Privacy policy

The controller of the personal data described here is Mindaugas Kiznis, trading as Kiznis Studio, who develops and provides Avokata as an individual. No company has been registered yet; when one is, this notice will name it and the date from which it is the controller. Data questions: privacy@avokata.com. Security: security@avokata.com.

What this is

Avokata gives a lawyer’s AI assistant tools to search Lithuanian legal acts and court practice, read provisions with exact references, follow citations and run workflows. The corpus is public. About you we keep only what an account needs and the text you choose to put in matter profiles or workflows.

We offer no search by person, we do not sell personal data, and we do not use it to train models.

Query text: what we do not keep

The text of a search or tool question is not stored. We record that a tool ran, when, how long it took, how many results came back, which quota it used, and a digest of the arguments made with our secret key (HMAC). Without that key your words cannot be recovered from the digest, and it exists only to recognise repeated calls. Because the digest is linked to your account, we treat it as personal data and this policy applies to it.

That is deliberate: a lawyer’s question can reveal case strategy. Keeping queries would turn the usage log into a diary of every user’s research.

Counting users

From the usage log we count, in aggregate, how many distinct people used the service in the last 7 and 30 days. A caller without an account is counted by a hash of the network address made with our secret salt. Such a hash is pseudonymised personal data: we hold the salt, so in theory we could link the hash to the address. We do not, the salt is kept separately, and the hashes are deleted after the periods in the table below. Only the totals leave the service. Our own testing and monitoring calls are left out.

Signing in

Every tool needs an account with a verified email address; registration is free on the beta plan. A request made without signing in is refused. The refusal is recorded in the usage log like any other call, with a hash of the network address made with our secret salt instead of the address itself.

What we keep and why

We send only these emails: the sign-in codes and links you ask for; the confirmation link when you ask to delete your account; notice of a personal-data breach that may affect you; and, only if you switch them on, an email when we reply to your feedback and a digest of unread messages (both are off by default); the newsletter only if you subscribe. We send no other email without your consent, and no advertising. We keep no copy of a statute or ruling under your name, only pointers into the public corpus.

Where the data lives

Servers and nightly backups: Hetzner in Germany (EU). Network edge and DNS: Cloudflare, which also forwards messages sent to our addresses to our mailbox at Google Workspace. Emails we send (sign-in and other messages) go out through Resend from its EU region (Ireland). Server errors are reported to Sentry, which stores them in its EU region (Germany). Connections are encrypted (HTTPS); backups are encrypted.

Who on our side can read matter data

There is no admin console. Profiles and workflows are reachable only through your connection. In normal operation we do not read matter text. If you ask for help, we open only what your question needs.

Server and application logs

Containers write server and application logs (start-up, errors, health checks) to the host; they rotate (about 30 MB per service). Search and tool question text is not written to the logs.

The web server in front of our services keeps an access log of each request: the network address, the browser identification, the country reported by Cloudflare, the page or address requested, the time and the response. We use it for security, abuse prevention and fault finding, and delete it after 14 days.

Log access is limited to the people who run the infrastructure, on a need-to-know basis (outages, a report to the security address, abuse). There is no console for browsing users’ research. If you contact us about a specific incident, we look only at the lines about it.

Deletion

Ask your assistant to call request_deletion, or write to privacy@avokata.com. You get a confirmation link; confirming deletes the account and every attached record in one step, with no undo. Call counts remain, with no account id and no text. For one matter: delete_matter. Export: export_account_data.

Incidents

If a personal-data breach is likely to put people’s rights and freedoms at risk, we notify the State Data Protection Inspectorate within 72 hours. If it may affect your account, we also tell you at the account’s email address without undue delay. Reports: security@avokata.com.

Your rights

You can ask for confirmation of whether we process your data and for a copy, for correction, deletion, restriction or portability, and you can object to processing based on legitimate interests and, at any time and without giving reasons, to direct marketing. Write to privacy@avokata.com. We answer within one month; for complex or numerous requests we may extend this by two further months, telling you within the first month. Requests are free. If we are unsure who sent a request, we may ask you to confirm it, for example by replying from the account’s email address. You may complain to the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt, vdai.lrv.lt) or to the supervisory authority where you live or work; we ask you to write to us first, as we can usually solve it quickly. An email address is needed to create an account; without it we cannot provide the service. We make no automated decisions with legal or similarly significant effects on you (GDPR Article 22). Where we rely on your consent (for example the newsletter), you can withdraw it at any time; this does not affect processing before the withdrawal.

Purposes and legal bases

We process personal data to run Avokata: accounts, API keys, quotas, the matter profiles and workflows you deliberately save, support and security reports. The legal corpus is public; the section Personal data in published legal texts explains how we treat the people named in it.

Under the GDPR we rely on:

• performance of a contract (Article 6(1)(b)) for the account;
• legitimate interests (Article 6(1)(f)) for security, abuse prevention, aggregated reliability measurement and counting refused requests made without signing in;
• consent (Article 6(1)(a)) where we ask for it explicitly: the website visit statistics (together with the consent the electronic communications rules require for using your device) and the newsletter. You can withdraw consent at any time; withdrawal does not affect processing before it.

Where we rely on legitimate interests, they are: protecting accounts and the service from unauthorised access and overload; keeping the service working and fixing its faults; knowing how many people use it, to improve it; proving what was agreed and that we met our obligations; answering messages; and keeping legal acts and court practice accessible (see Personal data in published legal texts). We process only the data each of these needs.

You have the right to object at any time to processing based on legitimate interests. Write to privacy@avokata.com. We stop unless we show compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims. You can object to direct marketing at any time, without giving reasons, and we then stop sending it.

Recipients and transfers outside the EEA

Infrastructure providers process data on our behalf; the list: sub-processors. Primary hosting and backups are in Germany (EU). The website visit statistics (Umami, only with your consent) are kept on our own server rented from Hetzner in its data centre in Ashburn, United States. Cloudflare, Resend, Sentry and Google are US companies and Cloudflare runs a global network; where data leaves the EEA, the sub-processors page names the safeguard for each provider: the EU-U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses. You can get a copy of these safeguards by writing to privacy@avokata.com.

You use Avokata through your own AI assistant (for example Claude or ChatGPT). Its provider is a separate controller that processes your conversation under its own terms and privacy policy; we receive nothing from that conversation except the tool call described in Query text: what we do not keep. A few further providers help us prepare the public legal texts; they receive only public texts or our own test questions, never data about you, and are listed on the same page.

Personal data in published legal texts

We hold legal texts as their sources officially published them (e-TAR, LITEKO, EUR-Lex and others). Courts publish their decisions depersonalised; we keep that depersonalisation and never try to identify anyone. We offer no search by person. The texts can still name judges, lawyers, companies or institutions that the sources publish openly. The legal basis is our legitimate interest in making the law accessible (GDPR Article 6(1)(f)). If a published text still lets someone identify you, or is inaccurate about you, write to privacy@avokata.com: we check it and, where justified, hide or correct the passage within 30 days.

Where a source’s depersonalisation failed, a text can still contain other details that identify a person; we treat such details as personal data. We do not knowingly process identifiable data about criminal convictions and offences, health or other special categories. If we notice, or are told, that such data has remained identifiable, we hide the passage within 3 working days and tell the source. We keep a text while its source publishes it, and update our copy when the source changes or removes it.

Cookies

The site uses strictly necessary cookies and, only if you accept it in the consent window, the Umami statistics tool that Kiznis Studio hosts itself; it sets no cookie and does not store your network address. You can withdraw that consent at any time with the Cookie settings link at the bottom of every page. Details: cookies.

Business customers

Enterprise terms and a signable DPA are not published during the beta. When they are, business customers will receive updated notices before any contractual processing.