Version 13.8 · Effective September 17, 2026
Aslak Media ApS (CVR DK44604957), trading as Lawcel ("we", "us"), is the data controller for personal data processed as described in this Policy.
| Company | Aslak Media ApS (trading as Lawcel) |
| Registered address | Vesterbrogade 52a, 3250 Gilleleje, Denmark |
| General contact | hello@lawcel.com |
| Privacy contact | privacy@lawcel.com |
When we process personal data on behalf of a customer organisation (for example, content inside their pull requests or legal documents), we act as a processor under a separate Data Processing Agreement.
This Policy applies to visitors to lawcel.com, prospective customers, and authorised users of the Lawcel platform. The Service is directed at businesses; it is not intended for consumers.
It does not govern personal data we process on behalf of customers as their processor — for that, contact the customer directly.
From you or your organisation. Account details (name, email, profile image, role), organisation details (name, address, contact email, registration number, optional DPO contact), legal documents you upload or generate, comments you write on cases, notification preferences, and access requests if you submit one.
Automatically when you use the Service. Integration credentials (GitHub App installation IDs, OAuth tokens for Linear and Jira, API key hashes); content ingested via your connected integrations (PR and issue titles, descriptions, code diffs); IDE-integration chat history if you use it; technical request logs; LLM analysis records associated with compliance events; session metadata (last login, approximate IP-derived location).
When you apply to the startup program. If you submit the public startup program application form (/startups), we collect your work email address, company name, company website, founding date, team size, funding raised, and a free-text description of what you build.
When you sign up for our newsletter. If you subscribe to our marketing newsletter on the marketing site, we collect the email address you provide. We also record newsletter consent records (consent timestamp, the IP address at the time of consent, the exact versioned wording you consented to, and double opt-in confirmation) to evidence your consent.
From third parties. Public company-registry data (e.g. Danish CVR) used to pre-populate your organisation profile during onboarding.
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Providing the Service: authentication, processing your integrations, performing compliance analysis, generating proposed legal-document changes, maintaining version history | Contract — 6(1)(b) |
| Account and organisation management, including team membership and role assignment | Contract — 6(1)(b) |
| Sending magic-link sign-in, team-invite, and transactional notification emails (e.g. @mention alerts) | Contract — 6(1)(b) |
| Security, abuse prevention, rate-limiting | Legitimate interests — 6(1)(f) |
| Reliability monitoring and debugging | Legitimate interests — 6(1)(f) |
| Capturing analysis traces and LLM usage for auditability and cost attribution | Legitimate interests — 6(1)(f) |
| Pre-sales communication when you submit an access request | Legitimate interests / pre-contractual steps — 6(1)(f) / 6(1)(b) |
| Reviewing startup program discount applications and understanding who applies for startup pricing | Legitimate interests — 6(1)(f) |
| Sending our marketing newsletter to subscribers who opted in | Consent — 6(1)(a) |
| Keeping newsletter consent records (timestamp, IP address, versioned consent wording, double opt-in) to demonstrate consent | Legal obligation — 6(1)(c) |
| Compliance with our own legal obligations (e.g. responding to lawful requests) | Legal obligation — 6(1)(c) |
We do not currently rely on consent as a legal basis except for non-essential cookies (see Section 9). Where we rely on legitimate interests, we have conducted a balancing assessment; you may object as set out in Section 8.
Sub-processors. Third parties that process personal data on our behalf, under written processing agreements. The current list is published at lawcel.com/policies/sub-processor-list — Anthropic (US, AI analysis), Hetzner (Germany, hosting), Resend (US, email), Stripe, Inc. (US, payment processing and subscription management), Geoapify GmbH (Germany, address geocoding and autocomplete), and Google LLC (US, marketing-site analytics, loaded only after analytics consent) at the Effective Date. We notify customers at least 30 days before adding or replacing a sub-processor.
Identity providers. Where you sign in with Google, Microsoft Entra ID, or GitHub, those providers act as independent controllers for the OAuth attributes they share with us; their own privacy notices apply.
Legal and regulatory disclosure. Where required by law, court order, or to establish or defend legal claims. We will notify the affected customer first where legally permissible.
Corporate transactions. In a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity. Material changes will be notified under Section 13.
We do not sell personal data and do not share it for cross-context behavioural advertising.
We are established in Denmark and host the application in the EU (Hetzner, Germany). Some sub-processors, Anthropic, Resend, Stripe, Inc., Google (marketing-site analytics), and the GitHub/Linear/Atlassian integration APIs, process data in the United States.
Transfers outside the EEA rely on the EU Standard Contractual Clauses (Module Two, Commission Decision 2021/914), supported by encryption in transit and at rest, contractual purpose-limitation on the processor, and a Transfer Impact Assessment per the Schrems II ruling and EDPB Recommendations 01/2020. For UK transfers, the UK International Data Transfer Addendum applies in addition.
A copy of the SCCs applicable to a specific sub-processor is available on request to privacy@lawcel.com.
| Category | Retention |
|---|---|
| Account and organisation data | Duration of the account; deleted within 30 days of contract termination, or on self-service account deletion |
| Legal documents and version history | Duration of the subscription; deleted within 30 days of termination |
| Workflow content (PRs, issues, diffs) | Duration of the subscription; deleted within 30 days of termination |
| IDE-integration chat history and memory | Duration of the subscription; deletable any time via the platform |
| Technical request logs (including IP address, user agent, and request metadata) | Retained indefinitely; no fixed deletion period is currently defined |
| Integration credentials, API key hashes, and OAuth access tokens for MCP agent connections | While the integration or connection is active; OAuth access tokens for MCP agent connections are revoked immediately on disconnection; remaining credential data hard-deleted within 90 days of disconnection |
| LLM analysis traces | Duration of the account; hard-deleted within 90 days of account deletion |
| LLM usage records (cost metering) | Retained while needed for billing; no fixed cut-off currently defined |
| Access request data | 12 months, or until conversion to an active account |
| Startup program applications (company, website, founding date, team size, funding, work email, description) submitted via the /startups form | 12 months from submission, then deleted regardless of outcome; erased earlier if the applicant closes a Lawcel account under the same email |
| Newsletter subscriber email address | Until the subscriber unsubscribes or withdraws consent |
| Newsletter consent records (timestamp, IP address, versioned wording, double opt-in) | For as long as the subscription exists and as required to demonstrate consent |
| Backups | Rolling 30-day window, then deleted |
Where Danish bookkeeping or tax law requires longer retention, we retain only what the law requires and only for the period required.
Account deletion is hard-delete: name, email, job title, and profile picture are removed immediately. Audit trail entries are anonymised to "Deleted User" so compliance history remains intact.
Under the GDPR you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection to processing based on legitimate interests (Art. 21), and not to be subject to a decision based solely on automated processing with legal or similarly significant effects on you (Art. 22).
You also have the right to object to direct marketing at any time. If you subscribe to our newsletter, you can unsubscribe from marketing emails at any time using the one-click unsubscribe link in every newsletter email; withdrawing consent is as easy as giving it.
These rights apply to data we hold as controller. Where we hold data as processor for a customer organisation, address requests to that customer.
To exercise a right, email privacy@lawcel.com with your name, the email address linked to your account, and a description of what you're asking for. We respond within one calendar month, with up to two further months in exceptional circumstances. We may verify your identity before acting. Manifestly unfounded or excessive requests may be declined or charged a reasonable fee.
You also have the right to lodge a complaint with the supervisory authority. The Danish authority is Datatilsynet — Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk, www.datatilsynet.dk. You can also complain to the authority of your country of residence or workplace. We'd appreciate the chance to address your concerns first.
We use strictly necessary cookies for sign-in sessions, CSRF protection, sign-in redirects, and cookie-consent preference storage. On the public marketing site (lawcel.com), we also set Google Analytics cookies, but only after you grant analytics consent. We do not use marketing, advertising, or fingerprinting cookies. See our Cookie Policy for the current list and durations.
The Service is for businesses. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data to us, contact privacy@lawcel.com and we will investigate and delete.
We apply technical and organisational measures appropriate to the risk under Article 32 GDPR, including:
No system is perfectly secure. Use strong credentials at your identity provider, sign out on shared devices, and report suspected vulnerabilities to security@lawcel.com.
We use Anthropic's Claude language model to:
Every AI output is reviewed by a human before any change is applied to a legal document. Risk scores and proposed updates are clearly identified as AI-generated in the interface; you can accept, modify, or reject any of them.
The regulatory-feed recommendation processing operates on an organisation's profile (jurisdiction, data categories, business model), not on individual data subjects, and you can change subscriptions at any time. Article 22 GDPR (decisions based solely on automated processing with legal or similarly significant effects on a person) does not apply, but we apply transparency and override controls anyway.
We share with Anthropic only the content needed for the analysis. Anthropic processes data as our sub-processor under a DPA and does not use it to train its models.
We may update this Policy. We notify registered users by email at least 14 days before a material change takes effect — for example, a new category of data, a new processing purpose, a new recipient, a change in retention, or a change affecting your rights. Minor corrections are reflected by updating the Effective Date.
Continued use after the effective date of an update means you accept the updated Policy; if you don't accept it, stop using the Service and contact us about deletion.
Privacy: privacy@lawcel.com General: hello@lawcel.com Address: Vesterbrogade 52a, 3250 Gilleleje, Denmark
Article 27 GDPR Representative: Ulf Aslak Lai — ulf@lawcel.com
Supervisory authority (Denmark): Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby — dt@datatilsynet.dk — www.datatilsynet.dk