Privacy Policy

• First name, last name, email address, phone number
• Encrypted password (bcrypt-hashed; never stored in plain text)
• Role within your organisation (User / Admin)
• Profile picture (optional)
• Account status and verification data

• Organisation name, slug, and status
• Organisation membership and role assignments

The Platform processes legal documents you upload, including PDFs, Excel files, and national legislative texts. These documents may contain personal data if referenced in the legislation (e.g., named individuals in legal instruments). We process this content solely to provide the AI-assisted legal analysis services you request, including:

• EU directives and EFTA legal acts fetched from EUR-Lex and EFTA portals
• National transposition documents you upload
• Adaptation, amendment, auditing, and gold-plating analysis outputs
• Folder and file organisation metadata

• Features accessed and processing jobs created (job type, status, timestamps)
• Processing events and usage statistics per user and organisation
• Notification interactions

• IP address (captured at consent recording for audit purposes)
• Authentication tokens (JWT, stored in your browser's localStorage)
• Error and crash reports (via Grafana)
• Server-side access logs

• Record of acceptance of Terms of Service and Privacy Policy (timestamp, version)
• Cookie notice acknowledgement (stored locally)
• Contact-form privacy consent (timestamp, version, hashed email and IP)

When you submit the contact form on the public Treyst website (/api/contact), we collect the data fields you provide (name, email, optional phone, job title, organisation, country, subject, message) plus the recorded privacy consent. This data is forwarded to our CRM provider (HubSpot) for sales follow-up — see §5 and §6 for the transfer mechanism.

Cloudflare is used solely as a CDN, DNS provider and frontend host. The content of uploaded documents and AI processing data is never routed to or stored on Cloudflare; only minimal connection metadata (IP, request headers) is processed at the edge.

Even though almost all processing takes place in the EU, we apply the following safeguards aligned with EDPB Recommendations 01/2020:

• Encryption in transit — all API calls use TLS 1.2+ end-to-end.
• Encryption at rest — cloud storage and database backups are encrypted at rest in EU regions.
• Data minimisation — only the document content strictly necessary for the requested analysis is transmitted to AI providers; no account, identity or organisation data is sent. For contact-form leads, only the form fields you fill in are transmitted to HubSpot — no platform data, documents, or AI outputs.
• Contractual restrictions — providers are contractually prohibited from using transmitted content for model training, sub-licensing, or any purpose beyond fulfilling the API request or, in HubSpot's case, supporting our sales response.
• EU data-residency enforcement — Azure OpenAI, Google Vertex AI, AWS S3 and Azure Blob deployments are pinned to EU regions; we routinely audit configurations to detect drift.

Some EU-based sub-processors (notably Microsoft and Google) are ultimately part of US-headquartered groups. Where any incidental access from outside the EU/EEA could occur (e.g., for technical support), it is governed by the EU Standard Contractual Clauses (EU Commission Decision 2021/914) and the supplementary measures described above. A Transfer Impact Assessment (TIA) for these scenarios is available on request.

In addition to the time-based retention periods above, data is deleted or anonymised upon any of the following events:

Because uploaded documents are a core processing activity, the following lifecycle applies:

• Upload: Documents are stored in cloud storage (AWS S3 or Azure Blob) within an EU region. Each file is associated with the uploading user and organisation.
• Processing: When an AI analysis job is initiated, relevant document content is extracted and transmitted to the AI provider via API. Content is held in the provider's memory only for the duration of the API request (see §7.4 below).
• Retention: The original file is retained in cloud storage for 12 months from the upload date.
• Early deletion: Users may delete any document at any time via the Platform interface. Organisation administrators may delete all documents within their organisation.
• Automatic purge: Documents exceeding the 12-month retention window are permanently deleted by an automated daily process. Deletion is irreversible.
• Account or subscription termination: All documents are permanently deleted within 30 days of account deletion or subscription termination.

Document content transmitted to AI providers for analysis is subject to the following retention commitments, as established by our Data Processing Agreements (DPAs):

We select API configurations that minimise data retention at the provider level. No account, identity, or organisation data is transmitted to AI providers — only the document content required for the requested analysis.

Database backups are retained for a maximum of 30 days on a rolling basis for disaster recovery purposes. Backups are encrypted at rest and stored in EU-region infrastructure. When data is deleted from the live database (e.g., following an account deletion request), the deletion propagates to backups as they rotate out within the 30-day window. No data is restored from backups except in the event of a system failure.

After the applicable retention period, data is securely deleted or irreversibly anonymised using methods appropriate to the storage medium. Account deletion requests are processed within 30 days in accordance with GDPR Art. 17.

When you delete your account, all personal identifiers (name, email, phone number, profile picture) are irreversibly replaced with non-reversible placeholders and your uploaded documents are permanently removed from storage. The anonymised account record is retained solely to preserve referential integrity of audit and consent logs, but cannot be linked back to any identifiable person.

Cookies are small text files stored on your device by your browser. We also use browser localStorage for certain technical purposes. Both are described below.

These are essential for the Platform to function. They do not require consent under the ePrivacy Directive.

Google reCAPTCHA cookies (_GRECAPTCHA, NID) are only set if you focus or interact with the public contact form. The reCAPTCHA script is not loaded on any other page or section.

This platform does not use analytics, marketing, or tracking cookies. You can view cookie details at any time via the "Manage Cookies" link in the footer, or by adjusting cookie settings in your browser. Disabling necessary cookies may impair Platform functionality.

For more information about cookies in general, visit allaboutcookies.org.

In its capacity as data processor, Treyst commits to the following under GDPR Art. 28(3)(g):

• Retention during subscription: Uploaded documents and AI processing outputs are retained only for the duration specified in §7.1, or until earlier deletion by the controller.
• Data return on termination: Upon subscription termination, the controller may request an export of all data (documents, AI outputs, account data) in a structured, machine-readable format (JSON) within the 30-day post-termination window.
• Data deletion on termination: After the 30-day post-termination window (or immediately upon written instruction from the controller), all personal data processed on behalf of the controller is permanently deleted from live systems. Database backups containing such data rotate out within 30 days (see §7.5).
• Sub-processor retention: Treyst ensures that all sub-processors (including AI providers) delete or return personal data upon termination of the sub-processing relationship, as required by the DPA chain. AI provider data persistence is described in §7.4.
• Certification of deletion: Upon request, Treyst will provide written confirmation that all data processed on behalf of the controller has been deleted, unless retention is required by EU or member state law.