Last updated: 2026-10-01 (version 2026-10-22)
The data controller for the Avokati AI service ("the Service") is the entity shown below. Business details are loaded from our registered configuration; if they read "Business details pending" the operator has not yet published them.
This policy is governed by the law of the Republic of Albania (Law No. 9887/2008 "On the protection of personal data", as amended). If you are in the European Union or EEA, the rights described in section 7 apply to you as set out in the General Data Protection Regulation (GDPR).
This inventory is derived from the actual database schema and is kept in sync with the internal data map.
| Category | Data | Where it lives |
|---|---|---|
| Account | email, username, avatar, the terms version you accepted and when | users |
| OAuth identity | provider email and provider user id (Google / GitHub) | oauth_accounts |
| Conversations | the questions you ask and the answers generated | conversations, messages |
| LLM call log | query text, token counts, model, latency | llm_calls |
| Security audit log | IP address, user agent, action | audit_log |
| Site analytics | page URL, referrer, viewport size, scroll depth and time on page — no cookies and no cross-site identifier | PageViews.ai (processor) |
| API key usage | IP address, key id, endpoint | api_key_usage_logs |
| Rate limiting | user / key id and request counters | rate_limit_logs |
| Email delivery log | recipient address, email type, delivery status | email_logs |
| Login tokens | magic-link token hash and email | magic_tokens |
| Business profile | business name and your free-text description | business_profiles |
| Uploaded documents | files you upload to a personal knowledge base and their extracted text | knowledge_bases |
| Research artefacts | bookmarks, saved searches, legal alerts | bookmarks, saved_searches, legal_alerts |
| Quotas | token budgets and usage | token_budgets |
| Feedback | ratings and comments you leave on answers | message_feedback |
We do not process special categories of data on purpose. Do not put health, criminal or other sensitive personal data of third parties into your questions or uploads unless you have a lawful basis to do so.
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the Service: accounts, login, answering your questions, history, uploads, bookmarks, quotas | account, OAuth identity, conversations, business profile, uploads, research artefacts, quotas, login tokens | Performance of a contract (GDPR art. 6(1)(b)) |
| Security, abuse prevention, rate limiting, cost accounting, incident response | security audit log, API key usage, rate limiting, LLM call log | Legitimate interest (GDPR art. 6(1)(f)) in keeping the Service secure and fairly used |
| Understanding how the site is used (page views and clicks) | site analytics events | Legitimate interest (GDPR art. 6(1)(f)); the analytics are cookieless and do not identify you across sites |
| Transactional email: login links, account and security notices | email address, email delivery log | Performance of a contract |
| Non-transactional email: product updates, legal alerts digests | email address, email preferences | Consent (GDPR art. 6(1)(a)); withdraw at any time via the unsubscribe link or /api/v1/email preferences |
| Improving answer quality from your feedback | message feedback | Consent — the feedback field is optional |
| Keeping a record of deletion and of unsubscribe requests | erasure log (email hash only), email opt-outs | Legal obligation (GDPR art. 6(1)(c)) |
We use the following providers. We never sell personal data.
| Processor | Purpose | Data sent | Location |
|---|---|---|---|
| OpenAI | Answer generation and text embeddings | Your queries, the law text retrieved for them, text of documents you upload, and your business profile text when relevant. Not used to train their models. | United States |
| Resend | Email delivery | Your email address and the email content | United States |
| Cloudflare | Edge network, TLS, DDoS protection | IP address and request metadata | Global edge network |
| PageViews.ai | Website analytics (page views, clicks) | Page URL, referrer, viewport size, scroll depth, time on page. No cookies, no cross-site identifiers. | European Union [operator: confirm hosting region in the provider's DPA] |
| Telegram | Operator alerting | Error text and technical identifiers only; user content is never sent by policy | Global |
| Jina reranker | Re-ranking retrieved passages | Runs as a local model on our own servers — no data leaves | Self-hosted |
Google and GitHub act as identity providers when you choose to sign in with them; they receive only the sign-in request, governed by their own policies.
OpenAI and Resend process data in the United States. Transfers to them rely on Standard Contractual Clauses incorporated in each provider's data processing agreement. Everything else is processed on our own servers or on Cloudflare's edge network under Cloudflare's data processing terms.
The values below are the exact configured limits enforced by our retention jobs.
| Data | Retention | What happens after |
|---|---|---|
| Query text in the LLM call log | 90 days | query text is erased; anonymous token counters are kept |
| IP address and user agent in the security audit log and API key usage log | 90 days | set to null |
| Rate limiting records | 30 days | deleted |
| Recipient address in the email delivery log | 90 days | replaced with a hash |
| Expired magic-link login tokens | 7 days | deleted |
| Account, conversations, uploads, bookmarks, profile, quotas, feedback | Life of the account | deleted when you delete the item or the account |
| Erasure record (email hash and row counts only) | 3 years [operator: confirm] | deleted |
| Database backups | up to [operator: confirm backup retention] days | backups roll over; they are restored only for disaster recovery |
Under Albanian data protection law, and under the GDPR if you are in the EU/EEA, you have the right to:
DELETE /api/v1/users/me (also available from account settings), or ask the privacy contact below. We complete erasure within the 30-day statutory window and keep only an erasure record (a hash of your email and the row counts) as proof.We answer rights requests within 30 days. We may ask you to confirm your identity (normally by replying from the account email).
We use only strictly necessary cookies. Our website analytics (PageViews.ai, listed in section 4) set no cookies and use no cross-site identifiers, so no tracking or advertising cookies exist and no cookie consent banner is shown.
| Cookie | Purpose | Lifetime | Flags |
|---|---|---|---|
access_token | Session authentication (JWT) | 24 hours | HttpOnly, SameSite=Lax, Secure in production |
csrf_token | Protection against cross-site request forgery (double-submit token) | 24 hours | HttpOnly, SameSite=Lax, Secure in production |
Your interface language is remembered in your browser's local storage; it is never sent to us.
Connections are encrypted (HTTPS). Passwords are never stored in clear text; login is passwordless by default. Login tokens are stored hashed. Access is rate limited, security-relevant actions are audited, and OAuth access tokens from identity providers are not stored.
The Service is a professional tool for adults. We do not knowingly offer it to, or collect data from, anyone under 18. If you are in the EU and under the age of digital consent in your country (GDPR art. 8), you may not create an account. Contact us if you believe a minor has registered and we will delete the account.
Each version is dated and numbered (see the line under the title). When we change this policy materially we bump the version, and you will be asked to accept the new version on your next sign-in; the version and time of your acceptance are recorded on your account.
To exercise your rights or ask about this policy, write to the privacy contact shown in the business details below. If a dedicated privacy address is not shown, use the general contact address.