Privacy Policy
As of: March 2026 · Version 2.0.0
1. Responsible Party
Responsible for data processing is: DRET Legal, Zurich, Switzerland Email: datenschutz@dret.ch
2. Data We Collect
- Account data: Email address (for login via one-time code)
- Case data: Case descriptions you enter, answers to follow-up questions, uploaded documents
- Technical data: IP address, browser type, access times (server logs)
- Usage data: Interaction data for improving the Platform (e.g. page views, usage flows)
3. Purpose of Data Processing
- Providing the service (case capture and initial legal assessment)
- Authentication and account management
- Quality assurance, development, and evaluation of our internal AI agents (see § 4)
- Technical operation and security of the Platform
- Usage analysis for improving the Platform
4. AI Data Processing and Cross-Border Data Transfer
All your case data and assessments are stored exclusively in Switzerland (Supabase, Zurich). To generate the legal assessment, your inputs are transmitted to AI language models (LLMs). The following applies:
- No model training: We use exclusively commercial API interfaces. No provider is permitted to use your data for training its AI models.
- No permanent storage by providers: Data is processed only at the moment of generation and automatically deleted thereafter (max. 30 days for security purposes, unless a shorter processing period is configured).
Internal Use by DRET Legal
The initial legal assessment is provided to you free of charge. In return, you grant us the right to use the case descriptions you enter for quality assurance, development, and evaluation of our internal AI agents.
Should your inputs contain particularly sensitive personal data within the meaning of Art. 5 para. c nDSG (e.g. health data or information about criminal proceedings), such data will not be used for quality assurance, development, or evaluation. It will serve exclusively for providing your assessment and for statutory record-keeping.
Providers and Data Transfers
DRET uses AI models from various providers. This involves data transfers abroad. We rely on the following legal bases pursuant to Art. 16 et seq. nDSG:
| Provider | Task | Server Location | Legal Basis |
|---|---|---|---|
| Microsoft (Azure AI Foundry) | Text processing, document analysis, speech recognition | EU (Sweden) | EU/CH adequacy decision |
| Legal analysis | EU / USA | Swiss-U.S. Data Privacy Framework (DPF) | |
| Anthropic | Legal analysis (fallback) | USA | Standard Contractual Clauses (SCCs) incl. Swiss Addendum |
Which models are used for which task may change at any time.
5. Services and Server Locations
| Service | Purpose | Server Location |
|---|---|---|
| Supabase | Database, authentication, file storage | Zurich, Switzerland |
| Vercel | Frontend hosting | Frankfurt, Germany (EU) |
| Railway | Backend hosting | Amsterdam, Netherlands (EU) |
| Langfuse | Operational monitoring | EU |
| PostHog | Usage analysis | Frankfurt, Germany (EU) |
6. Data Retention and Deletion
Your case data and the generated assessments are stored in our database in Switzerland. Storage serves two purposes:
-
Record-keeping: To document the service provided and to defend against potential legal claims, we retain the inputs and assessments for 10 years in accordance with statutory limitation periods (Art. 127 CO).
-
Platform development: Provided your inputs do not contain particularly sensitive personal data, we use the case descriptions for quality assurance, development, and evaluation of our AI agents.
Account deletion: You may request deletion of your account at any time by emailing datenschutz@dret.ch. Your identification data (email address) will be deleted. The case data itself remains in our system for the reasons stated above.
Server logs are automatically deleted after 30 days.
7. Cookies and Analytics
The Platform uses technically necessary cookies for authentication. To improve the Platform, we use an analytics tool (PostHog, EU) that captures usage flows and page views. No advertising cookies or third-party trackers are used.
8. Your Rights
Under the Swiss Data Protection Act (nDSG), you have the right to:
- Access to the data processed about you
- Correction of inaccurate data
- Deletion of your data
- Data portability
- Objection to data processing
Please direct enquiries to: datenschutz@dret.ch
9. Right to Complain
You have the right to file a complaint with the Federal Data Protection and Information Commissioner (FDPIC): FDPIC, Feldeggweg 1, 3003 Bern www.edoeb.admin.ch
10. Amendments
DRET Legal reserves the right to amend this Privacy Policy at any time. The current version is available on the Platform.