Privacy.

This notice covers accounts and organisations at platform.eigenweltlabs.com, paid model inference, team administration, billing, the Knowledge Hub, and intake and tasks.

Controller and processor roles

Poensgen Technology UG (haftungsbeschränkt), Wiclefstr. 45, 10551 Berlin,Germany · chris@eigenweltlabs.com

We are controller for account, subscription, security, and legal-compliance data. When a Customer processes personal data in prompts, output, Hub content, intake messages, or tasks, the Customer is generally controller and we act as processor. Business customers are covered by our Art. 28 GDPR data processing agreement.

Data we process

• Account, authentication, organisation, membership, role, and invitation data.
• Plan, seats, subscription status, invoices, tax information, and payment status.
• Content-free inference metadata: user, model, token counts, cost, timestamp, and request status.
• Hub items users publish, including workflows, integrations, plugins, MCP server definitions, presets, permissions, publisher, and item history.
• Intake and tasks: emails sent to a firm's intake addresses and submissions through its intake API (sender, subject, text, attachments, check result), and tasks with their description, assignee, due date, notes, attachments, and history, including tasks created in LegalWork and synced with the firm.
• Firm configuration: the hosting regions an administrator has chosen and the on/off decisions for individual models.
• One gateway access key per user and firm, stored encrypted (AES-256-GCM) and re-issued on later sign-ins so a user's devices share one key.
• IP address, session, device, access, error, and security records.

Full card details are handled by the payment provider and are not stored by Eigenwelt.

Purposes and legal bases

Account, organisation, billing, usage, and Hub data is processed to provide and bill for the contracted service (Art. 6(1)(b) GDPR). Security and operational data is processed to protect accounts and maintain the service (Art. 6(1)(f) GDPR). Invoice and transaction records are processed under legal accounting and tax duties (Art. 6(1)(c) GDPR). Processor activity follows Customer instructions and the applicable DPA.

Connected storage and team configuration

For team-managed storage connections, the platform processes configurations, permissions, revisions and supported shared credentials. Personal OAuth tokens for connected providers remain in the app's local encrypted vault. Files are opened as local working copies for editing; saving back to the source is explicit. Connecting storage does not automatically back up every matter file or index it in LegalMemory.

Model inference: regions, providers, and retention

Paid inference passes through Eigenwelt's gateway on Google Cloud in Frankfurt, Germany, and from there to the model infrastructure of the provider that runs the selected model. Every model carries a hosting region; the region and the provider are shown on the platform's Models page and in LegalWork's model list.

The European Union is the default. A firm that has not enabled a further region uses EU-hosted models; Mistral can also process requests in EFTA countries. A model Eigenwelt adds later — including one on a new provider — is off by default and does not reach the firm until an administrator turns it on.

An administrator can enable further hosting regions, currently the United States. That selection applies to the entire firm and constitutes a documented Customer instruction within the meaning of Art. 28(3)(a) GDPR to send inference content to model infrastructure in the selected region. Such transfers rely on an adequacy decision or appropriate safeguards under Chapter V GDPR, in particular the EU Standard Contractual Clauses in the relevant providers' data processing agreements.

We obtain Mistral Large 4 (Eigenwelt Europe Mistral) directly from Mistral AI through its EU regional endpoint. According to Mistral's documentation processing can also take place in EFTA countries. ZDR is enabled for Eigenwelt's stateless chat requests; use of API data for training is separately disabled. Account, billing, and operational metadata may be processed outside the inference region. The model is used when an administrator has enabled it.

The paid gateway does not log prompts or output and retains only content-free metering data. Zero data retention (“ZDR”) is enabled for Eigenwelt’s accounts with our inference providers; prompt or output content is not used to train models. Under their published terms, TensorX processes prompts and outputs only transiently in ephemeral enclaves and persists them to no storage system; Fireworks does not log or store prompt and generation data absent an explicit opt-in; Scaleway's policy permits temporary access and retention for up to two weeks when investigating abnormal errors or suspected malicious activity, and the retention of aggregated, anonymised usage data for up to six months.

For the Gemini models served through Google Cloud (Vertex AI), Google has switched off abuse-monitoring logging for Eigenwelt. Prompts sent to these models are therefore not logged or retained for abuse monitoring either, and ZDR applies to them as it does to the other models.

We obtain the Claude models (Anthropic) and the GPT models (OpenAI) through OpenRouter. For these we use only OpenRouter's regional hosts and only zero-data-retention endpoints at Microsoft Azure, Amazon Web Services, and Google Cloud; requests are not sent to Anthropic's or OpenAI's own interfaces. Under its data processing agreement, OpenRouter deletes inputs and outputs promptly after the output is generated and stores only content-free request metadata, except where retention is required by law or necessary to address malicious use.

ZDR applies to paid inference content, not to account, billing, security, usage, or Hub data intentionally stored in the platform. The separate free-model gateway is not ZDR.

ZDR is enabled on Eigenwelt’s TypeSafe account for Eigenwelt US Jev. TypeSafe AI, Inc. receives the content and questions submitted to this SystemOne model only where an administrator has enabled both the US region and the model. Eigenwelt Europe EigenJev is operated by Eigenwelt on Google Cloud in the Netherlands; requests to that model are not sent to TypeSafe.

Knowledge Hub

Hub items are stored for sharing with authorised members of the Customer organisation. Access depends on roles and permissions; administrators and members may be able to view, install, update, pin, or remove items and see their publisher. Users must share only authorised material. Credentials belong only in features expressly designed to protect and permission them.

Intake and tasks

Intake is off until an administrator turns it on. Emails sent to a firm's intake addresses are received by our provider Brevo and passed on to the platform, where the sender is first checked against the firm's rules. Messages that are not admitted get no AI processing; depending on the setting, they are stored with the reason for rejection but without attachments, or discarded. For admitted messages, an AI model called through the paid gateway creates a task and assigns it to a member; the statements on model regions and ZDR above apply.

Messages, attachments, and tasks are stored in the platform database in Frankfurt for as long as the firm uses the service, and synced with the firm's signed-in members in LegalWork as far as the visibility settings allow. Tasks a signed-in member creates in LegalWork are stored and shared the same way. Deleted tasks go to a trash and can be restored.

Platform analytics

To understand where sign-up, subscribing, and connecting LegalWork break down, we capture named product events and send them to PostHog's EU Cloud in Frankfurt. Captured events include a trial starting or ending, seat-count changes, failed payments, a firm being created, and members joining or being removed; in the browser, additionally the pages viewed and load timings.

• Events are keyed to the firm, not to an individual: the identifier is a hash (SHA-256) of the organisation id. This is pseudonymisation within the meaning of Art. 4(5) GDPR, not anonymisation.
• No person profiles, and no names, email addresses, user ids, or payment-provider ids in the events.
• Explicitly named events only. Autocapture, heatmaps, and session replay are switched off so that customer data rendered on the page cannot be picked up.
• The paid inference gateway is deliberately not connected to analytics. Prompts, output, and individual model usage never appear there.

This relies on our legitimate interest in improving and securing the Service (Art. 6(1)(f) GDPR). You may object using the contact address below. Events are retained for at most 24 months.

Infrastructure subprocessors

• Google Cloud Platform: application, gateway, databases, object storage, caches, Hub data, and operational metadata in europe-west3 (Frankfurt, Germany); hosting of Eigenwelt Europe EigenJev, operated by Eigenwelt, in europe-west4 (Netherlands), under the Google Cloud DPA.
• TensorX Limited (Dublin, Ireland): model inference for the European models, operated in Dublin and Helsinki, under its data processing agreement.
• Scaleway SAS (Paris, France): model inference in the EU (region fr-par), under its Generative APIs privacy policy and DPA.
• Mistral AI (Paris, France): model inference for Mistral Large 4 through the EU regional endpoint (documented EU/EFTA footprint), under its data processing addendum.
• Google Cloud (Vertex AI): model inference in the EU and — only where an administrator has enabled it — in the United States, under the Google Cloud DPA.
• Fireworks.ai, Inc. (San Mateo, California, USA): model inference for the US models, under the provider's DPA. Engaged only where an administrator has enabled a US model.
• TypeSafe AI, Inc. (United States): SystemOne model inference for Eigenwelt US Jev in the United States, with ZDR enabled on Eigenwelt’s TypeSafe account. Engaged only where an administrator has enabled both the US region and this model, under the TypeSafe DPA, which incorporates Module 3 of the EU Standard Contractual Clauses for processor-to-subprocessor transfers.
• OpenRouter, Inc. (New York, USA): routing of inference requests for the Claude and GPT models through regional hosts in the EU and — only where an administrator has enabled it — in the United States, under its data processing agreement, which incorporates Module 2 of the EU Standard Contractual Clauses. OpenRouter also processes content-free request metadata in the United States.
• Microsoft Azure, Amazon Web Services, and Google Cloud (Vertex AI): model inference for the Claude and GPT models as infrastructure providers to OpenRouter, in the EU and — only where an administrator has enabled it — in the United States.
• Clerk, Inc. (San Francisco, California, USA): accounts, authentication, organisations, memberships, and invitations, under the provider's DPA.
• Brevo GmbH (Berlin, Germany): receipt of emails sent to intake addresses, including attachments, processed in the EU (France and Belgium), under the provider's DPA. Engaged only where a firm has activated intake.
• Stripe Payments Europe, Limited (Dublin, Ireland): payment processing, subscriptions, tax calculation, and invoices. Full card details are handled by Stripe alone.
• PostHog: platform analytics in the EU Cloud in Frankfurt, Germany, under the provider's DPA.

Core platform data is hosted in the EU. Paid inference is processed in the EU unless an administrator has enabled a further region; Mistral can also process requests in EFTA countries. Where processing takes place in a third country — because of the model or region selection, a provider's place of establishment, or limited support access — it relies on an adequacy decision or safeguards such as EU Standard Contractual Clauses, as Chapter V GDPR requires. The binding list of authorised subprocessors, with processing locations and purposes, is Annex 3 of the data processing agreement.

Retention and deletion

Paid prompt and output content follows ZDR above, including the exception stated there: up to two weeks where a provider investigates abnormal errors or suspected misuse. Account, organisation, and Hub data remains while needed to provide the service or until an authorised user deletes it. After termination, we delete or anonymise Customer data within a reasonable operational period, subject to backups, security, disputes, and law. Billing records remain for statutory retention periods. Customers should export needed Hub material before closing an organisation.

Your rights

You may request access, correction, deletion, restriction, portability, or object to processing, and may complain to a competent supervisory authority. For Customer-managed data, contact your organisation first; we assist Customers with requests as required. Contact us at chris@eigenweltlabs.com.