In short
- Stored in Germany. The Legal OS app of a firm based in the EU/EEA, the United Kingdom or Switzerland runs on our servers in Frankfurt (Berlin when Frankfurt has no room) — its database, documents and uploads included.
- Never used for training. Client files, matters, documents and messages are never used to train AI models — not ours, not any provider's.
- Two AI providers, named. For a review, redline, research memo or draft, the passages needed are sent to Anthropic (primary) or OpenAI (fallback) in the USA. Nobody else sees client text.
- 30 days at most at the AI provider under their standard API terms; zero retention with your own key and your own agreement with the provider.
- Data processing agreement with a confidentiality clause for professional secrecy (§ 203 StGB, § 43e BRAO, and the equivalent rules elsewhere) — see section 6.
1. Where your firm's data is stored
Each firm gets its own app with its own database. That database lives on the server that runs the app. For firms based in the EU/EEA, the United Kingdom or Switzerland, that server is in Germany: Frankfurt first, Berlin when Frankfurt has no room. Both are servers we rent from IONOS SE, a German company.
Your Autoflowly account itself (name, e-mail, plan, the conversation with the builder) is held on our platform servers in the USA (IONOS data centre, Kansas City). It contains no client files.
If neither German server has room at the moment your app is created, it is placed in the USA. Ask us where your app runs; we move it to Germany on request at no cost. Apps created before 15 October 2026 were created in the USA; we move them to Germany on request — write to privacy@autoflowly.com.
2. Who sees client text
| Who | When | What | Where |
|---|---|---|---|
| Autoflowly (Jules Guilain Kenfack, Mühlacker, Germany) | Running the app; support only when you ask for it | Everything stored in your app | Germany (servers, see 1) |
| IONOS SE, Germany | Hosting provider of our servers | Encrypted volumes; no access to content in normal operation | Frankfurt / Berlin |
| Anthropic, PBC | Only when you run an AI task (review, redline, research, draft, Word add-in) | The passages that task needs | USA — DPF and SCCs |
| OpenAI, L.L.C. | Only when Anthropic is unavailable | Same as above | USA — DPF and SCCs |
Only if you use them yourself: Resend (e-mails your app sends to clients), your own Stripe account (client payments) and Twilio (phone and SMS). The official law databases (EUR-Lex, BOE, Légifrance, CourtListener and others) receive search words, never documents.
With your firm's own Anthropic or OpenAI key (the app's Integrations), AI requests go to that provider under your contract with it, and Autoflowly's AI relay is not used at all.
3. How long the AI providers keep it
Under their standard API terms, Anthropic and OpenAI delete inputs and outputs within 30 days and keep them only for abuse monitoring or where the law requires; neither trains on API data. Zero data retention — nothing kept once the answer is returned — needs a separate agreement with the provider. On our shared key we do not have one today, so we do not promise it. With your own key you can conclude it directly with the provider.
In your app, documents, AI answers and audit entries stay until you delete them or close the app. When you close the app, its database is deleted within 30 days and from backups within a further 30 days. You can export your data and your app's code first.
4. Security
- Each app runs isolated, in its own container with its own database.
- TLS on every connection; encrypted storage volumes; passwords hashed.
- Staff accounts by invitation only, with roles; an app is private until the firm publishes it.
Certifications. Autoflowly itself holds no SOC 2 or ISO 27001 certificate. We will not claim one we do not have. Our technical and organisational measures are described on the security page and in Annex 2 of the agreement below.
5. Your rights as controller
Your firm is the controller of its clients' data; Autoflowly processes it on your behalf. You can read, correct, export and delete everything in your app at any time, and answer your clients' requests from it.
6. Data processing agreement (Art. 28 GDPR)
This agreement applies to every Legal OS app of a firm that accepts our Terms. A countersigned copy is available on request from privacy@autoflowly.com.
- Subject and duration. Autoflowly hosts and operates the firm's app and runs the AI tasks the firm starts, for as long as the app exists.
- Data and data subjects. Clients, opposing parties, witnesses, employees and other persons named in matters, documents, time entries and invoices; this may include special categories (Art. 9) and data on criminal offences (Art. 10).
- Instructions. We process the data only on the firm's documented instructions — given by using the app — unless the law requires otherwise, in which case we tell the firm first where allowed.
- Confidentiality and professional secrecy. Everyone at Autoflowly with access is bound to confidentiality. We know that the data may be covered by professional secrecy (§ 203 StGB, § 43e BRAO, § 62a StBerG and the equivalent rules in other countries); we take note of the criminal liability for unauthorised disclosure, access client content only as far as strictly necessary to provide the service, and pass these obligations on to every sub-processor in writing.
- Security (Art. 32). The measures in Annex 2. We may improve them; we will not lower their level.
- Sub-processors. The firm authorises those listed in section 2. We announce a new one at least 30 days in advance by e-mail; the firm may object and, if we cannot meet the objection, close the app with a refund of prepaid fees.
- Transfers. Transfers to the USA rest on the EU–US Data Privacy Framework and the EU Standard Contractual Clauses.
- Assistance. We help the firm with data subjects' requests, security of processing, breach notifications, impact assessments and consultation of the authority (Art. 32–36).
- Breaches. We notify the firm without undue delay and within 48 hours of becoming aware of a breach affecting its data.
- End. When the app is closed we delete the data within 30 days (backups within a further 30 days) unless the firm first exports it; the law may require us to keep invoices of our own.
- Audits. We provide the information needed to show compliance, and allow and contribute to audits by the firm or an auditor it appoints, with reasonable notice, at most once a year unless there is a breach.
Annex 1 — Sub-processors: section 2. Annex 2 — Technical and organisational measures: section 4 and the security page.
Contact
Jules Guilain Kenfack, trading as Autoflowly Software, Bernhardhauser Str. 1/2, 75417 Mühlacker, Germany · privacy@autoflowly.com · Privacy policy