Privacy Policy

Comprehensive Privacy Policy governing personal data, legal work product, database metadata, and AI processing across Legalpunkt aOS, Datapunkt aOS, and the Agentpunkt Marketplace.

Enterprise AI Confidentiality & Non-Training Guarantee

Agentpunkt Marketplace ("Agentpunkt", "we", "us", or "our") enforces strict confidentiality controls across all our operating environments, including Legalpunkt aOS and Datapunkt aOS. We NEVER use your confidential legal documents, contract files, work product, proprietary database schemas, or agent prompts to train public or foundational artificial intelligence models without your explicit, affirmative, written opt-in consent.

This Privacy Policy ("Policy") sets forth the comprehensive standards and operational procedures governing the collection, processing, storage, disclosure, protection, and international transfer of personal data and confidential technical assets by Agentpunkt Marketplace, operating out of the European Union. This Policy applies to all visitors, account holders, legal operators, corporate subscribers, developers, and enterprise clients accessing our website, applications, APIs, hosted agent runtimes, and specialized AI operating systems: Legalpunkt aOS, Datapunkt aOS, and the Agentpunkt Marketplace (collectively, the "Services").

Please read this Policy carefully to understand our practices regarding your data and how we fulfill our legal obligations under the European Union General Data Protection Regulation (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the EU Artificial Intelligence Act (EU AI Act), and other applicable global data protection regimes.

1. Categories of Data Collected & Processed

We collect and process various categories of data depending on the specific product, operating system tier, or interface you engage with across our platform ecosystem.

1.1 Legalpunkt aOS Data Assets & Legal Work Product

Legalpunkt aOS serves as our specialized AI Agent Operating System designed for legal search, legal project execution, legal contract redlining, legal playbooks, legal skills execution, legal artifact creation, and legal billing tracking. In connection with Legalpunkt aOS, we process:

  • Legal Documents & Case File Data: Uploaded contracts, litigation briefs, discovery transcripts, judicial filings, regulatory compliance submissions, corporate governance records, legal search queries, and structured prompt inputs ("Legal Inputs").
  • Generated Legal Artifacts & Work Product: Contract redlines, clause recommendations, legal research syntheses, statutory risk analyses, due diligence reports, and automated legal memorandum outputs ("Legal Outputs").
  • Legal Practitioner Identifiers: Professional bar affiliation credentials, attorney license numbers, law firm or corporate employer entity names, business addresses, professional role designations (e.g., General Counsel, Managing Partner, Senior Associate, Paralegal), and billable rate structures.
  • Legal Audit Trails & Compliance Telemetry: Immutable, timestamped logs documenting legal search queries, playbook execution histories, version control deltas, and time-tracking metrics required for professional bar compliance and enterprise billing audits.

1.2 Datapunkt aOS Technical Metadata & Engineering Data

Datapunkt aOS serves as our specialized AI Agent Operating System designed for enterprise data engineering, metadata extraction, automated code generation, data lineage tracking, data modeling, synthetic data generation, and IT data support. In connection with Datapunkt aOS, we process:

  • Database Metadata & Schemas: Relational and non-relational database table schemas, DDL definitions, column data types, foreign key relationships, SQL query scripts, Python data pipeline code, and data lineage mapping definitions. Database connection credentials are end-to-end encrypted and managed in isolated secrets vaults.
  • Synthetic Dataset Specifications: Parameters, distribution constraints, schema mappings, and seed rules utilized to synthesize non-personally identifiable artificial testing data.
  • Data Pipeline Performance Logs: Query execution durations, data transformation telemetry, error tracebacks, schema drift alerts, and memory utilization logs.

1.3 Agentpunkt Marketplace & Account Data

The Agentpunkt Marketplace allows users, businesses, and developers to discover, license, buy, sell, and hire specialized AI agents. In connection with Marketplace operations, we process:

  • Account Identity Data: Full legal name, business email address, account password (hashed using bcrypt), username, avatar, and authentication tokens.
  • Financial & Billing Information: Payment card tokens, bank account details for payout processing, transaction receipts, VAT numbers, subscription invoices, and credit usage ledgers. Payments are processed securely via PCI-DSS Level 1 compliant payment gateways (e.g., Stripe).
  • Marketplace Interactions & Ratings: Agent reviews, star ratings, merchant developer listings, support tickets, community forum contributions, and communication records between Buyers and Sellers.

1.4 Automated Technical Telemetry & Device Data

When you access or interact with any part of our platform, our servers automatically record standard internet telemetry:

  • Network & Device Identifiers: IP address, browser user-agent string, operating system type and version, language settings, network service provider, and general coarse location derived from IP lookup.
  • Session Analytics & Cookies: Essential session cookies, security tokens, page response metrics, clickstream patterns, and feature usage analytics collected via first-party diagnostic tools.

2. Roles of the Parties: Data Controller & Data Processor

Under the EU GDPR, UK GDPR, and international data protection laws, the legal capacity in which Agentpunkt processes personal data depends on the nature of the data and your engagement with our platform:

Agentpunkt as Data ControllerAgentpunkt acts as a Data Controller with respect to personal data collected directly from website visitors, registered account users, billing contacts, and platform telemetry (such as your account profile, billing credentials, transaction receipts, security logs, and customer support correspondence). In this capacity, Agentpunkt determines the legal purposes and means of processing in accordance with this Policy.
Agentpunkt as Data Processor (for Client Data & Work Product)When corporate subscribers, law firms, and legal practitioners use Legalpunkt aOS to upload legal case files, contracts, discovery documents, or execute searches concerning counterparties or individuals, the subscriber serves as the Data Controller. Agentpunkt acts strictly as a Data Processor (or Service Provider), processing such data solely pursuant to the customer's documented instructions and executed Data Processing Agreements (DPAs) in compliance with GDPR Article 28.

3. Lawful Bases & Specific Purposes of Data Processing

Under the EU GDPR and global privacy frameworks, we only process personal data when we have an established legal basis. The table below details our processing purposes and corresponding lawful bases:

Processing PurposeData Categories ProcessedLawful Basis (GDPR Art. 6)
Operating Legalpunkt aOS legal search, contract analysis, playbook execution, and legal billing trackingLegal Work Product, Contracts, Attorney Data, Audit LogsPerformance of Contract (Art. 6(1)(b))
Operating Datapunkt aOS metadata extraction, code generation, data lineage, and synthetic data modelingDatabase Schemas, Metadata, SQL/Python Scripts, LogsPerformance of Contract (Art. 6(1)(b))
Processing marketplace orders, subscriptions, developer payouts, and credit accountingFinancial & Account Data, Transaction RecordsPerformance of Contract (Art. 6(1)(b))
Ensuring platform security, threat detection, preventing prompt injection, and audit trail retentionIP Addresses, Telemetry, System Logs, Account DataLegitimate Interests (Art. 6(1)(f))
Fulfilling tax reporting, statutory accounting, EU AI Act compliance, and legal process obligationsInvoices, Business Identifiers, Audit Trail RecordsLegal Obligation (Art. 6(1)(c))

4. Public Registers, Open Legal Intelligence & Freedom of Information

Legalpunkt aOS aggregates and facilitates search across publicly accessible judicial decisions, statutory registers, company filings, court dockets, regulatory publications, and official sanctions lists to provide transparency and legal research capabilities:

  • Freedom of Information & Legitimate Interest: Processing of personal data indexed from official public records is conducted for legitimate legal research, public interest, and transparency purposes, pursuant to Article 6(1)(f) and Article 17(3)(a) of the EU GDPR, Article 10 of the European Convention on Human Rights (ECHR), and Article 11 of the EU Charter of Fundamental Rights.
  • Public Register Right to Erasure Exceptions: The statutory 'right to be forgotten' (erasure) does not mandate the removal of lawfully indexed public records or judicial opinions that remain publicly available in official government or court registers. If an official public source amends, seals, or removes an underlying record (e.g., expungement of a judicial filing or de-listing from an official sanctions registry), Agentpunkt will update or remove the corresponding record from its search index promptly upon verified notification.

5. AI Infrastructure, Zero-Data-Retention & Subprocessors

To provide the state-of-the-art intelligence powering Legalpunkt aOS and Datapunkt aOS, we integrate with enterprise artificial intelligence foundation model infrastructure providers. We maintain rigid contractual safeguards with all subprocessors:

Enterprise Zero-Data-Retention (ZDR) Endpoints

All AI model inference requests generated through Legalpunkt aOS and Datapunkt aOS are transmitted strictly over secure TLS 1.3 connections to enterprise model endpoints governed by binding Zero-Data-Retention (ZDR) agreements. Under these agreements, third-party model providers process your input prompts and files in volatile RAM solely for the millisecond duration required to generate the output completion, after which all memory buffers are immediately erased. No customer data is written to disk or retained by third-party model hosts.

Vetted Cloud Infrastructure Subprocessors

Our core database systems, encrypted vaults, and application servers are hosted in top-tier ISO 27001 and SOC 2 Type II certified data centers operated by Amazon Web Services (AWS) and Google Cloud Platform (GCP) located in the European Union. All subprocessors operate under signed Data Processing Agreements (DPAs) containing Standard Contractual Clauses (SCCs).

6. Data Storage, Encryption & Security Architecture

Agentpunkt employs a multi-layered technical and organizational security framework designed to protect high-value legal work product and enterprise data infrastructure against unauthorized access, loss, or exfiltration:

AES-256 & TLS 1.3 EncryptionAll stored files, legal project vaults, contract drafts, database connection strings, and backups are encrypted at rest using AES-256. All network traffic is encrypted in transit using TLS 1.3 with standard HSTS preloading.
Customer Vault IsolationLegalpunkt aOS project environments and Datapunkt aOS metadata stores utilize strict multi-tenant logical isolation and role-based access control (RBAC) to ensure your organization's legal files cannot be accessed across account boundaries.

7. Comprehensive Cookies & Tracking Technologies Policy

We utilize first-party and select third-party cookies, web beacons, and local storage tokens to deliver secure authentication, maintain user preferences, and analyze platform performance in accordance with the e-Privacy Directive and GDPR:

Strictly Necessary CookiesEssential for core platform navigation, secure account authentication, CSRF token validation, load balancing, and session integrity. These cookies cannot be deactivated in our systems and do not require prior consent.
Performance & Analytics CookiesCollect anonymized telemetry and aggregated metrics regarding page load speeds, workflow latency, and feature usage patterns to optimize platform reliability and diagnostic monitoring.
Functionality CookiesPreserve user-selected preferences across sessions, including interface language, dark/light theme, and active workspace configurations.
Targeted Marketing & Conversion CookiesMeasure the efficacy of authorized promotional campaigns and track referral conversions. These cookies are disabled by default and require explicit user opt-in.
Cookie Management & Browser ControlsYou can configure or update cookie consents at any time via the in-app Cookie Preferences modal. You may also disable or delete cookies directly in your web browser settings (Google Chrome, Mozilla Firefox, Apple Safari, Microsoft Edge). Disabling essential cookies may impair core platform features.
Do Not Track (DNT) & Zero-Profiling GuaranteeBecause we do not track platform users across third-party websites or engage in behavioral cross-site advertising, we do not alter platform behavior based on browser DNT signals. We do not perform automated individual profiling producing legal effects based on tracking cookies.

8. Data Retention, Erasure & International Transfers

We retain personal data and legal project records only for as long as necessary to fulfill the purposes outlined in this Policy, or as required to comply with statutory legal, tax, accounting, and professional audit obligations.

  • User-Controlled Vault Destruction: Users and law firm administrators can trigger permanent deletion of specific Legalpunkt aOS legal projects, contract files, or Datapunkt aOS metadata schemas at any time. Upon deletion, data is purged from active databases immediately and wiped from encrypted cold backups within 30 days.
  • International Transfers: Where data is transferred outside the European Economic Area (EEA) or United Kingdom, we rely on official European Commission Adequacy Decisions, the EU-U.S. Data Privacy Framework, or execute European Commission Standard Contractual Clauses (SCCs) supplemented by Transfer Impact Assessments (TIAs).
  • Minors & Children's Data Protection: Our Services are strictly designed and intended for commercial and professional use by individuals aged 18 and older. We do not knowingly collect, process, or solicit personal data from children under 13 (or under 16 in applicable EEA jurisdictions). If we become aware of inadvertent collection of data from minors, we will promptly purge such data.

9. Your Statutory Rights (GDPR, CCPA/CPRA & Global Privacy Laws)

Depending on your place of residence, you hold comprehensive statutory data privacy rights regarding your personal information:

Right of Access & PortabilityRequest confirmation of processing, receive a structured copy of your personal data, and export your Legalpunkt/Datapunkt workspace artifacts in machine-readable formats.
Right to Erasure ("Right to be Forgotten")Request the permanent deletion of your account, profile, legal project vaults, and transaction histories, subject to statutory tax or regulatory retention mandates.
Right to RectificationCorrect incomplete, inaccurate, or outdated personal identification, professional bar credentials, or organizational account settings.
Right to Object & Opt-OutObject to data processing based on legitimate interests, restrict processing activities, and opt-out of marketing communications. We do not sell or share personal data for cross-context behavioral advertising.
Identity Verification for Data RequestsTo protect your confidentiality and ensure that personal information is not inadvertently disclosed to unauthorized third parties, we require verifiable proof of identity before fulfilling any data access, rectification, portability, or erasure request. Verified requests are processed within statutory timeframes (30 calendar days, extendable by 60 days for complex inquiries).
Anti-Fraud & Security IntegrityWe maintain rigorous anti-fraud monitoring and technical defense controls to protect user accounts and platform registries from credential harvesting, fraudulent inquiries, identity impersonation, and unauthorized attempts to manipulate or exfiltrate customer data assets.

10. Third-Party Services, API Integrations & External Security Boundaries

Our platform integrates with select enterprise third-party services and cloud APIs to provide rich media, payment processing, and security authentication:

Google Services & YouTube API Disclosure

Where our learning paths, documentation, or events feature embedded instructional videos, we utilize YouTube API services. By interacting with these features, you acknowledge and agree to be bound by the Google Privacy Policy (http://www.google.com/policies/privacy) and YouTube Terms of Service (https://www.youtube.com/t/terms).

Two-Factor Authentication (2FA) via SMS

When you enable two-factor authentication for enhanced account security, authentication codes are delivered directly to your verified mobile phone number via SMS. Telecommunication delivery providers process these requests strictly for the transmission of one-time login verification codes.

Payment Processing Gateways

Online transactions and subscription payments are handled securely through PCI-DSS Level 1 compliant payment gateway providers (e.g., Stripe). Agentpunkt never stores raw credit card numbers (PANs) or CVV security codes on its servers.

External Cyber Threats & Infrastructure Boundaries

While Agentpunkt enforces industry-leading defense-in-depth security, the platform may experience service disruptions or latency caused by external factors beyond our reasonable control, including upstream ISP outages, distributed denial-of-service (DDoS) attacks, or third-party telecommunication failures.

11. Contact Information & Privacy Office

To exercise any of your statutory data rights, submit privacy inquiries, or request an enterprise Data Processing Agreement (DPA) containing Standard Contractual Clauses for Legalpunkt aOS or Datapunkt aOS, please contact our Compliance Office:

Agentpunkt Data Protection & Compliance Office

Official Contact Email: info@agentpunkt.com