LawBot 
Privacy Policy
LawBot Pro (the legal AI research assistant for lawyers) and LawBot Business (the legal AI assistant for entrepreneurs) are services of Litic B.V. ("Litic", "we"), Uitbreidingstraat 84, 2600 Antwerp, Belgium (company number 0817.919.143, VAT BE0817919143). Litic is the controller for the processing described in this policy. It covers both services on every channel where they are offered (Claude and ChatGPT), the sign-in pages at portal.litic.ai and the website lawbot.nl. Questions? E-mail support@litic.ai.
In short. Our servers do not store the content of your work: no questions, no documents, no answers. To apply usage limits we record metadata only (counts, times, which tool, which channel). The LawBot infrastructure runs in the EU (Frankfurt).
1. Categories of personal data we process
Account and payment
- Account and licence: your e-mail address, the plan and status of your licence and its validity dates, and for business licences the company name. We need these to issue your licence, link it to your subscription and contact you about the service.
- Payment and invoicing: payments run entirely through Stripe; we never see or store card details. Stripe processes your billing name and address and, optionally, your VAT number. We keep the Stripe customer and subscription references.
Sign-in
- Licence key or e-mail code: you sign in with your licence key or with a one-time code sent to your e-mail address. For a code request we store the e-mail address, the IP address of the request (to limit abuse) and the code itself only as a cryptographic hash.
- Connected apps: when you connect an AI app, we register the name of that app (for example "ChatGPT" or "Claude") and its return address, and issue access tokens that we store only as hashes, together with the time they were last used.
- Licence keys are likewise stored only as a cryptographic hash (SHA-256); the key itself stays with you.
Use of the service
- Usage metadata: for each tool call we record which tool was called, the time, the duration, the number of results, whether the result came from our own index, a status or error code, and the channel (for example Claude or ChatGPT). These records have no fields for the content of your questions or documents.
- Optional features: if you create a verification code or a partner code, we store that code with your licence and the time of creation, not the text it relates to. If a new customer uses your partner code, we record that link in order to grant the reward.
- Technical logs: our hosting providers record technical request data (IP address, app or browser identifier, time and requested address) for security and troubleshooting. These logs contain no request content.
What we do not store
To answer your request, the AI assistant sends our tools concrete instructions, such as a statutory article, a search term, a case number or a web address. We process this input in memory to carry out the request and discard it immediately afterwards. It is not logged, not used for training and not reused in any other way. This is an architectural choice, not a setting.
Website and contact
- Website statistics: lawbot.nl uses Clicky to count visits (pages viewed, referring page, device type and an approximate location). Clicky works without cookies on our website and stores IP addresses only in anonymised form. We use no advertising technology. During checkout, Stripe may use functional cookies on its own domain.
- Contact: if you e-mail us, we process your message and contact details to answer it.
2. Purposes and legal bases
- Performance of the contract: issuing licences, access to the service, sign-in, invoicing and support (Art. 6(1)(b) GDPR).
- Legitimate interests: fair-use limits, security and abuse prevention, and improving the service on the basis of aggregated metadata and website statistics (Art. 6(1)(f) GDPR).
- Legal obligation: statutory retention of invoicing data (Art. 6(1)(c) GDPR).
We do not sell personal data, do not use it for advertising, and do not make automated decisions about you that have legal or similarly significant effects.
3. The AI channels: Claude and ChatGPT
LawBot works inside an AI assistant of your choice: Claude (Anthropic, including Claude for Word) or ChatGPT (OpenAI). This means there are two layers:
- Your conversation with the assistant (your prompts and its answers) is processed by the provider of that assistant under your agreement with them. Their terms and settings, such as training opt-outs, apply to that layer.
- The LawBot server only receives the concrete tool instructions the assistant passes on, carries them out on official sources and returns the result, without keeping any of that content. This applies on every channel. When you connect an app, our sign-in service tells that app which account is connected: your licence identifier, your e-mail address and, for business licences, the company name.
Recommendation for confidential client work, in line with the Netherlands Bar's guidance on AI: do not include client-identifying information in prompts unless it is necessary, and use the channel your firm has made arrangements for. LawBot itself treats every channel with the same restraint: no content is stored.
4. Categories of recipients
| Recipient | Role and data received | Location |
|---|---|---|
| Supabase | Database and server functions (core infrastructure); the data in section 1, except payment data | EU, Frankfurt (AWS eu-central-1) |
| Vercel | Hosting of the sign-in pages at portal.litic.ai; technical request data | EU edge / United States |
| TransIP | Hosting of the website lawbot.nl; technical request data and website forms | Netherlands |
| Stripe | Payments, invoicing and VAT; billing data | EU / United States (independent controller for payment data) |
| Brevo | Sending e-mail (sign-in codes, licence keys, service messages); e-mail address and message | EU |
| OpenAI (API) | Converting public legal texts, and the question of a semantic case-law search, into a numeric vector for our search index. The question is not stored by us; under OpenAI's API terms it is not used for training and is kept by OpenAI for at most 30 days for abuse monitoring | United States |
| Brave Search | Web search tool; the search term | United States |
| Perplexity and Browserless | In-depth web research, only when enabled for your licence; search terms and the web addresses to be retrieved | United States / EU (Amsterdam) |
| Clicky (Roxr Software) | Website statistics; visit data with anonymised IP addresses | United States |
| Official sources | rechtspraak.nl, wetten.overheid.nl, officielebekendmakingen.nl, tuchtrecht.overheid.nl, EUR-Lex, linkeddata.overheid.nl; the search query is executed there | EU |
| The AI app you connect | Anthropic or OpenAI, under your own agreement with them; tool results and, at sign-in, your account details (section 3) | Per provider |
We have data processing agreements with our processors. Data is only transferred outside the European Economic Area on the basis of an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.
5. Data retention
- Content of your work: not applicable, it is never stored.
- Usage metadata: individual records for at most four months; hourly totals per licence for at most 12 months, after which they are deleted or fully anonymised.
- Sign-in codes and key-recovery links: valid for 10 and 30 minutes respectively; the records (e-mail address, IP address and hash) are deleted after 30 days.
- Connection tokens: access tokens expire after 24 hours, refresh tokens after at most 90 days without use, authorisation codes after 5 minutes.
- Technical logs: kept only briefly for security and troubleshooting; in our core infrastructure they are deleted automatically after 7 days.
- Account and licence data: for as long as your licence exists, and afterwards for as long as needed to settle the contract.
- Invoicing data: for the statutory retention period (up to 10 years), at Stripe and in our accounts.
- Website statistics: kept in Clicky for as long as we use the service; they contain no directly identifying data.
- Support e-mails: for as long as needed to handle your question and the follow-up of your contract.
6. Your controls
- Disconnect at any time: remove or disconnect LawBot in your AI app. Your access tokens are then no longer used and expire within 24 hours; on request we sign out all connected apps immediately.
- Sign in without e-mail: you can always sign in with your licence key only.
- Replace your licence key if you think it has leaked; all connected apps are then signed out.
- Web research only when needed: web search and in-depth web research are only used when your request calls for them, and in-depth web research only when it is enabled for your licence.
- Manage your subscription and download invoices via the Stripe customer portal.
- Exercise your privacy rights by e-mail (section 8).
7. Security
Keys and tokens are stored only as hashes, secrets are kept in a separate vault, all traffic uses TLS, and the core infrastructure runs in a single EU region. The most important measure is the architecture itself: what is not stored cannot leak. That is why we store no content.
8. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object. E-mail support@litic.ai; we respond within one month. You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit) or the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
9. Children
LawBot is a professional service and is not intended for persons under 16. We do not knowingly process their personal data.
10. Changes
When we change this policy in substance, we say so on this page with a new version date. The current version is always available at lawbot.nl/en/privacy-policy; the Dutch version at lawbot.nl/privacy.