Trust center

Privacy policy

What we do with personal data, why, and on what basis. The purposes below are the things the product actually does — there is no entry for a feature that does not exist.

Last updated 6 October 2026 · Trust center

Who is responsible

REALTY.TM GROUP sp. z o.o., ul. Bpa Albina Małysiaka 26/15, 30-389 Kraków, Poland, entered in the National Court Register (KRS) under 0001219891. Write to privacy@clausebench.com.

Where we are the controller. Personal data about the people who use clausebench: the consultants and companies who hold accounts, the visitors who leave an address on our website, and the people who subscribe to our subprocessor notices.

Where we are the processor. Personal data inside a firm's workspace about that firm's own clients. There the firm is the controller and clausebench is the processor, acting on the firm's instructions; our model provider is a subprocessor.

What we use personal data for

To give you what you signed up for

Give you an account and a workspace: signing in, your firm, the colleagues you invite and what each of them may do.
Your email address, your name if you give one, your role in the firm, and the times you signed in.
Basis: contract.
Ask the interview questions, keep the answers you confirm, and draft the documents your regimes require from them.
Whatever you enter about a client or about your own company, and the documents drafted from it.
Basis: contract. Inside a workspace this is the firm's data and we act as its processor.
Answer a customer's security questionnaire from the documents in the same workspace, and keep the answer library that builds up.
The questionnaire file you upload and the answers drafted from your own documents.
Basis: contract.
Publish a trust page for you or your client, take document requests on it and pass them to you.
What you choose to publish, and the name, company and address of anyone who requests a document there.
Basis: contract.
Watch vendor pages daily, work out which of your clients a change touches, and tell you.
The vendors your clients use and the address we send the alert to.
Basis: contract.
Take payment for the subscription and issue invoices.
Billing name and address, VAT id, and the payment record. Card details are entered on Stripe's own form and never reach us.
Basis: contract, and a legal obligation for the invoice records themselves. Kept: invoice and payment records, five years.
Send the messages the service is made of: the sign-in link, vendor change alerts, deadline reminders, document requests and billing notices.
Your email address and what the message is about.
Basis: contract.
Let our staff look at your workspace to help you, read-only, only after you grant access, and with every session recorded.
What is already in your workspace, plus a record of who looked, when, and at which screens.
Basis: contract.

Where we rely on a legitimate interest

Keep the service standing and account for what happens in it: rate limits, the audit log of staff actions, and the records that show who changed what.
Request metadata such as the IP address a rate limit counts, and the actor and time of an action.
Basis: legitimate interest in running the service safely and being able to account for it.
Work out the result of the free NIS2 scope and AI Act risk checks on the website, and, if you choose to save one, add it to your workspace after you sign up.
The answers you type into the form, including a client name if you give one. Nothing is stored unless you save the check; a saved check waits in a cookie for up to 7 days.
Basis: legitimate interest in answering the request you make, and contract once you add it to a workspace. Kept: the check and its result, 90 days; an unconfirmed request to exclude a domain, 7 days.
Find companies whose published privacy documentation is out of step with what their own website does, write a report about that one website, and offer it to the company by email — at an address it publishes for questions of exactly this kind or, where it publishes none, at the business address of one person whose role answers for them: a founder or chief executive, a chief technology officer, a head of legal or data protection officer, or a chief operating officer.
The company's domain and what a reading of its public pages found; a role mailbox the company publishes on its own site — privacy@, dpo@, legal@ and the like; where it publishes no privacy or legal mailbox, the name, job title and business email address of one person in one of the four roles above, taken from Hunter.io, a licensed business contact dataset that states the public pages it found the address on — never an address we construct ourselves, and never a named address read off a website by our own code; whether the mailbox exists, checked with Hunter.io's email verifier before anything is sent; and, once a letter has gone, whether it was opened (the letter carries an open-tracking pixel since 2 October 2026), whether the report was opened from it — visits by mail scanners are counted apart from a person's — whether anyone replied, and whether anyone asked us to stop.
Basis: legitimate interest under Article 6(1)(f) GDPR in telling a company something true about its own website and offering to help with it, assessed below. Whether the letter may be sent at all is decided per country by a table of rules that a lawyer reviews and signs; a country nobody has reviewed permits nothing, and so does a country nothing could establish.. Kept: the company, the address, the report and the letters are kept until you ask, and then erased within 30 days of the request being confirmed; the report goes on one click; the list of addresses and domains we never write to again is kept, because it is the only thing that keeps that promise.

Only if you agreed

Count how the product is used — which steps people reach, where they stop — with our own events in our own database.
A pseudonymous visitor id and the name of the step. No document content, no interview content, and no personal data in the event itself.
Basis: consent. Kept: 25 months; events of the demo workspace, 30 days.
Run the website and its campaign pages: capture an address you leave for a download or a scan, and measure which page brought a customer.
The address you enter, the page you arrived on and the campaign parameters in its link.
Basis: consent. Kept: kept until you ask us to delete it, and then erased within 30 days of the request being confirmed; nothing deletes it on a timer.
Credit the firm whose referral link you arrived through, if you subscribe.
The referral code in the link, and later the fact that the account it led to started paying.
Basis: consent.
Tell you before a subprocessor changes, if you asked to be told.
The address you confirmed, and nothing else.
Basis: consent.
Send the monthly digest of vendor changes, if you subscribed to it on the website.
Your email address, when you subscribed and confirmed, and the last month we sent you.
Basis: consent. Kept: until you unsubscribe. Given by confirming the link we email you; withdrawn with the unsubscribe link in every digest.

Where it is processed

Client data at rest is stored in the Supabase project region eu-west-1 (Ireland).
The application runs in our own containers on a server in Frankfurt, Germany (fra1).
Data is encrypted in transit with TLS. At rest it is encrypted by our database and storage provider as part of their platform; we have not audited that ourselves.
Product analytics are our own events in our database, with no third-party analytics service and no document or interview content in them.
Our website sets no optional cookies before consent.
Prompts and model answers are not written to application logs. What is recorded per call is the model, the token counts, the cost and whether it succeeded.
We do not process special categories of personal data. What a workspace holds is facts about companies and their vendors, not health, biometric or similar data about people.
The product is sold to businesses and we do not knowingly process data about children.
Our customers are in the EEA, the United Kingdom and North America.
Incident records and the log of data subject requests are kept five years.
When one of our policies changes, every user is told by a notification in the product, sent automatically when the change goes live, and the revised policy is published on the website with the date it changed.
Transfers from the UK: to Stripe and Anthropic (Ireland) under the UK adequacy regulations for the EEA; to Supabase (Singapore) under the UK Addendum to the EU Standard Contractual Clauses; to Resend (United States) under the UK Extension to the EU-US Data Privacy Framework and the UK Addendum.
Data about people who are not customers. A free website check — the addresses entered and, where the result was asked for by email, that address — is deleted 90 days after the check, and a request to exclude a domain that was never confirmed is deleted after 7 days. An address left on the website for a download or a result, and the outreach register — the company, the role address it publishes for questions of this kind, the report and the letters sent — are kept until the person asks, and then erased within 30 days of the request being confirmed (owner, 2026-09-29). Nothing there is deleted on a timer. One click on a letter already deletes the report. What is kept is the record that this address or domain is not to be written to again: it is the only thing that keeps that promise.

Who processes it on our behalf

The same list the trust page publishes, with the legal entity and transfer mechanism of each.

DigitalOcean — The servers our application, its background jobs and its rendering service run on. All data of firms and their clients, while it is being processed and in server logs Registered in US. Transfers covered by DPF.
Supabase — Database, authentication and file storage. All data of firms and their clients Registered in SG. Transfers covered by SCC.
Anthropic — Drafting documents, interview replies and questionnaire answers. Facts and document text sent for drafting Registered in IE. Transfers covered by SCC.
Resend — Transactional email. Recipient addresses and email content Registered in US. Transfers covered by DPF.
Stripe — Payments and invoicing. Billing contact, company and payment details of firms Registered in IE. Transfers covered by DPF.

We announce a change to this list before it takes effect — subscribe to be told.

How long we keep it

When a subscription ends the workspace becomes read-only and its data is kept: it is a practice's working archive, and an engagement that resumes finds it where it was left. Nothing is deleted on a timer. It is deleted when the customer asks, within 30 days of confirming the request.
Logs are kept 90 days. Product events, which carry no personal data, are kept 25 months and the demo workspace's 30 days.
Support correspondence is kept 365 days.
Invoice and payment records are kept five years, as accounting and tax law require. Everything else about a closed account is deleted as described above.

Your rights

Access, rectification, erasure, restriction, portability, and objection to processing based on a legitimate interest. Where processing rests on consent, you can withdraw it at any time, which does not undo what was lawful before. Ask us at privacy@clausebench.com. If the data is inside a firm's workspace, that firm is the controller and the request goes to them — we will help them answer it.

You may also complain to a supervisory authority, for us Urząd Ochrony Danych Osobowych (UODO).

Cookies

Every cookie we set is listed in the cookie policy, with what it does and how long it lasts.

Reporting a security problem

Write to incident@clausebench.com. It reaches the incident officer directly, who confirms receipt within one working day.

Who is responsible

REALTY.TM GROUP sp. z o.o., ul. Bpa Albina Małysiaka 26/15, 30-389 Kraków, Poland, entered in the National Court Register (KRS) under 0001219891. Write to privacy@clausebench.com.

What we use personal data for

To give you what you signed up for

Give you an account and a workspace: signing in, your firm, the colleagues you invite and what each of them may do.
Your email address, your name if you give one, your role in the firm, and the times you signed in.
Basis: contract.
Ask the interview questions, keep the answers you confirm, and draft the documents your regimes require from them.
Whatever you enter about a client or about your own company, and the documents drafted from it.
Basis: contract. Inside a workspace this is the firm's data and we act as its processor.
Answer a customer's security questionnaire from the documents in the same workspace, and keep the answer library that builds up.
The questionnaire file you upload and the answers drafted from your own documents.
Basis: contract.
Publish a trust page for you or your client, take document requests on it and pass them to you.
What you choose to publish, and the name, company and address of anyone who requests a document there.
Basis: contract.
Watch vendor pages daily, work out which of your clients a change touches, and tell you.
The vendors your clients use and the address we send the alert to.
Basis: contract.
Take payment for the subscription and issue invoices.
Billing name and address, VAT id, and the payment record. Card details are entered on Stripe's own form and never reach us.
Basis: contract, and a legal obligation for the invoice records themselves. Kept: invoice and payment records, five years.
Send the messages the service is made of: the sign-in link, vendor change alerts, deadline reminders, document requests and billing notices.
Your email address and what the message is about.
Basis: contract.
Let our staff look at your workspace to help you, read-only, only after you grant access, and with every session recorded.
What is already in your workspace, plus a record of who looked, when, and at which screens.
Basis: contract.

Where we rely on a legitimate interest

Keep the service standing and account for what happens in it: rate limits, the audit log of staff actions, and the records that show who changed what.
Request metadata such as the IP address a rate limit counts, and the actor and time of an action.
Basis: legitimate interest in running the service safely and being able to account for it.
Work out the result of the free NIS2 scope and AI Act risk checks on the website, and, if you choose to save one, add it to your workspace after you sign up.
The answers you type into the form, including a client name if you give one. Nothing is stored unless you save the check; a saved check waits in a cookie for up to 7 days.
Basis: legitimate interest in answering the request you make, and contract once you add it to a workspace. Kept: the check and its result, 90 days; an unconfirmed request to exclude a domain, 7 days.
Find companies whose published privacy documentation is out of step with what their own website does, write a report about that one website, and offer it to the company by email — at an address it publishes for questions of exactly this kind or, where it publishes none, at the business address of one person whose role answers for them: a founder or chief executive, a chief technology officer, a head of legal or data protection officer, or a chief operating officer.
The company's domain and what a reading of its public pages found; a role mailbox the company publishes on its own site — privacy@, dpo@, legal@ and the like; where it publishes no privacy or legal mailbox, the name, job title and business email address of one person in one of the four roles above, taken from Hunter.io, a licensed business contact dataset that states the public pages it found the address on — never an address we construct ourselves, and never a named address read off a website by our own code; whether the mailbox exists, checked with Hunter.io's email verifier before anything is sent; and, once a letter has gone, whether it was opened (the letter carries an open-tracking pixel since 2 October 2026), whether the report was opened from it — visits by mail scanners are counted apart from a person's — whether anyone replied, and whether anyone asked us to stop.
Basis: legitimate interest under Article 6(1)(f) GDPR in telling a company something true about its own website and offering to help with it, assessed below. Whether the letter may be sent at all is decided per country by a table of rules that a lawyer reviews and signs; a country nobody has reviewed permits nothing, and so does a country nothing could establish.. Kept: the company, the address, the report and the letters are kept until you ask, and then erased within 30 days of the request being confirmed; the report goes on one click; the list of addresses and domains we never write to again is kept, because it is the only thing that keeps that promise.

Only if you agreed

Count how the product is used — which steps people reach, where they stop — with our own events in our own database.
A pseudonymous visitor id and the name of the step. No document content, no interview content, and no personal data in the event itself.
Basis: consent. Kept: 25 months; events of the demo workspace, 30 days.
Run the website and its campaign pages: capture an address you leave for a download or a scan, and measure which page brought a customer.
The address you enter, the page you arrived on and the campaign parameters in its link.
Basis: consent. Kept: kept until you ask us to delete it, and then erased within 30 days of the request being confirmed; nothing deletes it on a timer.
Credit the firm whose referral link you arrived through, if you subscribe.
The referral code in the link, and later the fact that the account it led to started paying.
Basis: consent.
Tell you before a subprocessor changes, if you asked to be told.
The address you confirmed, and nothing else.
Basis: consent.
Send the monthly digest of vendor changes, if you subscribed to it on the website.
Your email address, when you subscribed and confirmed, and the last month we sent you.
Basis: consent. Kept: until you unsubscribe. Given by confirming the link we email you; withdrawn with the unsubscribe link in every digest.

Where it is processed

Client data at rest is stored in the Supabase project region eu-west-1 (Ireland).

The application runs in our own containers on a server in Frankfurt, Germany (fra1).

Data is encrypted in transit with TLS. At rest it is encrypted by our database and storage provider as part of their platform; we have not audited that ourselves.

Product analytics are our own events in our database, with no third-party analytics service and no document or interview content in them.

Our website sets no optional cookies before consent.

Prompts and model answers are not written to application logs. What is recorded per call is the model, the token counts, the cost and whether it succeeded.

We do not process special categories of personal data. What a workspace holds is facts about companies and their vendors, not health, biometric or similar data about people.

The product is sold to businesses and we do not knowingly process data about children.

Our customers are in the EEA, the United Kingdom and North America.

Incident records and the log of data subject requests are kept five years.

When one of our policies changes, every user is told by a notification in the product, sent automatically when the change goes live, and the revised policy is published on the website with the date it changed.

Transfers from the UK: to Stripe and Anthropic (Ireland) under the UK adequacy regulations for the EEA; to Supabase (Singapore) under the UK Addendum to the EU Standard Contractual Clauses; to Resend (United States) under the UK Extension to the EU-US Data Privacy Framework and the UK Addendum.

Data about people who are not customers. A free website check — the addresses entered and, where the result was asked for by email, that address — is deleted 90 days after the check, and a request to exclude a domain that was never confirmed is deleted after 7 days. An address left on the website for a download or a result, and the outreach register — the company, the role address it publishes for questions of this kind, the report and the letters sent — are kept until the person asks, and then erased within 30 days of the request being confirmed (owner, 2026-09-29). Nothing there is deleted on a timer. One click on a letter already deletes the report. What is kept is the record that this address or domain is not to be written to again: it is the only thing that keeps that promise.

Who processes it on our behalf

The same list the trust page publishes, with the legal entity and transfer mechanism of each.

DigitalOcean — The servers our application, its background jobs and its rendering service run on. All data of firms and their clients, while it is being processed and in server logs Registered in US. Transfers covered by DPF.

Supabase — Database, authentication and file storage. All data of firms and their clients Registered in SG. Transfers covered by SCC.

Anthropic — Drafting documents, interview replies and questionnaire answers. Facts and document text sent for drafting Registered in IE. Transfers covered by SCC.

Resend — Transactional email. Recipient addresses and email content Registered in US. Transfers covered by DPF.

Stripe — Payments and invoicing. Billing contact, company and payment details of firms Registered in IE. Transfers covered by DPF.

We announce a change to this list before it takes effect — subscribe to be told.

How long we keep it

When a subscription ends the workspace becomes read-only and its data is kept: it is a practice's working archive, and an engagement that resumes finds it where it was left. Nothing is deleted on a timer. It is deleted when the customer asks, within 30 days of confirming the request.

Logs are kept 90 days. Product events, which carry no personal data, are kept 25 months and the demo workspace's 30 days.

Support correspondence is kept 365 days.

Invoice and payment records are kept five years, as accounting and tax law require. Everything else about a closed account is deleted as described above.

Your rights

You may also complain to a supervisory authority, for us Urząd Ochrony Danych Osobowych (UODO).