Status of this document
This document has not yet been reviewed by external legal counsel. It is published so that prospective design partners can see the intended terms in full.
Not production-ready
This draft is not ready for execution. Several provider, region and contract facts referenced by Art. 28 are not yet verified on our side; those points are marked as open below rather than filled in. The processor is currently the provider named in the legal notice, not a future company; formation-dependent passages remain subject to legal review.
1 — Subject matter and duration
Processing of personal data that the controller makes available through the KLARMASS service, for the duration of the service relationship.
2 — Nature and purpose of processing
- Storage of uploaded work products and their parsed content.
- Identification of externally checkable claims and inspection of their evidence.
- External verification, including discovery queries and source retrieval.
- Recording of human resolutions, materiality confirmations and review dispositions.
- Account, workspace and support administration.
3 — Categories of data and data subjects
Account and contact data of the controller's users; any personal data contained in uploaded documents. During the current phase the controller undertakes not to upload confidential or personal material.
4 — Instructions
The processor processes personal data only on documented instructions from the controller, including with regard to transfers to third countries, unless required to do so by Union or member state law.
5 — Confidentiality
Persons authorised to process the data are committed to confidentiality.
6 — Security of processing
The measures set out in the technical and organisational measures document apply. Only measures actually implemented are stated there.
7 — Subprocessors
The controller grants general authorisation for the subprocessors listed in the subprocessor register, subject to notification of changes and a right to object. Contractual coverage of several of these subprocessors is open and marked accordingly in the register.
| Party | Function | Data reaching it | Region | Status |
|---|---|---|---|---|
| Lovable (hosting and platform) | Website delivery, server-side application logic, deployment, platform logs | Request metadata, session tokens, request and response bodies, error text | Undisclosed | Not verified |
| Supabase (via Lovable Cloud) | Database, authentication, document storage | All governed content, credentials, uploaded documents | AWS eu-west-1 (Ireland) | Partly verified |
| AWS | Underlying infrastructure for the database, auth and storage | As above | Ireland | Verified |
| Lovable AI Gateway | Routing of AI requests | Document text, claim text, retrieved passages | Undisclosed | Not verified |
| Model provider behind the configured alias | Inference | Document text, claim text, retrieved passages | Undisclosed | Not verified |
| Brave Search | Discovery of candidate sources | Claim-derived query strings | Undisclosed | Not verified |
| Original source websites | Passage retrieval | Server-side HTTP request originating from KLARMASS | Wherever the source is hosted | Varies by source |
| IONOS | Domains, DNS, mailboxes | Email sent to KLARMASS addresses, DNS queries | Germany (mail); DNS anycast | Partly verified |
| Sender of account emails | Confirmation and password-reset messages | Email address, one-time links | Undisclosed | Not verified |
8 — Assistance with data subject rights
The processor assists the controller with appropriate measures in responding to requests from data subjects and in meeting the obligations under Art. 32 to 36 GDPR.
9 — Personal data breaches
The processor notifies the controller without undue delay after becoming aware of a personal data breach and provides the information available to it.
10 — Return and deletion
On termination the processor deletes or returns the personal data at the controller's choice, unless storage is required by law.
11 — Audit rights
The processor makes available the information necessary to demonstrate compliance and allows for audits, including inspections, conducted by the controller or a mandated auditor, within reasonable limits.
Open points in this draft
Hosting region of the application runtime, region and retention of the AI processing chain, log and backup locations, and the identity and contractual status of the email sender are not verified and are therefore not asserted in this draft.