Privacy Terms

Controller

The controller for Lepinguluup is Klapib OÜ, registry code 17554599, address Juhkentali 8, 10132 Tallinn, email info@lepinguluup.ee.

Analysing your contract

To produce the report, Lepinguluup processes your uploaded file, the text read from it, and the description of your situation you add. The purpose of this processing is to provide the contract-check service you requested. The legal basis is the conclusion or performance of a contract.

The uploaded file is processed in memory. Lepinguluup does not write the file or the contract text to disk, to a database, or to logs. The file and the contract text are removed from the Lepinguluup application's memory after the report is produced.

Before uploading, remove data not needed for the analysis, such as a personal ID code, bank account number, or signatures. Do not upload other people's special categories of personal data unless strictly necessary for the analysis.

Use of an AI service

To produce the report, the contract text is sent over an encrypted connection to a cloud-based AI service located in the European Union.

The service provider does not use inputs or outputs to train foundation models and does not share them with a model provider. Lepinguluup uses the contract text only to produce the report and any Action Pack you order; how long the provider retains it depends on the service configuration.

Buying the Action Pack

The Action Pack is not yet available for purchase. This section describes how your data will be handled once Action Pack sales open.

When you buy the Action Pack, Klapib OÜ processes your email address, order reference, payment status, language, and, temporarily, the data from your report needed to generate the Action Pack. The purpose is to fulfil the order, send the purchase confirmation, and deliver the purchased materials. The legal basis is the conclusion and performance of a contract.

Your email address and the data needed to generate the Action Pack are held encrypted until the order is fulfilled and are deleted after successful delivery. Data for an abandoned or failed order is deleted no later than 24 hours after creation.

The Action Pack is sent as a PDF file; after delivery Klapib OÜ does not retain the Action Pack file or the temporary data linked to it.

Payment and accounting data

Payments are intermediated by Montonio. Montonio and your chosen payment service provider process the information needed to make the payment under their own terms and privacy notices. Klapib OÜ does not receive or store your card security details or online-banking login credentials.

For accounting and to meet its statutory obligations, Klapib OÜ retains the transaction date, amount, currency, payment status, and the Montonio and merchant references. This data is retained for seven years from the end of the financial year in which the transaction was recorded in the accounts. The legal basis is Klapib OÜ's compliance with a statutory obligation.

Sending emails

To send the purchase confirmation and the Action Pack PDF, Klapib OÜ uses the SMTP2GO service, provided by Sand Dune Mail Ltd. SMTP2GO processes the email address, message headers, and technical delivery data to provide the service.

SMTP2GO retains email headers and delivery activity data for a limited period in line with its own terms and privacy policy. The processing region depends on the SMTP2GO account configuration.

In the free beta, if you enter an email address at the order step, we use it once to email you the Action Pack and do not store it.

Technical and usage data

If analytics is switched on, Lepinguluup may collect limited event data, such as the language used, file type and size range, analysis duration, the number and topic of findings, and feedback choices. This data does not include contract text, extracted clauses, your situation description, file name, wage, names, employer name, email address, phone number, personal ID code, address, or PDF content.

The purpose is to measure and improve service reliability. The legal basis is Klapib OÜ's legitimate interest in operating and developing the service. Event data is retained for up to 12 months and is then deleted or irreversibly aggregated. You have the right to object to this processing.

Cookies

Lepinguluup uses a language-choice cookie and a private-beta access cookie (only during the beta period). Once Action Pack sales open, a temporary session cookie is also used during a purchase. Where possible, the Secure, HttpOnly, and SameSite attributes are used to protect it.

These cookies are necessary to provide the function or service you have chosen. Lepinguluup does not use advertising cookies, third-party tracking cookies, or session recording.

Recipients of data

Personal data may be processed for the purposes described by:

• Amazon Web Services, as the provider of the cloud-based AI service used to analyse your contract;
• Montonio and your chosen payment service provider, to process payment;
• SMTP2GO, i.e. Sand Dune Mail Ltd, to send the purchase confirmation and the Action Pack PDF;
• hosting and infrastructure providers Klapib OÜ needs to operate the service, to the extent they may have technical access.

Klapib OÜ enters into the required data-processing agreements with its processors. Where data is processed outside the European Economic Area, an applicable adequacy decision or another GDPR-compliant safeguard is used. Information about the specific safeguard is available at info@lepinguluup.ee.

Automated processing

Lepinguluup uses automated analysis to produce the informational report and any Action Pack you order. Lepinguluup does not make decisions about you that produce legal effects or similarly significantly affect you. You decide yourself whether and how to use the report or the Action Pack.

Your rights

To the extent applicable, you have the right to:

• ask for access to your personal data;
• request correction of inaccurate data;
• request deletion of data or restriction of processing;
• object to processing based on legitimate interest;
• receive the data you provided in a machine-readable form and have it transmitted to another controller, where the right to data portability applies;
• withdraw consent, where processing is based on consent;
• lodge a complaint with the Estonian Data Protection Inspectorate, www.aki.ee.

To exercise your rights, write to info@lepinguluup.ee. We respond without undue delay and generally within one month. Some information cannot be deleted before a statutory retention period has passed.

Changes to this notice

This privacy notice states its effective date and version. Material changes are announced on the website before they take effect, where reasonably possible.