AIcleared
EU AI Act

Privacy Policy

Last updated: 27 September 2026 · Operator: [OPERATOR LEGAL NAME], [OPERATOR ADDRESS] · Contact: [PRIVACY EMAIL] · DPO: [DPO CONTACT OR "none appointed"]

1. What we process

When you sign in with Google we store your account identifier, display name, and email address, plus a session record. Your compliance workspace (transparency jobs, Annex IV document drafts, Article 12 log events, Article 25 scan answers and results) is stored server-side and linked to your account. If you enter personal data of third parties into the Article 12 log demo (e.g. a candidate email), that value is stored in an encrypted form (AES-GCM) in a separate mutable store so it can be erased without breaking the hash chain.

2. Purposes and bases

Authentication and account management (Art. 6(1)(b)/(f) — providing the service); storing your workspace to perform the contract (Art. 6(1)(b)); keeping the tamper-evident audit trail you generate (Art. 6(1)(f) or your compliance obligations as controller of your own workflow). You are the controller of the data you enter; AIcleared processes it on your behalf as processor for the stored content.

3. Sub-processors and hosting

Application hosting: Cloudflare (Workers, EU/EEA edge processing available). Database: Cloudflare D1 (created in the Western Europe region). Sign-in: Google Identity Services. No analytics or advertising trackers run on this site.

4. Retention

Sessions expire after 30 days of inactivity. Your workspace is retained until you delete your account. Deleting your account removes your user record, sessions, and entire workspace immediately and irreversibly.

5. Your rights

Access and portability (Arts. 15, 20): export everything from Settings → Export. Erasure (Art. 17): Settings → Delete account. You may also lodge a complaint with your supervisory authority. EU representative (Art. 27, if applicable): [REPRESENTATIVE OR "n/a — EU establishment"].

6. Security

TLS in transit; the raw-PII portion of your workspace is encrypted at rest with AES-GCM before it reaches the database. Access to production systems is limited to the operator.

This app is a compliance tooling product, not a law firm; using it does not create a lawyer-client relationship. See the Terms.