Privacy policy

1. Controller

Controller

Klartext AI FlexCo

Address

Lerchenfelder Straße 74/2/7, 1080 Wien, Austria

Email

doclarity@klartext-ai.com

Phone

+43 660 81010 67

We have not appointed a data protection officer, because the conditions in Art. 37 GDPR are not met. Please direct all data protection matters to the email address above.

2. Two roles – please read first

doclarity handles two very different kinds of data, and our role is not the same for both.

• Account, organisation and billing data. Here we are the controller under Art. 4(7) GDPR. This notice describes that processing in full.
• The content of uploaded documents. If you upload documents containing other people's personal data as a business or public body, you are the controller for that content and we act as your processor, strictly on your instructions. The basis for that is the data processing agreement, which forms part of our contract.

If you use doclarity as a private individual for your own documents, we are the controller for their content too.

3. Visiting our website and contacting us

When you open our pages, our server processes the connection data it needs to serve them: IP address, date and time, the resource requested, the HTTP status code, the amount of data transferred and the identifier your browser reports (user agent). This is unavoidable in delivering a page and serves secure, stable operation.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is running the service and defending against attacks. Logs are deleted after 14 days at the latest, unless a specific security incident requires keeping them longer.

We use no analytics, tracking or advertising services. There is no Google Analytics, no Matomo, no pixels and no social network embeds. That is also why this website has no cookie banner: there is nothing to consent to.

Contacting us

If you contact us by email or by telephone, for example using the contact details in section 1 or the contact option for our Enterprise offering, we process the details you send us: usually your name, email address, where applicable your organisation and telephone number, and the content of your enquiry.

Our Enterprise offering cannot be booked online. For it the website points to an email address only; no registration and no sign-in via single sign-on takes place.

The purpose is to deal with your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry is directed at concluding or performing a contract, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in answering enquiries.

We keep the correspondence until your enquiry has been dealt with conclusively. Business correspondence is additionally subject to the statutory retention obligations.

4. Cookies

We set only strictly necessary cookies. No consent is required for these under § 165(3) of the Austrian Telecommunications Act 2021.

5. Account and organisation

Using doclarity requires an account. For it we process: name, email address, password (only as a cryptographic hash), chosen language, account role and status, organisation membership, and – for signed-in sessions – the session's IP address and user agent.

The legal basis is Art. 6(1)(b) GDPR (performance of the user contract and pre-contractual steps).

Invitations to an organisation. If your account belongs to an organisation, an authorised person there can invite you. In that case we receive your data not from you but from the inviting organisation: usually your email address, and where applicable your name and the role envisaged for you. We use these details to send you the invitation and to set up your account. The legal basis is Art. 6(1)(b) GDPR in conjunction with the contract with your organisation, together with Art. 6(1)(f) GDPR; our legitimate interest lies in providing the agreed access. When we send the invitation we inform you about this processing and about the source of your data (Art. 14 GDPR). If you do not accept the invitation, we delete the details after 30 days. The inviting organisation is responsible for the lawfulness of passing your data to us.

Deleting your account

You can delete your account at any time. On deletion we remove your documents and their contents. A reduced record of contract and billing data is kept for as long as statutory retention and limitation periods require; see the retention overview for details.

If your account belongs to an organisation and you are removed from it, the documents you uploaded stay with the organisation. There they can be deleted by a person holding the Owner role.

Inactive accounts

If you do not use your account for 24 months, we contact you by email 30 days beforehand. If you do not respond, we delete the account together with the documents stored in it.

6. Processing your documents

This is the heart of the service. When you upload a document:

• The file is stored in our object storage in Amsterdam, Netherlands.
• Files in formats other than PDF, that is Word, PowerPoint and OpenDocument files, are first converted to PDF; for scanned originals we obtain the text through text recognition. Both happen on our own infrastructure.
• The application analyses structure, text and layout. Page content is sent to Google Vertex AI in the EU multi-region to detect the logical structure. Zero data retention is enabled for this processing: content is held only for the duration of processing, is not stored at Google, and is not used to train models.
• The result – the detected structure and the tagged PDF – is written back to our object storage so you can review, edit and download it.

Processing outside the EU at your request

By default we process your documents exclusively within the European Union. You can additionally activate worldwide processing in your account settings. The contents of your documents are then transmitted to data centres operated by Google Cloud EMEA Limited (Vertex AI) outside the EU, worldwide, including in the United States. The only reason for this is speed: more capacity is available, so results arrive sooner.

The option is deactivated by default. We never activate it ourselves. Only a person holding the Owner role can activate and deactivate it. On personal accounts you are the Owner yourself and can therefore set the option yourself. The option is available on all plans, including the free plan. It can be deactivated again at any time with effect for the future; processing already under way is completed.

Zero Data Retention remains active for worldwide processing as well: contents are held only for the duration of the processing, are not stored and are not used to train models. Your documents continue to be stored exclusively in our object storage in Amsterdam.

What you should know. Countries outside the EU do not all offer a level of data protection equivalent to that of the GDPR. Public authorities there may have access rights that do not exist in the EU, and enforcing your rights may be more difficult. The transfer is safeguarded by the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR. Where these do not apply in an individual case, we rely on the explicit consent given under Art. 49(1)(a) GDPR when the option is activated in the knowledge of this information.

For accounts held by businesses and public bodies, activation by the Owner constitutes an instruction under Art. 28 GDPR. As controller, the organisation is responsible for ensuring it has a legal basis; consent from individual users does not replace this.

We record who activated or deactivated the option and when.

Retention: your documents stay stored until you delete them in the application. A document you are still working on does not disappear from under you; there is no automatic deletion clock for individual documents. If your account is deleted for inactivity (section 5), the documents stored in it are deleted with it. Deleting removes the original file, every intermediate artefact and the tagged result from object storage, along with the database record. Deleting your account deletes the documents linked to it.

Backups may still contain deleted data for up to 30 days. They are overwritten there on a rolling basis and are not restored in the meantime, except to recover from a system failure.

The legal basis is Art. 6(1)(b) GDPR; where we act for you as controller, Art. 28 GDPR applies together with the data processing agreement.

After the contract ends you have 30 days to download your documents. We delete them afterwards, or sooner on request (terms and conditions, § 6(5)).

Access by us. Beyond the automated processing, staff of Klartext AI FlexCo do not look at your documents. The exceptions are: you ask us to, for example to investigate a problem with a particular document, or you share an individual element for us to look at (section 12); consent under section 7 has been given (private individuals on the free plan only); or we are required to by law. The legal basis is Art. 6(1)(b) GDPR; where we act for you as controller, Art. 28 GDPR applies on your instruction. We record who shared which document or element and when, and make no copy.

One thing worth checking: before uploading, please consider whether a document contains special categories of personal data under Art. 9 GDPR – health data, for instance – and whether you have an appropriate legal basis for it.

If you contract as a private individual and your own documents contain health data or other special categories of personal data concerning you, such as medical reports, assessments or official decisions, we process that data solely in order to make those documents accessible. The legal basis is, in addition to Art. 6(1)(b) GDPR, your explicit consent under Art. 9(2)(a) GDPR. We ask for it at registration, through a separate field that is not pre-ticked. This applies regardless of the plan you choose.

This consent is a precondition for us to process documents containing such data for you. On the private access tier it is a precondition of the tier itself, because documents of exactly this kind are what it exists for.

You can withdraw your consent at any time with effect for the future, in your account settings or by email to doclarity@klartext-ai.com. Once withdrawn, you can no longer upload documents containing such data and we delete the documents concerned; on the private access tier this ends your access. We tell you before you confirm the withdrawal, so that you can download your documents first. Your account remains. This does not affect the lawfulness of processing carried out up to that point.

We record when you gave your consent and which version of the text you saw.

7. Free plan: additional processing for private individuals

If you use the free plan as a private individual, we process your documents beyond mere operation of the service in order to improve its quality. Specifically, these documents may

• be viewed by staff of Klartext AI FlexCo, and
• be analysed automatically by Anthropic PBC. This processing takes place under Anthropic's Commercial Terms, including a data processing agreement and the EU Standard Contractual Clauses; use for model training is contractually excluded.

This additional processing applies solely to documents uploaded by private individuals on the free plan and takes place solely with your consent. We ask for it separately at the point of upload, it is not buried in our terms and conditions, and it is not a precondition for using the free plan. The legal basis is Art. 6(1)(a) GDPR. Your consent covers your own data; please give it only for documents that contain no personal data relating to other people.

You can withdraw your consent at any time with effect for the future, in your account settings or by email to doclarity@klartext-ai.com. This does not affect the lawfulness of processing carried out up to that point.

If you contract as a business or public body, this processing does not take place, including on the free plan. The same applies to all paid plans. These documents are not transmitted to Anthropic and are viewed by us only in the exceptional cases set out in section 6.

8. Private access for blind and visually impaired people

Free private access is open to people with a visual impairment. It is granted on your self-declaration, which you give at sign-up (terms and conditions, § 7(6)); we store that declaration. We ask for no proof.

That declaration allows an inference about your health and is therefore a special category of personal data under Art. 9 GDPR. We process it solely on the basis of your explicit consent under Art. 9(2)(a) GDPR, which we obtain separately before activation, and solely to grant private access and prevent duplicate use.

The declaration is not passed to third parties and not evaluated for any other purpose. It is deleted once private access ends. You may withdraw your consent at any time; we cannot maintain private access if you do.

The legal basis remains your explicit consent under Art. 9(2)(a) GDPR. Unlike the consent in section 7, this one may legitimately be tied to the service: the attribute is the condition of the plan itself – without it there is no private access, whereas the free plan runs on unchanged without the section 7 consent.

This consent relates solely to proving your eligibility for the tier. It is separate from your consent to the processing of special categories of personal data contained in the documents you upload. We ask for the two separately.

9. Prospects and business contacts

In the course of developing business we process contact details of people at businesses, public bodies and organisations for which our offering may be relevant: name, function, organisation, business contact details, our correspondence with you, and notes on conversations. This data comes from you, from publicly available sources such as websites and professional networks, or from meeting you at events.

The purpose is to make contact and to maintain our business relationships. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in approaching potential customers and partners directly. Where we did not obtain your data from you, we inform you of that when we first make contact (Art. 14 GDPR).

You can object to this processing at any time (Art. 21 GDPR). An email to doclarity@klartext-ai.com is enough; we then make no further contact and record only that you objected.

We delete this data once it is no longer needed for the purpose, and at the latest 24 months after the last contact.

10. Payment processing

Paid plans are billed through Stripe Payments Europe, Ltd. (Dublin, Ireland). Payment details such as card numbers are collected and processed by Stripe directly; we neither receive nor store full card data. We process billing address, VAT number, payment status and invoice amounts.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (retention duties under the Austrian Commercial Code and Federal Fiscal Code).

11. Email

System emails – organisation invitations, password resets, status notifications – are sent through Scaleway Transactional Email, processed in Paris, France. doclarity sends no newsletter.

12. Feedback in the service

When you give us feedback on a result, we process your comment, any rating, the technical identifier of the affected element, and your account. We do not see the content of your document. You can additionally share the content of an individual element if you want us to look at it (terms and conditions, § 8(6) and (7)). Sharing only makes visible what we already store; we make no copy, and we record who shared which element and when. For business customers, sharing is an instruction under Art. 28 GDPR, not consent by the individual user.

The purpose is to improve the service. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the quality of the automated tagging. Please do not write personal data or document content into the free text field. We delete feedback and the record of shares after 24 months.

13. Processors

We use the following service providers. Art. 28 GDPR agreements are in place with all of them. This list is also the annex to the data processing agreement – it is maintained in one place so the two documents cannot drift apart.

Beyond these, we pass personal data on only where we are legally obliged to or where you have consented. We do not sell data.

14. Transfers to third countries

By default doclarity runs entirely in the EU: servers in Nuremberg, Germany; storage and database in Amsterdam, Netherlands; email in Paris, France; AI processing in Google Cloud's EU multi-region. Processing outside the EU takes place only where the worldwide processing option has been activated.

A transfer to a third country occurs in the following cases: in payment processing, where data reaches Stripe, Inc. in the USA; solely for private individuals on the free plan and only with their consent, for the quality analysis carried out by Anthropic PBC in the USA; only where the worldwide processing option is active, for the analysis of document contents by Google Cloud EMEA Limited (Vertex AI); in our email correspondence, where data reaches Google LLC in the USA; and in the management of prospect and business contact data by Notion Labs, Inc. in the USA. All of these are covered by the EU standard contractual clauses under Art. 46(2)(c) GDPR, and for worldwide processing, in the alternative, by your explicit consent under Art. 49(1)(a) GDPR (section 6). The transfers to Google LLC and to Notion Labs, Inc. concern contact and correspondence data only, not the contents of your documents.

15. Retention at a glance

16. Your rights

You have the following rights against us:

• Access to whether and which data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Portability in a common format (Art. 20 GDPR)
• Objection to processing we base on a legitimate interest (Art. 21 GDPR)
• Withdrawal of a consent, with effect for the future (Art. 7(3) GDPR)

An email to doclarity@klartext-ai.com is enough. We reply within one month. You can delete your documents yourself in the application at any time, without contacting us.

17. Right to complain

If you believe we are processing your data unlawfully, you can lodge a complaint with the supervisory authority:

Authority

Austrian Data Protection Authority

Address

Barichgasse 40–42, 1030 Wien

Email

dsb@dsb.gv.at

Website

https://www.dsb.gv.at

18. Changes to this notice

When the service changes, this notice changes with it. The date above tells you which version you are reading. We inform you about material changes before they take effect.