Privacy Policy

01Data controller

02What data we collect

AI Potential Audit (the test on the Reliability Audit page). Your answers and score are processed only locally in your browser. They do not reach our servers unless you click "Send result" yourself and confirm sending the email from your own mailbox.

Email correspondence. If you write to [email protected], we receive your address, your name (if you give it) and the content of the message. We use this data only to carry on the conversation.

Technical data. The hosting (Cloudflare Pages) keeps standard server logs: IP address, browser headers and request time. They serve to detect failures and attacks. We do not use them for profiling or marketing.

Visit statistics. We want to know which content people need, so we count page visits and file downloads. For each visit we record only:

• the time of the visit and the address of the page visited, including when the page does not exist,
• the campaign label from the link (the src or utm_source parameter), if the link has one,
• where the visit came from - only the name of the service (e.g. LinkedIn, a search engine, an AI assistant), and for a file download also our page from which the click came,
• country, device type (phone or computer) and the first language set in the browser,
• who visited: a person, an AI assistant fetching the page at someone's request, or another automated agent (e.g. a search engine),
• network type: home or office, or data centre.

Cloudflare determines the country and network type from the IP address at the moment of the visit, but the IP address itself does not enter the statistics. We use no cookies or identifiers here and we do not link visits into one person's history. We record the network operator's number (the so-called ASN) only when the visit comes from an automated agent or a data centre. For visits from home and office networks we leave it out, because in a small firm with its own network it could point to a specific office.

Page views and page speed. The pages also run the Cloudflare Web Analytics script. It counts page views and measures how fast the page loads: it records the page address, the source of the visit, the browser and device type and the country. It uses no cookies or browser storage and does not track you on other companies' websites.

Repertorium search (on the home page and on the Repertorium page). This is a test release and we want to know what lawyers look for in it, so we store the text of the queries you enter. Along with it we keep the kind of query, the chosen scope (Polish law or EU law), the number of results, the response time and the list of documents shown. All of it goes under one shared label for the website, without a name, IP address or personal identifier, so queries cannot be linked into the history of one person. Before storing, we remove PESEL and NIP numbers, bank account numbers, email addresses and phone numbers from the query. After 90 days we delete the query text and only the data without content remains.

To prevent abuse of the search without an account, we count a daily query limit. For this we record a hash of the IP address (SHA-256) with the date, not the address itself.

Do not enter client data or case details in the search field. The search covers public sources of law and we store the queries, so it is not a place for information covered by professional secrecy.

Repertorium access key (form on the website). We issue the key without an account. If you give an email address, we store it with the key so that we can contact you about your access. The field is optional. We store the key itself only as a hash (SHA-256). We do not store the text of queries made with the key. For each call we record the same technical data as for an account (described below), without the query text.

Repertorium account (connector in Claude, ChatGPT and Microsoft Copilot). When you connect Repertorium to your AI assistant, you sign in with your email address, to which we send a 6-digit code. We store:

• your email address (one address is one account),
• hashes (SHA-256) of your IP address and email address, used for the limit on sending codes,
• the sign-in code, only as a hash and only for 15 minutes,
• for each tool call: the tool name, time, result (status, number of hits, response time), kind of query (case number or provision, short keywords or a full sentence), word-count range, chosen jurisdiction, and the name and version of the program you connect with. Account limits depend on this data, and we measure service quality with it.

Search text on the free account. We store the text of your searches to improve the database - what lawyers look for, where results fall short, what the corpus lacks. Each stored query keeps the list of documents shown and is linked to your account. We do not store briefs or texts sent for citation checking, nor document contents. Before storing, we remove PESEL and NIP numbers, bank account numbers, email addresses and phone numbers from the query. After 90 days we delete the query text and only the data without content remains. This applies to free accounts created from 13 October 2026. On paid plans we do not store search text. Even with this cleaning, do not enter client data or case details in searches.

AI assistant. Your query and our answer also reach the company that runs your AI assistant (Anthropic, OpenAI or Microsoft). That company processes them as a separate controller, under its own privacy policy.

03Legal basis and purpose of processing

We process data on the basis of:

• Article 6(1)(b) GDPR - steps taken at your request before entering into a contract (e.g. replying to an enquiry, preparing an offer) and providing the Repertorium service (access key, account and connector) under the Repertorium terms of service
• Article 6(1)(f) GDPR - our legitimate interest (contact with people who wrote to us themselves; defence against claims; infrastructure security; visit statistics that tell us which content and tools to develop; measuring the quality of the Repertorium search and protecting it against abuse, including limits on sending sign-in codes and keeping the address of an account blocked for breaching the terms; improving the database on the basis of search text on the free account)

04Recipients of data

Your data may be shared only with entities necessary for the service to work:

• Cloudflare, Inc. - website hosting, server logs, protection against attacks, storage of visit statistics (Cloudflare Analytics Engine) and of the Repertorium search counter, statistics and stored queries, sending sign-in code messages (Cloudflare Email Service) and storing Repertorium account sign-in data. Cloudflare is our processor under the EU standard contractual clauses (SCC).
• Google LLC - operator of the [email protected] mailbox (Google Workspace). This concerns only correspondence sent to that address.

We do not sell data. We do not share it for third-party marketing. Transfers to the USA take place on the basis of the EU standard contractual clauses approved by the European Commission.

05Retention period

• Email correspondence: up to 24 months from the last contact (unless you request earlier deletion)
• Cloudflare technical logs: according to Cloudflare's policy (usually 30 days)
• Visit statistics: up to 3 months, after which Cloudflare deletes them automatically
• IP address hash for counting the daily search limit: up to 48 hours
• Text of Repertorium search queries: up to 90 days, after which we delete the query text
• Repertorium account sign-in code (as a hash): 15 minutes
• Hashes of IP address and email address for the code-sending limit: up to 24 hours
• Connection between the connector and your AI assistant: 30 days from last use (then you sign in again)
• Date and time of each tool call, kept to count limits: 90 days (the longest limit is counted over 30 days)
• Technical data of tool calls (without query text): 395 days, i.e. 13 months - needed to compare service quality year on year
• Search text on the free account: up to 90 days, after which we delete the query text
• Email address of a Repertorium account and of a form key: 30 days after access expires
• Email address of an account blocked for breaching the terms: for as long as the block lasts, so that it cannot be bypassed with a new account
• Contract data (after signing): 6 years (accounting requirements and limitation of claims)

06Your rights

You have the right to:

• access your data and receive a copy
• rectification of your data
• erasure ("the right to be forgotten")
• restriction of processing
• object to processing based on Article 6(1)(f)
• lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl)

To exercise any of these rights, write to [email protected]. We reply within 30 days.

07Cookies and browser storage

The website does not use cookies to track users. We have no Google Analytics, Facebook Pixel, Hotjar or any other marketing tracker. The visit statistics described in section 02 run on the server side, and the Cloudflare script for page views and speed runs in the browser, but neither stores anything in it.

Academy modules may store your learning progress, meaning the steps you have ticked, in your browser (the localStorage mechanism), so that you do not lose it when the page reloads. This data stays only with you and you can delete it at any time in your browser settings.

When you connect Repertorium to an AI assistant, we set two technical cookies without which sign-in does not work: __Host-repertorium-logowanie (the session between entering the code and approving access, 15 minutes) and __Host-oauth-consent-... (binds the consent form to your browser, 10 minutes). They are not used for tracking, do not go into statistics and expire on their own.

08Automated decisions and profiling

We do not make automated decisions about you or profile you within the meaning of Article 22 GDPR. The visit statistics create no profiles: we count each visit separately, without a personal identifier.

09Voluntary provision of data

Providing data is voluntary, but necessary to receive a reply to an enquiry or to prepare an offer.

10Changes to this policy

This document may be updated. The date of the last update and the version number are given at the bottom of the page.

What PATRON, Repertorium and this website do with data, with evidence in the code for every statement and a list of what is only planned: Where your data is.