Privacy.

This notice covers the free, local-first LegalWork desktop App. The hosted Eigenwelt Plus service has a separate Privacy Notice.

Controller

Poensgen Technology UG (haftungsbeschränkt), Wiclefstr. 45, 10551 Berlin,Germany · chris@eigenweltlabs.com

Local-first operation

Documents, prompts, drafts, recordings, and work product are stored and processed on your device. They are not sent to us merely because you use the App. If you run a local model, inference stays on your device.

If you connect a model provider with your own API key, content selected for inference is sent directly to that provider under its privacy terms. You control the provider and data you send.

Voice Mode

Voice Mode is off until you start it and requires a connected OpenAI provider using your own API key. While it runs, your microphone audio is streamed continuously to OpenAI's Realtime API. An excerpt of the current chat is sent along with the audio as context, so the voice model can follow the conversation. The voice model can also call tools that perform actions in your workspace.

This transmission goes directly to OpenAI under your agreement with OpenAI and its privacy terms. It is not covered by the Eigenwelt Plus commitments, and Eigenwelt receives neither the audio nor the chat excerpt sent. Use Voice Mode only where OpenAI is an appropriate provider for the confidentiality and professional duties attaching to the content involved.

Recording and transcription

The recording feature can capture the microphone and system audio. Capture, transcription, and the models used for them run entirely on your device: audio and transcripts are not uploaded, including to Eigenwelt. The transcription models unlocked on the Plus plan are also local models; the subscription only governs which of them you can download. Because system audio also captures other participants in a conversation, you are responsible for obtaining the necessary consents.

Personalisation and local memory

Custom instructions and the App's local memory are stored on your device — globally in the configuration directory and per workspace in that workspace's folder. They are not sent to Eigenwelt. Because both are added to the system prompt, however, their contents form part of the requests sent to the model provider you have chosen. Under Settings → Personalisation you can control whether the agent may also derive memory from tool, web, and MCP results, and delete all local memory.

Attachments and workspace files

Files you attach to a chat or drag into the App are stored as files in your workspace on disk and shown in the chat as a reference. They exist independently of the conversation: deleting a chat leaves the file in the workspace until you remove it there.

Signing in with Eigenwelt

When you sign in with Eigenwelt, the App receives and stores locally your account details (id, name, email address) and your firm's id and name, the plan, subscription status, any trial end, seat count, enabled features, the models assigned to you, and your weekly usage with its reset time. The App polls the platform for these periodically so the model list and usage display stay current.

While you are signed in, the App syncs your tasks with your firm on the platform. Tasks you or the agent create or edit are sent to the platform with their content — such as title, description, status, assignee, due date, notes, and attached files — and shared with the firm as its visibility settings allow. The firm's tasks, including those received through intake, are downloaded to your device. When you sign out, the App removes the tasks synced with the firm from your device.

The platform-side processing of this data is covered by the Eigenwelt Plus Privacy Notice, including its statements on model regions, providers, and retention.

Free Eigenwelt models (closed to new users)

The free-model gateway is no longer offered to new users. Where access still exists — for example in older installations or with a device key already issued — the following continues to apply unchanged: it is not zero data retention. Prompts, responses, model, and usage information may be logged for evaluation and service improvement. Do not use free models with personal, privileged, client, or matter data. The App identifies when a free model is active.

Connected services and connectors

The App can be connected to third-party services over MCP and integrations. Where such a service is connected, the content you or the agent direct to it is transmitted to that provider and processed there under its own terms. Eigenwelt is not a party to that exchange and does not receive the content. Choosing appropriate providers is for you and your firm; connections can be disconnected in Settings at any time.

LegalMemory is Eigenwelt Labs' knowledge index and runs in the firm's own infrastructure. When you connect it, access follows the permission model of your LegalMemory instance; documents and citations retrieved from it land in your workspace and from there in the requests sent to the model you have chosen. Where you run LegalMemory yourself, Eigenwelt receives no data in the process. Where you instead use the public demo operated by Eigenwelt, its separate privacy notice and terms of use apply. Do not use the demo with client or matter data.

Google integrations and Drive access

Google integrations are optional. You choose a connection and its features, then grant the necessary permissions through Google's OAuth screen. The Google Drive file-storage integration accesses file names, identifiers, folder relationships, file types, sizes, revisions, and file contents to browse folders, search, download, and open files in your workspace. Google documents may be exported to a supported file format for this purpose. Access follows your Google account's permissions.

A read-only Drive connection requests only drive.readonly. A writable connection instead requests drive so you can upload files, create folders, and save changes to existing files. The App needs access to existing files and subfolders, including files it did not create. You can limit the displayed area to a folder; LegalWork enforces that boundary, which does not narrow the account-wide permission granted by Google. The integration does not currently offer deletion of Drive files.

Gmail and Outlook plugins

Where these plugins are available in your installed version, you can connect a personal Google or Microsoft account through your system browser. The plugins access account identifiers, names, email addresses, message identifiers, senders, recipients, subjects, timestamps, message text, and attachments to perform the email tasks you request. The App searches the mailbox on demand; these plugins do not create a complete local mailbox copy. You explicitly enable each account for the local projects whose agents may use it. Shared client credentials alone do not provide access to personal email accounts.

Read-only Gmail access requests gmail.readonly. Enabling drafts and sending also requests gmail.compose; this Google permission covers both drafts and sending. Outlook requests Mail.Read for reading, or Mail.ReadWrite and Mail.Send for drafts and sending, alongside permissions needed for sign-in, account identification, and connection refresh. These provider permissions apply to the connected account. LegalWork additionally enforces project access grants. Before every plugin send, the App presents the sender account, To, Cc and Bcc recipients, subject, and exact message text for explicit approval. The plugin does not automatically resend after an uncertain submission outcome.

OAuth access and refresh tokens, account information, project grants, and content-free submission receipts are encrypted on this computer using AES-256-GCM. Submission receipts contain a hash of the send request and its status, but no message text. Tokens are neither sent to model providers nor included in portable projects or firm synchronization. Downloaded attachments, chat histories, and derived work product instead remain in your local working files and follow their retention and deletion rules.

When you ask an agent to work with email, search results, selected message text, attachments, and derived answers enter the task context and may be sent to the model provider you choose. With a local model, inference remains local; Eigenwelt Plus is additionally covered by its own Privacy Notice. Disconnecting removes saved tokens and local project grants. For Google, the App also attempts provider-side revocation and reports when it could not confirm it. For Microsoft, you can additionally remove app permissions in your Microsoft account. Disconnecting does not delete original emails or previously saved attachments, chats, or work product.

Use and sharing of Google data

Google data is used only for the features you request. Browsing, opening, and saving Drive files alone does not send their contents to Eigenwelt. When you ask an agent to work with connected files, search results, file contents, and derived answers may become part of the task context and be sent to your chosen model provider. With a local model, inference remains local. Eigenwelt Plus is additionally covered by its own Privacy Notice. Other tools and integrations you enable may receive content when you instruct the agent to use them. Your Google access tokens are neither sent to model providers nor synchronized with team members.

We do not sell Google data, use it for advertising, train general or public AI models with it, or use it to determine creditworthiness. Human access by Eigenwelt requires your affirmative agreement to the specific data, a security need, a legal obligation, or another narrowly permitted exception under Google's policy. Our use and transfer of data received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Protection of Google Drive data

• In transit: connections to Google's OAuth and Drive APIs use HTTPS/TLS. Sign-in uses the system browser, PKCE, and validation of a one-time sign-in state. The local sign-in callback is bound to your device's loopback address.
• Stored credentials: the built-in Drive connection encrypts OAuth access and refresh tokens using AES-256-GCM. The local key file and token file are created with file permissions restricted to the operating-system account running the App. This encryption does not protect against a compromised operating-system account that can also access the key.
• File contents: downloaded working copies are stored in your chosen workspace. The App creates these downloads with restricted file permissions and checks local paths against the workspace and remote paths against the connected folder. Workspace files and chat histories are not additionally encrypted by the OAuth credential store. Their protection on disk depends on access permissions and the device or disk encryption you enable.
• Access controls: each person signs in with their own Google account. Read-only access is enforced for file operations. Disconnecting a connection removes its saved tokens and prevents further retrieval through that connection.

Retention, disconnection, and deletion

Credentials are retained while you use the connection; the App can renew expired access tokens using the saved refresh token. Signing out of the connection in File storage settings removes its stored tokens. You can also revoke Google's authorization at any time in Google Account permissions.

Disconnecting does not delete original files in Google Drive. Downloaded files, local exports, chat histories, and derived work product remain on your device until you delete the relevant files or conversations. Deleting a conversation does not automatically remove its workspace files. Content you sent to a model provider or another service is also subject to that service's retention and deletion rules. For questions about data processed by Eigenwelt itself or to request deletion, contact chris@eigenweltlabs.com.

Optional App analytics

If enabled during setup or later in Settings, the App sends anonymous, content-free usage events to PostHog's EU Cloud in Frankfurt. You can disable this at any time under Settings → Privacy → Share anonymous usage data.

• Sent: event names, counts, duration, App version, operating system, and model ID.
• Onboarding-flow events, including microphone and system-audio permission prompts and model downloads, plus Office add-in installation, connecting and disconnecting a connector together with its identifier, and changes to tool and permission toggles.
• Error and crash events: an error name from a fixed list, a hash used to group similar errors, the component affected, a status code, and the surface on which the error occurred. These fields are produced from a fixed schema rather than extracted from error text, so no content can travel with them.
• Not sent: prompts, messages, files, file paths, recordings, code, or work product.
• A random identifier, new on every app start and never stored on your device, plus a machine-generated task id that groups the events of one task.
• Location no finer than city level, derived from the request IP address, which is not stored.

This processing relies on our legitimate interest in improving the free App (Art. 6(1)(f) GDPR). You may object by disabling analytics. Events are retained for at most 24 months. PostHog is US-based, while EU Cloud data is stored in Frankfurt; possible support access is protected by its DPA and EU Standard Contractual Clauses.

Your rights

You may request access, correction, deletion, restriction, portability, or object to processing. Because App analytics is deliberately anonymous, we may be unable to locate a specific event (Art. 11 GDPR); disabling analytics stops future collection. Contact chris@eigenweltlabs.com.