NeoJuris

GDPR overview

Implementation is explicit but partial. The homepage carries a DSGVO Konform trust badge and the publisher claims to be fully GDPR compliant. The privacy policy, effective 20 January 2026, lists the seven data subject rights with their articles — access (15), rectification (16), erasure (17), restriction (18), portability (20), objection (21) and complaint to a supervisory authority (77) — all exercised through datenschutz@neojuris.ai. It states that all data is stored and processed on servers within the EU, and describes SSL/TLS encryption at the highest level the browser supports plus technical and organisational measures. What the document omits matters as much: it designates no data protection officer, sets no retention period, publishes no sub-processor list beyond naming Supabase, and mentions no data processing agreement. The publisher also declares itself neither willing nor obliged to join consumer dispute resolution proceedings.

Who owns the data?

The privacy policy, dated 20 January 2026, names NeoJuris, Börsegasse 11, 61-63, 1010 Wien, as the controller, with datenschutz@neojuris.ai as the dedicated contact. The document designates no data protection officer and, the publisher being established in the EU, no Article 27 representative. It lists what is gathered at sign-up: first and last name, email address, an optional firm name, and a password stored in encrypted form. Nothing in the published documents states who owns the documents a client uploads, or what the publisher may do with them and with whom: the general terms, where such a clause would normally sit, are not publicly accessible.

Reuse rights

For use of the platform the policy invokes Article 6(1)(b) GDPR, performance of a contract. Connection data is collected automatically: IP address, date and time, the name and URL of the file requested, the referring URL, the browser and the operating system. Cookies are split into three categories — necessary, analytics and marketing — the last two subject to consent gathered through a preference banner, and Google Analytics is present, loading with consent denied by default for ad_storage and analytics_storage. On its public prototype page the publisher describes a flywheel effect in which the AI learns continuously from your cases and grows more accurate with use, and an unpublished Enterprise tier mentions bespoke training on a firm's own data. The veiled product pages state the reverse, describing a zero-knowledge architecture in which NeoJuris has no access to sensitive content. The site does not resolve that contradiction. No opt-out from training is documented anywhere in the published material, so a customer has no written basis for reusing or restricting the material they feed in.

Data retention & training

Hosting summary

A public trust badge on the homepage reads “AT & EU — Datenhaltung — Österreich & EU-Server”. On its about page the publisher states that client data stays in Austria and that everything is hosted exclusively in Austrian or EU data centres, explicitly contrasting this with US cloud solutions. Section 6 of the privacy policy names a single third party, Supabase, as the host of the site, described as running its servers in the EU and working in line with the GDPR. The wording is not uniform: the FAQ of the veiled pricing page asserts storage exclusively on GDPR-compliant servers in Austria, which is stricter than the privacy policy's “within the EU”. Two further elements sit outside that framing: the Murmur prototype ran on Google Cloud Run in the europe-west1 region, in Belgium, although that URL returned 404 on 5 September 2026, and the marketing site itself is published on Figma Sites and served behind Cloudflare. No independent certification of any of these arrangements is published.