LegalMike

GDPR overview

GDPR implementation is stated explicitly and in concrete terms. LegalMike declares compliance with the AVG and with the AI Act, where an independent assessment classified it as a limited-risk AI system meeting the article 4 (AI literacy) and article 50 (transparency) obligations. The data processing agreement is not a separate document but article 9 of the general terms version 1.1, in force since 11 February 2026: it grants the customer an audit right (30 days' written notice, at its own cost) and sets breach notification at 72 hours maximum. Data subject rights listed are access, rectification, erasure, restriction, objection and portability, with privacy@legalmike.ai as the contact point and the Autoriteit Persoonsgegevens as supervisory authority. A processing register is kept internally, and privacy by design and by default are claimed. No article 27 representative is designated, the publisher being established in the EU.

Who owns the data?

Under the general terms (art. 8.4), the customer keeps its intellectual property rights over the input it submits and receives an irrevocable right of use over the output. LegalMike acts as processor for the web application, the customer as controller. Stored questions, answers and uploaded files are encrypted inside the customer's own environment and accessible to that customer alone; users delete their history and files at any time, and an organisation can disable uploads entirely. The publisher only obtains a licence over input and output where end users explicitly opt in to service improvement, and article 8.8 forbids using the output to develop models, algorithms or software.

Reuse rights

The customer receives an irrevocable right of use over the output and keeps its rights over its own input, so answers and drafts can be reused in its own files, memos and letters without asking permission. Two limits apply: the contractual duty to check everything, since the terms state the output is not necessarily correct, and article 8.8, which forbids using the output to develop models, algorithms or software. On the publisher's side, customer data is not used to train AI models, at LegalMike or at OpenAI, under a zero data retention agreement, and LegalMike has no default access to user data. The single exception is voluntary: if a user rates an answer and consents to that chat being opened, LegalMike's own lawyers may review the reasoning, for that chat only and for thirty days at most. Nothing is shared with third parties beyond contracted processors, except on official order or legal obligation.

Data retention & training

Hosting summary

All customer data is processed and stored within the European Economic Area, and the publisher states that this covers the whole chain: the customer database on servers in Amsterdam, processing by the language model, text extraction from uploaded documents, and back-ups. No transfer to countries outside the EEA takes place, according to the security page. The language models are hosted by OpenAI Europe through a European endpoint, and article 9.2 of the general terms commits the supplier to hosting services located in the European Union only. Back-ups are encrypted in two layers and kept in Europe, on a rotation of 7 daily, 4 weekly and 24 monthly copies, with restores tested periodically. One nuance deserves attention: the privacy statement mentions a processor outside the EU that handles telemetry data only, under GDPR export safeguards. That sits alongside the security page's blanket statement that no transfer outside the EEA occurs, and the site does not reconcile the two. The marketing site itself resolves to 85.10.159.223, in the Netherlands (AS34762 Combell NV), which is the brochure site's infrastructure and not the application hosting.