Privacy Policy

Last updated: 2026-08-15

1. Controller

The data controller is [Raison sociale — à compléter], [Forme juridique et capital — à compléter], registered office [Adresse du siège social — à compléter], registration number [N° registre de commerce — à compléter].

For any question about your data: privacy@legal-index.com.

2. Principle

We process the minimum data necessary to operate the Service. We do not use your documents, conversations or knowledge bases to train artificial-intelligence models, ours or third parties'. We do not sell personal data.

3. Data processed

Category	Examples	Source
Identification	name, email address, hashed password, language	you
Account and organisation	teams, roles, seats, invitations	you
Content	uploaded documents, knowledge bases, conversations, agents you build, generated files	you
Usage	request timestamps, models called, credits consumed, error logs	automatic
Billing	plan, payment history, transaction identifier	you / provider
Technical	IP address, browser type, session cookies	automatic
Integrations	access tokens for services you connect, encrypted at rest	you

4. Purposes and legal bases

Purpose	Legal basis
Providing the Service and executing your instructions	performance of contract
Managing your account, teams and access	performance of contract
Billing and fraud prevention	performance of contract / legal obligation
Security, incident tracing, abuse prevention	legitimate interest
Improving reliability (aggregate measurement)	legitimate interest
Informing you of material changes	legitimate interest
Sending marketing communications	consent, revocable at any time

5. Processors and recipients

To provide the Service, certain data is transmitted to processors acting on our instructions:

• AI model providers (depending on the model selected) to execute requests;
• payment providers (Stripe) for transactions;
• the hosting provider of the infrastructure;
• optional services you enable: voice synthesis and dubbing, outbound telephony, web search and extraction engines, services connected through your integrations.

These providers are bound by confidentiality and security commitments. Requests sent to model providers are transmitted without training use, in line with their business offerings.

In an on-premise deployment, no data leaves your infrastructure: models can run locally and outbound access can be disabled.

6. Transfers outside the country of origin

Some processors are established outside the country where the data originates. Such transfers are covered by appropriate safeguards (standard contractual clauses or an equivalent mechanism). A copy is available on request.

7. Retention

Data	Period
Account and content	while the account is active
After account deletion	erased within 30 days; encrypted backups purged within 90 days
Technical and security logs	12 months
Accounting and billing records	applicable statutory retention period

You can delete a conversation, a document or a knowledge base at any time; deletion is immediate on the application side.

8. Security

Encryption in transit; integration secrets and tokens encrypted at rest; strict partitioning by account and organisation; code executed in an isolated sandbox with no network access; filtering of outbound access; access logging; revocable token authentication and global session invalidation on password change.

No system is infallible. In the event of a personal-data breach likely to result in a high risk to your rights, you will be informed without undue delay, in accordance with applicable regulation.

9. Your rights

Under applicable regulation — in particular Regulation (EU) 2016/679 (GDPR) and Algerian Law No. 18-07 on the protection of natural persons in the processing of personal data — you have the following rights:

• access to your data and its origin;
• rectification of inaccurate data;
• erasure of your data;
• restriction of or objection to processing;
• portability of your data in a structured format;
• withdrawal of consent at any time, for processing that depends on it;
• complaint to the competent supervisory authority.

These rights may be exercised from your settings or by email to privacy@legal-index.com. We respond within one month at most.

10. Cookies

We use only the cookies and local storage necessary to operate: maintaining the authenticated session, language and theme preference, and abuse protection. No advertising cookie or third-party marketing tracker is set. These strictly necessary cookies do not require prior consent.

11. Minors

The Service is not intended for persons under 16. We do not knowingly collect data concerning them. Any such account reported to us is deleted.

12. Automated decisions

The Service produces automatically generated output but takes no decision producing legal effects concerning you without human intervention. Sensitive actions triggered by an agent may be subject to explicit human approval.

13. Changes

This policy may change. Any material modification is brought to your attention by appropriate means before it takes effect.

14. Contact

For any question or to exercise your rights: privacy@legal-index.com.