Privacy and security
What happens to your data, step by step.
This page shows where your data lives, who receives it, how long we keep it and what is encrypted.
The legally binding text is the privacy policy (German only).
Servers in Germany
One dedicated server
Klaracase runs on a dedicated server at Hetzner in Germany. The database and the search index run on the same server.
Backups in Frankfurt
Backups of your data are stored at Amazon Web Services in Frankfurt (region eu-central-1).
What is encrypted
We name only what is really encrypted.
On the way to you
Every connection to Klaracase uses TLS 1.2 or 1.3. Our server tells your browser to connect only over an encrypted connection from then on (HSTS). The connections to third-party search services use HTTPS too.
In our database
These are stored encrypted: the texts you submit for a check, the text of uploaded documents, your search history, invitation tokens and the secrets of two-factor sign-in. We store passwords only as a hash, never in plain text.
In backups
We encrypt backups of your data, meaning the database and the file storage, on our server before they are uploaded.
Where your data goes
For each function: what can leave the server, who receives it and where the recipient is based.
Hosting and backups
What is sent
Your data lives on our server. Encrypted backups go to Frankfurt.
Recipient
- HetznerGermanyRuns our server.
- Amazon Web ServicesLuxembourgStores encrypted backups (S3) and sends email (SES).
Research
What is sent
The text of your search query, nothing else. No documents and no account data.
Recipient
- OpenAIUSATurns the search query into a vector of numbers (embedding). In the laws section the service also rewrites the query in legal terms. Training on your data: excluded by contract.
- Voyage AIUSACreates a second embedding of the query in the laws section. Training on your data: can be switched off, and we have switched it off.
- Jina AIGermany, part of the Elastic groupRe-ranks the results. Receives your query and text excerpts from the public corpus. Training on your data: excluded by contract.
Citation Check
What is sent
Your text is processed on our server only, with no AI services.
Recipient
Only single docket numbers of published decisions can go to an external case-law database for a lookup, never your text.
Email
What is sent
Your email address and the content of the message, for example at registration or a password reset.
Recipient
- Amazon Web ServicesLuxembourgStores encrypted backups (S3) and sends email (SES).
Payment
What is sent
Name, payment method, billing address, amount and IP address. The payment runs on a page hosted by Stripe.
Recipient
- StripeIreland and USAProcesses payments. Only during checkout.
Bot protection
What is sent
Your IP address and technical features of your browser. Only at sign-in, registration, password reset and when creating an organization.
Recipient
- CloudflareUSAChecks with Turnstile whether a request comes from a human.
Statistics
What is sent
Pages viewed, time on page, and browser and device data. Public pages only, never the signed-in area. Without your consent the software counts without cookies; it sets a cookie only with your consent.
Recipient
Matomo, run by us. No third party receives this data.
How long we keep data
- Check texts (Citation Check)
- We delete your text and the individual findings after 90 days at the latest. Only counts remain, without any text.
- Uploaded documents
- The text of a document that goes into no check is deleted after 48 hours.
- Search history
- Until you delete your account. There is no shorter period yet.
- Data export
- An export is available for download for 72 hours and is deleted afterwards.
- Account deletion
- Your account is locked as soon as you ask. After 14 days we delete the data for good. Until then you can withdraw the request.
- Backups
- Our rolling backups are replaced after 210 days at the latest. Copies from before a deletion age out this way.
- Invoices
- We keep invoices for ten years because tax law requires it. Deleting your account does not remove them.
Export and deletion
You can export your data and delete your account at any time. Both are in the settings after you sign in.
Enterprise
For confidential matters we process search queries on request without any external AI service.
The legally binding text
The privacy policy names every recipient with address, purpose and legal basis. This page summarizes it in plain words. The policy is available in German only.