Privacy Policy

The controller of platform-user data is the company operating Legisto: Genaitive sp. z o.o., ul. Żurawia 71, 15-540 Białystok, Poland, VAT ID 9662207839, company register 0001179479.

For matters concerning personal data, contact kontakt@legisto.pl.

Account data (name, e-mail address, role in the firm), authentication data, and data entered while using the platform (cases, deadlines, documents, time, receivables).

Technical data: access logs, IP address, device information, and module-visit counters, to the extent necessary for security and operation of the service.

Providing the service and account management: Art. 6(1)(b) GDPR (performance of a contract).

Security, abuse prevention, access audit: Art. 6(1)(f) GDPR (legitimate interest).

Compliance with legal obligations (e.g. accounting): Art. 6(1)(c) GDPR.

Integrations at the user's request (e.g. Google Calendar): based on consent, Art. 6(1)(a) GDPR; consent may be withdrawn at any time.

After connecting a Google account we access only the scope necessary for deadline synchronization and import of selected files. We do not read or store the full content of the Google account beyond what is necessary for the feature.

Data processed by infrastructure providers is located in the European Union. The full list of processors is in section 5.

We use trusted providers acting on our behalf (processors) under data processing agreements:

Vercel (application hosting, EU region), Supabase (database and authentication, EU region, Frankfurt), Anthropic (AI features, processing requests on the user's demand), Resend (e-mail delivery), Stripe (payments, where applicable).

Data is not sold or used to train AI models on firm case files. The controller is informed of changes to the subprocessor list, with the right to object.

We retain data for the term of the agreement and for the period required by law (e.g. tax), or until consent is effectively withdrawn where processing is based on consent.

Data entered into the platform by the firm is subject to retention rules set by the firm (controller), with a default case-retention clock.

The right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21).

The right to lodge a complaint with the President of the Personal Data Protection Office (UODO).

We use files and mechanisms necessary for the service: login session, language preference (lx-locale), and theme preference. We do not use external analytics or marketing cookies.

Internal module-visit counters are used solely for product development and stay within the platform.