Privacy policy

1. Introduction

This privacy policy describes how LagKlar AB (in formation), below "LagKlar", "we" or "us", collects, uses, stores and protects your personal data when you use our service at lagklar.se.

We process your personal data in accordance with the General Data Protection Regulation of the EU (GDPR), the Swedish Act (2018:218) containing supplementary provisions to the GDPR, and other applicable data protection legislation.

2. Data controller

The controller for the processing of your personal data is:

LagKlar AB (in formation)

Email: kontakt@lagklar.se

Website: lagklar.se

3. Which personal data do we collect?

3.1 Account data

• Full name (required)
• Email address (required)
• Phone number (optional)
• Password (stored encrypted)
• Profile picture (optional)

3.2 Matter data

• Matter title and description that you provide
• Chosen service type (appeal, benefits, advice)
• Authority, type of benefit or area of law
• Company information (for business related benefits)
• Uploaded documents (PDF, images)
• AI generated analyses and drafts
• Final reviewed documents
• Strength score and appeal deadline

3.3 Communication data

• Messages between you and your reviewer
• Meeting notes

3.4 Technical data

• Timestamps (registration, creation of a matter, status changes)
• Status history and audit log
• Email notification log

3.5 Sensitive personal data

Uploaded documents may contain sensitive personal data such as personal identity numbers or health information. These are not stored as separate fields but may appear in the documents you upload. We process such information with particular care and only to the extent required to perform the service.

4. Purposes and legal basis for the processing

5. AI processing of personal data

5.1 AI provider

LagKlar uses the Claude AI service from Anthropic for document analysis and the generation of drafts. Anthropic acts as a processor on behalf of LagKlar for this processing.

5.2 Which data is sent to the AI

• Extracted text from uploaded documents
• Your description of the matter
• Type of authority and category of matter
• Legal context data from the LagKlar knowledge base (statutes, ordinances, precedents)

Complete documents (images and PDF) may be sent for text extraction through Claude Vision. Files are compressed automatically if they exceed 5 MB.

5.3 Data protection in AI processing

• Anthropic does not train its models on data sent through the API.
• Data is processed in accordance with the API terms and data protection agreement of Anthropic.
• No personal data is stored by Anthropic beyond temporary processing.

6. Sharing with third parties

We share your personal data with the following third parties, only to the extent required to provide the service:

7. Transfers to third countries

Some of our subprocessors, in particular Anthropic and Vercel, process data in the USA. These transfers take place on the basis of the adequacy decision of the European Commission (the EU and US Data Privacy Framework) or through standard contractual clauses in accordance with Article 46 GDPR.

8. Storage and security

8.1 Place of storage

Your personal data is stored primarily with Supabase (an EU based PostgreSQL database and AWS S3 storage). Files are stored encrypted at rest with AWS managed encryption.

8.2 Security measures

• HTTPS and TLS encryption for all traffic
• Row Level Security (RLS) on all database tables
• Secure cookies (HttpOnly, Secure, SameSite)
• Parameterised SQL queries (protection against SQL injection)
• Built in XSS protection through React and Next.js
• Separate API keys for the client side and the server side
• Access control: users see only their own data, staff see data within their role

8.3 Retention

Your personal data is stored for as long as your account is active. Matter data is kept after a matter is closed for history and reference. When you request deletion of your account, all data connected to the account is deleted.

9. Cookies

LagKlar uses only necessary cookies for authentication and session handling (Supabase session cookies). We use no third party cookies, tracking cookies or analytics cookies. No tools such as Google Analytics or similar are used.

10. Your rights under the GDPR

Under the GDPR you have the following rights regarding your personal data:

• Right of access: you have the right to receive a copy of the personal data we process about you.
• Right to rectification: you can update incorrect data through your profile or by contacting us.
• Right to erasure: you can request that your personal data be deleted. When an account is deleted, all connected data is removed.
• Right to restriction: you have the right to request that the processing of your data be restricted under certain circumstances.
• Right to data portability: you have the right to receive your personal data in a structured, machine readable format.
• Right to object: you have the right to object to processing based on legitimate interest.
• Right to withdraw consent: where the processing is based on consent you can withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, contact us at kontakt@lagklar.se. We answer your request within 30 days.

11. Complaints

If you consider that we process your personal data in breach of data protection legislation, you have the right to lodge a complaint with the supervisory authority:

Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection

Box 8114, 104 20 Stockholm, Sweden

imy.se

12. Changes to this privacy policy

We may update this privacy policy. In the event of material changes we will notify you by email or through the service. The latest version is always available at lagklar.se.

13. Contact details

LagKlar AB (in formation)

Email: kontakt@lagklar.se

Website: lagklar.se