Status of this document
This document has not yet been reviewed by external legal counsel. It is published so that prospective design partners can see the intended terms in full.
1 — Controller
KLARMASS is a project and a brand, not a separate legal entity. The provider is the named person below.
- Provider
- KLARMASS – a project by Ingo Zang
- hello@klarmass.eu
Privacy contact: privacy@klarmass.eu. No data protection officer has been appointed at this time; whether an appointment is required is being assessed.
2 — Website access and server logs
When you access this website, technical data such as IP address, time of access, requested resource, referrer and user agent is processed to deliver the site and maintain its security and stability. Legal basis: Art. 6(1)(f) GDPR. The hosting region and the retention period of these logs are currently being verified with the platform provider and are therefore not stated here as fact.
3 — Account registration and authentication
To use the product you create an account. We process your email address, your display name, an optional title, your workspace membership and authentication metadata. Legal basis: Art. 6(1)(b) GDPR. Authentication data is stored in the EU (AWS eu-west-1, Ireland).
4 — Workspace and profile data
Workspace name, roles (creator, reviewer), language preferences and pilot participation data are processed to operate the service and to keep decisions attributable. Legal basis: Art. 6(1)(b) and (f) GDPR.
5 — Uploaded work products
Documents you upload are stored in a private storage bucket in the EU (AWS eu-west-1, Ireland). The original file is retained unchanged. Uploads are restricted to synthetic, deliberately redacted or otherwise non-confidential documents; please do not upload personal or confidential material.
6 — Document parsing and claim extraction
Uploaded documents are parsed server-side into text blocks, tables and references. Statements that can be checked externally are identified and stored together with their position in the original document.
7 — AI-assisted inspection
Content of the document version being inspected is transmitted to an AI gateway for evidence inspection. Region, retention period and any use for model training in this chain have not been verified by us and are therefore not asserted here. Because of this, the service is restricted to non-confidential material.
8 — Verification, discovery queries and source retrieval
For verification, a search query derived from the claim is sent to an external search provider (Brave) to discover candidate sources. KLARMASS then retrieves the candidate sources server-side and stores the relevant passages together with their origin. Discovery queries may contain terms taken from your document.
9 — Human decisions and activity data
Resolutions, materiality confirmations and review dispositions are stored with the acting person and a timestamp. This attribution is a core purpose of the product and cannot be switched off. Legal basis: Art. 6(1)(b) and (f) GDPR.
10 — Language preferences
Interface, result and report language preferences are stored with your profile and in your browser's local storage so that the service can be shown in your language.
11 — Support and contact
If you contact us by email, we process the content of your message to handle the enquiry. Legal basis: Art. 6(1)(b) or (f) GDPR.
12 — Authentication emails
Sign-in and account emails are sent through the platform's email service. The provider identity and sending region are currently being verified and are therefore not stated as fact.
13 — Retention
Account, workspace, document, evidence and decision data is retained for the duration of the pilot participation and deleted on request, unless statutory retention obligations apply. Backup retention periods at the platform provider have not been verified.
14 — Recipients and subprocessors
| Party | Function | Data reaching it | Region | Status |
|---|---|---|---|---|
| Lovable (hosting and platform) | Website delivery, server-side application logic, deployment, platform logs | Request metadata, session tokens, request and response bodies, error text | Undisclosed | Not verified |
| Supabase (via Lovable Cloud) | Database, authentication, document storage | All governed content, credentials, uploaded documents | AWS eu-west-1 (Ireland) | Partly verified |
| AWS | Underlying infrastructure for the database, auth and storage | As above | Ireland | Verified |
| Lovable AI Gateway | Routing of AI requests | Document text, claim text, retrieved passages | Undisclosed | Not verified |
| Model provider behind the configured alias | Inference | Document text, claim text, retrieved passages | Undisclosed | Not verified |
| Brave Search | Discovery of candidate sources | Claim-derived query strings | Undisclosed | Not verified |
| Original source websites | Passage retrieval | Server-side HTTP request originating from KLARMASS | Wherever the source is hosted | Varies by source |
| IONOS | Domains, DNS, mailboxes | Email sent to KLARMASS addresses, DNS queries | Germany (mail); DNS anycast | Partly verified |
| Sender of account emails | Confirmation and password-reset messages | Email address, one-time links | Undisclosed | Not verified |
15 — International transfers
Some of the services used may process data outside the EU or use subprocessors outside the EU. Because the corresponding contractual and regional facts have not been verified for every element of the chain, we do not state a general transfer position here. This is one reason for the current restriction to non-confidential documents.
16 — Your rights
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection (Art. 21 GDPR)
- Withdrawal of consent with effect for the future, where processing is based on consent
Please direct requests to privacy@klarmass.eu. You also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence, place of work or the place of the alleged infringement.
17 — Cookies and local storage
KLARMASS uses technically necessary storage only: an authentication session and your language preference. No analytics or advertising trackers are integrated, and therefore no consent banner is shown. If non-essential technologies are introduced, the consent architecture will be reassessed and this policy updated.
18 — Changes
This policy is versioned. The effective date is shown at the end of the page; previous versions are retained internally.