Privacy Policy

Effective date: 15.10.2025
Revised: 28.07.2026

1. Introduction

This Privacy Policy explains how Ckvens (“we”, “us”, “our”) collects, uses, stores, and protects personal data in compliance with the EU General Data Protection Regulation (GDPR) (EU) 2016/679.

2. Data Controller

The data controller is:

Ckvens AS (Org. nr.: 831 683 112)
Gydas vei 16, 0363 Oslo, Norway
contact@ckvens.com

3. What Data We Collect

We collect only the data necessary to provide our services, which may include:

• Account Information — name, email address, login credentials. If you sign in through your organisation’s single sign-on (Microsoft Entra ID), we receive your name and email address from your organisation’s identity provider.
• AI Preferences — preferred language, jurisdiction, role, legal specialties, writing style profile.
• Case-Related Data — events, notes, documents, relation maps, and timelines you create or upload.
• AI Interaction Data — chat conversations with AI agents, AI-generated analyses, citations, and timeline suggestions.
• Document Content — text extracted from uploaded documents (PDF, DOCX, images) for search indexing and AI analysis. Original documents are stored in encrypted cloud storage.
• Voice Data — if you use dictation, your speech is transcribed in real time. Audio is not stored by Ckvens.
• Billing Data — plan, billing contact details, and payment information processed by our payment provider (see Section 6). Ckvens does not store card numbers.
• Support Conversations — messages you send through the in-app support chat.
• Activity Data — audit trail of actions taken within cases (event creation, document uploads, collaboration changes).
• Usage Data — log files, device type, browser type, IP address.
• Website and Pilot Sign-Up Data — name, email, firm affiliation, and message content submitted through ckvens.com.

4. How We Use Your Data

We use personal data to:

• Provide and maintain the Ckvens service.
• Enable AI-assisted features including document analysis, chat, entity extraction, and timeline generation.
• Index and search uploaded documents using text extraction and vector embeddings.
• Generate and store a writing style profile (stylistic patterns only — no document content is retained in the profile).
• Maintain an activity log for audit and accountability purposes.
• Process subscriptions and payments.
• Provide user support.
• Improve and secure the platform.
• Communicate with you about updates, support, and security issues.

5. Lawful Basis for Processing

We process data under GDPR Article 6 based on:

• Consent (Article 6(1)(a)) — for optional features such as Writing Style analysis, Case Memory, and web search.
• Performance of a contract (Article 6(1)(b)) — to provide the Ckvens service as described in our Terms and Conditions, including billing.
• Legitimate interests (Article 6(1)(f)) — for platform security, fraud prevention, and service improvement.
• Legal obligation (Article 6(1)(c)) — for retention of accounting records relating to billing.

6. Data Storage and Location

Core data processing takes place within the EU/EEA:

Authentication is handled by Ckvens directly (credentials stored as salted hashes in our EU-hosted database) or, for organisations using single sign-on, by Microsoft Entra ID under your organisation’s Microsoft tenant.

Resend processes only email addresses and message content for the purpose of delivering invitation and password reset emails. Tavily receives only the search queries generated for a conversation where you have switched web search on — no documents and no case files. Chatwoot processes only the support conversations you initiate. Polar processes billing contact and payment details only. No case data, documents, or AI outputs are shared with any of these providers.

7. AI Data Processing

Ckvens uses two AI model providers, both processing data within the EU:

Azure OpenAI (GPT models) — hosted by Microsoft in Sweden Central. Microsoft is the data processor under its standard Data Processing Addendum. Prompts, completions, and embeddings are not shared with other customers or OpenAI.

Anthropic Claude models (via Amazon Bedrock) — served on AWS infrastructure in the European Union (primary region: Frankfurt). AWS — not Anthropic — is the data processor: on Amazon Bedrock, model providers have no access to customer content, and prompts and outputs are not stored by the service after the request completes.

Principles that apply to both providers:

• No model training — Ckvens does not use your data to train AI models, and both providers’ enterprise terms prohibit using customer data for model improvement.
• Case isolation — AI-generated outputs are stored per case and accessible only to users with explicit case access.
• Writing Style — The Writing Style feature analyzes only stylistic patterns (sentence structure, tone, formality). No document content is stored or referenced in the style profile.
• Case Memory — When enabled, the AI stores key facts and conclusions per case to maintain context across sessions. Memories from one case are never shared with other cases.
• Web search — When you enable web search for a conversation, search queries are sent to Tavily (see Sections 6 and 14). Your documents and case files are never sent to the web search provider.

8. Data Minimisation

We only collect the minimum amount of personal data needed for functionality. Document text is chunked and indexed for search purposes — only the text necessary for retrieval is stored, not full document reproductions.

9. Data Retention

We retain personal data only as long as necessary to provide our services or as required by law.

• Active accounts — data is retained for the duration of the account.
• Deleted accounts — data is deleted or anonymized within 30 days of account deletion, unless retention is required by law.
• Chat history — retained for the duration of the account to provide conversation continuity.
• Activity logs — retained for the duration of the case for audit purposes.
• Billing records — retained as required by applicable accounting and tax legislation.

10. Data Sharing

We do not sell personal data. Data may be shared with the following categories of service providers strictly for operational purposes, under confidentiality and data processing agreements:

• Cloud infrastructure — Microsoft Azure (hosting, AI, storage, search, speech-to-text)
• AI processing — Amazon Web Services (Claude models via Amazon Bedrock, EU regions); Mistral AI (document OCR only)
• Web search — Tavily (optional; search queries only, when enabled by you)
• Support — Chatwoot (in-app support conversations)
• Billing — Polar (subscription and payment processing)
• Email delivery — Resend (invitations and password reset only)

No case data, documents, or AI outputs are shared with any third party for marketing, analytics, or model training purposes.

11. Your Rights

Under GDPR, you have the right to:

• Access your personal data — available via Preferences > Data & Privacy > Export my data.
• Rectify inaccuracies in your profile — editable in Preferences.
• Erase your data (“right to be forgotten”) — available via Preferences > Data & Privacy > Delete my account. Deletion is immediate and permanent.
• Restrict or object to processing — contact us at contact@ckvens.com.
• Data portability — receive a copy of your data in JSON format via the export function.
• Withdraw consent — you may disable optional features (Case Memory, Writing Style, web search) at any time in Preferences or in the chat.

To exercise any of these rights, use the in-app tools in Preferences or contact us at contact@ckvens.com.

12. Security Measures

We implement the following security measures:

• Encryption in transit (TLS 1.2+) for all connections.
• Encryption at rest for database and file storage (Azure managed encryption).
• Role-based access controls (Owner, Editor, Viewer, Client) per case.
• Authentication via secure credentials with hashed passwords, or single sign-on via Microsoft Entra ID.
• Cloud credentials for AI processing are short-lived and role-based — no static cloud access keys exist in the application.
• Rate limiting on API endpoints to prevent abuse.
• Input validation and sanitization to prevent injection attacks.
• Audit trail logging of case-related actions.

13. Cookies

Ckvens uses essential cookies for authentication and session management. The in-app support chat (Chatwoot) sets cookies required to maintain your support conversation. If you visit our public website, we may also use functional and analytics cookies to understand traffic and improve performance. You can manage your cookie preferences at any time through the “Cookie settings” link in the footer.

14. Data Transfers

Core processing — including all AI processing of case content — takes place within the EU/EEA. Personal data is transferred outside the EU/EEA only for the following limited purposes, in each case under Standard Contractual Clauses (SCCs) pursuant to GDPR Art. 46:

• Resend (US) — email addresses and message content for invitation and password reset emails.
• Tavily (US) — search queries, only for conversations where you have enabled web search.
• Chatwoot (US) — support conversations you initiate through the in-app chat.
• Polar (US) — billing contact details and payment information.

No case documents or AI outputs are transferred outside the EU/EEA. Any future transfer will only take place under GDPR-compliant safeguards.

15. Children

Ckvens is not intended for use by individuals under 18 years of age. We do not knowingly collect data from minors.

16. Changes to This Policy

We may update this policy from time to time. The latest version will always be available on our website and within the application. If material changes are made, we will notify users through the app or email at least 14 days before the changes take effect.

17. Contact

For any questions, GDPR requests, or data protection inquiries, contact:

Ckvens AS
contact@ckvens.com
Gydas vei 16, 0363 Oslo, Norway

Ckvens AS © 2025–2026. All rights reserved.