Privacy policy

Last updated: 2026-10-09 · Draft – have it reviewed before launch.

1. Who is responsible

Controller: [Operator legal name], [Address, Belgium], VAT [BE0xxx.xxx.xxx]. Contact: support@example.com.

2. What we process and why

• Letters you upload (photos/PDF). They may contain personal data and special categories of data (e.g. health, social benefits, debts). Purpose: to explain the letter to you. Legal basis: performance of the service you request (Art. 6(1)(b) GDPR) and your explicit consent (Art. 9(2)(a) GDPR), which you give with the checkbox before upload. You can withdraw consent at any time by not using the service; processing already completed is not affected.
• Files are never stored. They are held in server memory only for the seconds needed to analyse them and are then discarded. They are not written to disk, databases or logs.
• The explanation (AI output) is stored encrypted for at most 1 hour so you can unlock it after payment. The decryption key stays in your browser; we cannot read the stored copy. It is deleted as soon as you open it, or automatically after 1 hour.
• Anonymous wallet: a random identifier stored in your browser (localStorage) and your credit balance on our server. No name or account is needed.
• Email (optional): used by the payment provider for your receipt; we keep only a one-way hash to let you restore credits together with your payment reference.
• Askerlik tool: dates and petition fields are processed to compute the result and are not stored on our server.
• Payment data is processed by the payment provider; we never see your card or bank details.

3. Processors (sub-processors)

• Cloudflare, Inc. – hosting, serverless functions, key-value storage (EU/global network).
• OpenAI, L.L.C. (USA) or Anthropic PBC (USA) – AI analysis of the letter, via API, with no training on API data; we request zero/limited data retention where available. Transfers to the USA rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses.
• Mollie B.V. (Netherlands) / Stripe Payments Europe Ltd. (Ireland) / Lemon Squeezy LLC (USA, merchant of record) – payment processing; the provider actually used is shown at checkout.

4. Retention

Uploaded files: not retained. Encrypted result: max 1 hour. Wallet: until you delete it or 24 months of inactivity. Payment records: kept by the payment provider and by us as required by Belgian accounting law (7 years) – only the transaction, not the letter.

5. Your rights

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Delete your wallet instantly on this page or email us. You may complain to the Belgian Data Protection Authority (dataprotectionauthority.be).

6. AI disclosure

Explanations and reply drafts are generated by an AI system (EU AI Act art. 50 transparency). They can be wrong. Always check against the original letter.

7. Cookies

We use no tracking or advertising cookies. We use browser localStorage/sessionStorage only for your anonymous wallet ID, language choice and the pending result key.