Privacy Policy

Effective date: 15.10.2025

Revised: 15.09.2026

1. Introduction

This Privacy Policy explains how CKvens (“we,” “us,” “our”) collects, uses, stores, and protects personal data in compliance with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679), as incorporated into Norwegian law through the Norwegian Personal Data Act (Personopplysningsloven, LOV-2018-06-15-38), and other applicable Norwegian and EU legislation.

Our AI features process case data, documents, and queries to generate: document summaries and entity extraction; timeline suggestions and event identification; legal analysis and citation suggestions; and chat-based Q&A about your case materials. These outputs are generated using large language models (GPT) and may contain errors. They are not legal advice and should always be verified by a qualified professional.

2. Data Controller

The data controller is:

CKvens AS (Org. nr.: 831 683 112)
Gydas vei 16, 0363 Oslo, Norway
Email: contact@ckvens.com

Data Protection Officer

We are conducting an assessment of our obligations under Article 37 GDPR regarding the appointment of a Data Protection Officer, taking into account the nature and scale of personal data processed through the platform. We will update this section on completion of that assessment.

3. What Data We Collect

We collect only the data necessary to provide our services, which may include:

• Account Information — name, email address, login credentials. If you sign in through your organisation’s single sign-on (Microsoft Entra ID), we receive your name and email address from your organisation’s identity provider.

• AI Preferences — preferred language, jurisdiction, role, legal specialties, writing style profile.

• Case-Related Data — events, notes, documents, relation maps, and timelines you create or upload.

• AI Interaction Data — chat conversations with AI agents, AI-generated analyses, citations, and timeline suggestions.

• Document Content — text extracted from uploaded documents (PDF, DOCX, images) for search indexing and AI analysis. Original documents are stored in encrypted cloud storage. When you open a document, it is cached locally in your browser for up to 7 days to enable fast reopening.

• Voice Data — if you use dictation, your speech is transcribed in real time. Audio is not stored by Ckvens.

• Billing Data — plan, billing contact details, and payment information processed by our payment provider (see Section 6). Ckvens does not store card numbers.

• Support Conversations — messages you send through the in-app support chat.

• Activity Data — audit trail of actions taken within cases (event creation, document uploads, collaboration changes).

• Usage Data — log files, device type, browser type, IP address.

• Website and Pilot Sign-Up Data — name, email, firm affiliation, and message content submitted through ckvens.com.

4. How We Use Your Data

We use personal data to:

• Provide and maintain the Ckvens service.

• Enable AI-assisted features including document analysis, chat, entity extraction, and timeline generation.

• Index and search uploaded documents using text extraction and vector embeddings.

• Generate and store a writing style profile (stylistic patterns only — no document content is retained in the profile).

• Maintain an activity log for audit and accountability purposes.

• Process subscriptions and payments.

• Provide user support.

• Improve and secure the platform.

• Communicate with you about updates, support, and security issues.

5. Lawful Basis for Processing

We process your personal data under the following legal bases:

• Provide and maintain the CKvens platform (Account Information, Case-Related Data, AI Interaction Data, Document Content): Performance of contract (Art. 6(1)(b))

• Account creation and authentication (Name, email, credentials or SSO token): Performance of contract (Art. 6(1)(b))

• AI-assisted features (document analysis, chat, entity extraction, timeline generation): Performance of contract (Art. 6(1)(b))

• Document indexing and search (Document Content — text chunks, vector embeddings): Performance of contract (Art. 6(1)(b))

• Activity logging and audit trail (Activity Data): Performance of contract (Art. 6(1)(b))

• Billing and payment processing (Billing Data): Performance of contract (Art. 6(1)(b))

• Customer support (Support Conversations, Account Information): Performance of contract (Art. 6(1)(b))

• Writing Style profile generation (Stylistic patterns from your writing): Consent (Art. 6(1)(a)) — opt-in feature

• Case Memory (Per-case contextual information): Consent (Art. 6(1)(a)) — opt-in feature

• Web search within conversations (Search queries only): Consent (Art. 6(1)(a)) — opt-in feature

• Platform security and fraud prevention (Usage Data, IP address, access logs): Legitimate interests (Art. 6(1)(f)) — protecting our platform and users against unauthorized access, fraud, and security threats

• Service improvement and bug fixing (Usage Data, aggregated where possible): Legitimate interests (Art. 6(1)(f)) — improving platform performance, reliability, and user experience

• Communications (updates, security notices) (Name, email): Legitimate interests (Art. 6(1)(f)) — keeping users informed about important platform changes and security matters

• Retention of accounting records (Billing Data, invoices): Legal obligation (Art. 6(1)(c)) — Norwegian Bookkeeping Act (bokføringsloven)

Obligation to Provide Data

The provision of personal data to CKvens is not a statutory requirement. However:

• Data Required to Use the Platform (Contractual Requirement): Account Information (name, email, credentials) is required to create and maintain your account. Without this data, we cannot provide you with access to CKvens. Case-Related Data and Document Content are required for the core case management and AI features to function.

• Data Required for Paid Subscriptions: Billing Data is required to process your subscription payments. Without this data, we cannot activate or maintain paid features.

• Optional Data: AI Preferences, Writing Style, Case Memory, and web search are opt-in features. Choosing not to enable them does not affect your ability to use the core platform. Voice Data (dictation) is also optional; the platform functions fully without it.

Legitimate Interests

Where we rely on legitimate interests as our legal basis, we have conducted a balancing test weighing our interests against your fundamental rights and freedoms. We have determined that our interests do not override your rights in the following cases:

• Platform security: Our interest in protecting the platform, user data, and infrastructure from unauthorized access and threats is proportionate to the minimal intrusion of processing access logs and security events.

• Service improvement: We aggregate and minimize data for this purpose, reducing any impact on your privacy.

• Operational communications: Limited to necessary updates directly related to your use of the platform. You have the right to object to any processing based on legitimate interests (see Section 11).

6. Data Storage and Location

Core data processing takes place within the EU/EEA:

Authentication is handled by Ckvens directly (credentials stored as salted hashes in our EU-hosted database) or, for organisations using single sign-on, by Microsoft Entra ID under your organisation’s Microsoft tenant.

Resend processes only email addresses and message content for the purpose of delivering invitation and password reset emails. Tavily receives only the search queries generated for a conversation where you have switched web search on — no documents and no case files. Chatwoot processes only the support conversations you initiate. Polar processes billing contact and payment details only. No case data, documents, or AI outputs are shared with any of these providers.

7. AI Data Processing

We ensure users are aware when they are interacting with an AI system. As Ckvens is marketed and used explicitly as an AI-powered legal platform, this is considered clear from the context.

CKvens uses Microsoft Azure OpenAI for AI model processing. Core processing takes place within the EU:

Azure OpenAI (GPT models) — hosted by Microsoft in Sweden Central and Norway East (DataZoneStandard EUR deployments — data remains within the EU). Microsoft is the data processor under its standard Data Processing Addendum. Prompts, completions, and embeddings are not shared with other customers or OpenAI.

Mistral AI — EU-based. Document text extraction (OCR). Mistral processes data via its own API infrastructure within the EU.

Principles that apply to our providers:

• No model training — Ckvens does not use your data to train AI models, and our providers’ enterprise terms prohibit using customer data for model improvement.

• Case isolation — AI-generated outputs are stored per case and accessible only to users with explicit case access.

• Writing Style — The Writing Style feature analyzes only stylistic patterns (sentence structure, tone, formality). No document content is stored or referenced in the style profile.

• Case Memory — When enabled, the AI stores key facts and conclusions per case to maintain context across sessions. Memories from one case are never shared with other cases.

• Web search — When you enable web search for a conversation, search queries are sent to Tavily (see Sections 6 and 15). Your documents and case files are never sent to the web search provider.

• CKvens does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. All AI-generated insights, analyses, suggestions, and outputs are decision-support tools presented as suggestions for your professional judgment. A qualified legal professional always retains control over any decisions made using CKvens outputs.

8. Data Minimisation

We only collect the minimum amount of personal data needed for functionality. Document text is chunked and indexed for search purposes — only the text necessary for retrieval is stored, not full document reproductions.

9. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Specific retention periods:

• Active accounts — data is retained for the duration of the account.

• Deleted accounts — data is deleted or anonymized within 30 days of account deletion, unless retention is required by law.

• Chat history — retained for the duration of the account to provide conversation continuity.

• Activity logs — retained for the duration of the case for audit purposes.

• Billing records — retained for 5 years as required by the Norwegian Bookkeeping Act (bokføringsloven).

• Support conversations — retained for 2 years after the conversation ends, or the duration of your account if shorter, for service quality and dispute resolution purposes.

• Usage and security logs — retained for 12 months for security monitoring and incident investigation, then deleted or anonymised.

Where specific periods are not stated above, we retain data only for as long as necessary for the purpose for which it was collected under Article 5(1)(e) GDPR. When the retention period expires, data is securely deleted or irreversibly anonymised.

10. Data Sharing

We do not sell personal data. Data may be shared with the following categories of service providers strictly for operational purposes, under confidentiality and data processing agreements:

• Cloud infrastructure — Microsoft Azure (hosting, AI, storage, search, speech-to-text)

• AI processing — Microsoft Azure (Azure OpenAI); Mistral AI (document OCR only)

• Web search — Tavily (optional; search queries only, when enabled by you)

• Support — Chatwoot (in-app support conversations)

• Billing — Polar (subscription and payment processing)

• Email delivery — Resend (invitations and password reset only)

No case data, documents, or AI outputs are shared with any third party for marketing, analytics, or model training purposes.

11. Your Rights

Under the GDPR and the Norwegian Personal Data Act, you have the following rights regarding your personal data:

• Right of Access (Article 15) — You may request confirmation of whether we process your personal data and obtain a copy of that data. Available via Preferences > Data & Privacy > Export my data.

• Right to Rectification (Article 16) — You may request correction of inaccurate personal data or completion of incomplete data. Editable in Preferences.

• Right to Erasure (Article 17) — You may request deletion of your personal data where, among other grounds, the data is no longer necessary, you withdraw consent, or you object to processing. Available via Preferences > Data & Privacy > Delete my account. Access is terminated immediately and associated data is deleted or anonymized within 30 days, unless retention is required by applicable law. Account deletion is irreversible.

• Right to Restriction (Article 18) — You may request restriction of processing in certain circumstances, such as where you contest the accuracy of the data. Contact us at contact@ckvens.com.

• Right to Object (Article 21) — You have the right to object to processing based on legitimate interests (Article 6(1)(f)). We will cease processing unless we demonstrate compelling legitimate grounds that override your interests. You have an absolute right to object to processing for direct marketing purposes.

• Right to Data Portability (Article 20) — Where processing is based on consent or contract and carried out by automated means, you may receive your data in a structured, commonly used, machine-readable format. Available via the JSON export function in Preferences.

Right to Withdraw Consent (Article 7(3)) — Where processing is based on consent (e.g., Writing Style, Case Memory, web search), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. You may disable optional features at any time in Preferences or in the chat.

• Right to Lodge a Complaint — You have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) if you believe our processing of your personal data violates data protection legislation. Decisions by Datatilsynet may be appealed to the Privacy Appeals Board (Personvernnemnda).

You may exercise your rights through the in-app account settings or by contacting us at contact@ckvens.com. We may ask you to verify your identity before processing your request. We will respond to your request within one month of receipt. If your request is complex or we receive numerous requests, we may extend this period by up to two additional months, in which case we will notify you of the extension and the reasons. We do not charge a fee for exercising your rights, except where requests are manifestly unfounded or excessive (e.g., repetitive requests), in which case we may charge a reasonable fee or refuse to act.

12. Security Measures

We implement the following security measures:

• Encryption in transit (TLS 1.2+) for all connections.

• Encryption at rest for database and file storage (Azure managed encryption).

• Role-based access controls (Owner, Editor, Viewer, Client) per case.

• Authentication via secure credentials with hashed passwords, with optional two-factor authentication available; or single sign-on via Microsoft Entra ID.

• Cloud credentials for AI processing are short-lived and role-based — no static cloud access keys exist in the application.

• Rate limiting on API endpoints to prevent abuse.

• Input validation and sanitization to prevent injection attacks.

• Audit trail logging of case-related actions.

13. Cookies

We use cookies and similar technologies on our platform and website.

Strictly Necessary Cookies (No Consent Required): We use essential cookies for authentication, session management, security (CSRF protection), and storing your cookie consent preferences. These cookies are exempt from consent requirements under Ekomloven §3-15 as they are strictly necessary to deliver the service you have requested.

Other Cookies: Any cookies that are not strictly necessary are only set after you have given explicit, informed consent via our cookie banner. You can accept or reject non-essential cookies via the cookie banner when you first visit. Consent can be withdrawn as easily as it was given. You can change your preferences at any time via the “Cookie settings” link in the footer.

For more information about our cookie use, their purposes, providers, and durations, please refer to our Cookie Policy.

14. Controller and Processor Roles

CKvens operates in a dual capacity depending on the type of data involved:

CKvens as Data Controller: CKvens is the data controller for personal data we collect and process for our own purposes, including: Account Information and login credentials; Billing and payment data; Usage Data and security logs; Support conversations; Website and pilot sign-up data; AI Preferences and Activity Data. This Privacy Policy describes our processing activities in this controller capacity.

CKvens as Data Processor: When you or your law firm use CKvens to manage legal cases, you upload Case-Related Data and Document Content into our platform. For this content, your law firm is the data controller and CKvens acts as a data processor, processing data solely on your firm’s instructions. This means your law firm determines the purposes and means of processing Case-Related Data and Document Content. Your law firm is responsible for providing privacy notices to data subjects whose personal data appears in case materials (e.g., clients, witnesses, opposing parties). CKvens processes case content only as instructed by your firm and as set out in our Data Processing Agreement (DPA). We implement appropriate technical and organisational measures to protect case content. We assist your firm in fulfilling data subject rights requests relating to case content.

We enter into a Data Processing Agreement (DPA) with each customer. A copy of our standard DPA is available upon request. If you are a data subject whose personal data appears within case content processed through our platform, please direct any privacy inquiries to the law firm that uploaded or manages that data.

15. Data Transfers

Where personal data is transferred outside the EU/EEA we rely on the European Commission’s Standard Contractual Clauses (Article 46(2)(c) GDPR).

The data transferred to non-EU providers includes:

• Resend (US) — email addresses and message content for invitation and password reset emails.

• Tavily (US) — search queries, only for conversations where you have enabled web search.

• Chatwoot (US) — support conversations you initiate through the in-app chat.

• Polar (US) — billing contact details and payment information.

No case documents or AI outputs are stored outside the EU/EEA after processing completes.

16. Children

Our platform is not intended for individuals under the age of 18. CKvens does not direct services at children and do not knowingly collect personal data from individuals under 18. If we become aware that we have collected personal data from a person under 18, we will take steps to delete that information promptly.

If you believe we have collected personal data of a minor, please contact us at contact@ckvens.com.

17. Changes to This Policy

We may update this policy from time to time. The latest version will always be available on our website and within the application. If material changes are made, we will notify users through the app or email at least 14 days before the changes take effect.

18. Contact

For any questions, GDPR requests, or data protection inquiries, contact:

Ckvens AS
contact@ckvens.com
Gydas vei 16, 0363 Oslo, Norway

For Datatilsynet (Norwegian Data Protection Authority):

P.O. Box 458 Sentrum, 0105 Oslo
Norwaypostkasse@datatilsynet.no
www.datatilsynet.no
Ckvens AS © 2025–2026. All rights reserved.