With your agreement, and only then, we use Mixpanel to understand how the site is used, on the basis of your consent: on the public pages, page views, clicks, scroll depth, time on page and a replay of the session with everything you type and every image masked; in the dashboard, only the name of each page you open, with every project and scan identifier removed — no clicks, no text and no replay. Events carry a random id kept in your browser’s local storage and, once you sign in, your account’s internal id; never your e-mail address, your name, or anything from a scan. Mixpanel works out your country and city from your IP address and then discards the address. Until you choose, nothing is loaded; you can change your mind here at any time, and turning it off stops collection on this browser at once.
Everything else is strictly necessary and needs no consent. Signing in stores a Firebase authentication token in your browser’s storage (IndexedDB); it is strictly necessary to keep you signed in and is removed when you sign out. The report page keeps one local-storage entry remembering which coding agent you last handed a fix to — a setting you chose, holding nothing about you. Your analytics choice is kept the same way. Google’s sign-in window sets Google’s own cookies under Google’s terms. The signed-in app also runs Google reCAPTCHA Enterprise through Firebase App Check, a security check that requests come from this site; it is strictly necessary for that purpose and may set Google’s own security cookie.
Automated decisions
Lawpatch produces automated analysis about software, not about people, and it makes no decision that produces legal effects for an individual. The output is a prioritised list for a human to act on.
Sharing and international transfers
We share data only with the sub-processors listed here, each bound by a data processing agreement. All of them process data in the United States — our database is hosted there — so your data leaves the EEA, the UK and Türkiye. Those transfers rely on the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, on the EU-US Data Privacy Framework where the recipient is certified, and, for personal data covered by KVKK, on the standard contracts published by the Personal Data Protection Board under Art. 9 as amended by Law No. 7499, each notified to the Authority within five business days of signature as Art. 9(4) requires.
To tell you whether a dependency, AI model or dataset may be used commercially, our servers look up its public name in the public registry it is published on — npm, PyPI, Packagist, RubyGems, crates.io or Hugging Face. Only that public name is sent; nothing about your project, your code or you. The answers are cached for up to a month and shared across customers, as they describe public packages.
Your rights
Under the GDPR, the UK GDPR and KVKK you can ask for access, correction, deletion, restriction, portability, and you can object to processing based on legitimate interests. Under the CCPA/CPRA, California residents can ask what we collected, ask us to delete it, and opt out of sale or sharing — we do not sell or share personal information as those terms are defined, and we do not offer financial incentives.
Most of it you can do yourself, without asking us: each project has an Export everything button that downloads every scan, finding and processing model we hold for it as JSON, a Delete this project control that removes all of that immediately, the workspace owner can delete the whole workspace from the team page, and anyone can delete their own account there.
For anything else, write to [email protected]. We answer within 30 days. You can also complain to your supervisory authority — in Türkiye the Kişisel Verileri Koruma Kurumu, in the UK the ICO, and in the EU the authority where you live or work. Under KVKK you first apply to us; the Turkish-language KVKK aydınlatma metni sets out how.
Controller and representatives
[legal entity name], [registered address]. No representative under Art. 27 GDPR has been appointed yet; one will be named here before these terms take effect. The same applies to a representative under Art. 27 UK GDPR.