Privacy notice

Controller

The controller for Lepinguluup is Klapib OÜ, registry code 17554599, address Juhkentali 8, 10132 Tallinn, email info@lepinguluup.ee.

Analysing your contract

To produce the report, Lepinguluup processes your uploaded file, the text read from it, and the description of your situation you add. The purpose of this processing is to provide the contract-check service you requested. The legal basis is the conclusion or performance of a contract.

The uploaded file is processed in memory. Lepinguluup does not write the file or the contract text to disk, to a database, or to logs. The file and the contract text are removed from the Lepinguluup application's memory after the report is produced.

Before uploading, remove data not needed for the analysis, such as a personal ID code, bank account number, or signatures. Do not upload other people's special categories of personal data unless strictly necessary for the analysis.

Use of an AI service

To produce the report, the contract text is sent over an encrypted connection to a cloud-based AI service located in the European Union.

Lepinguluup uses an automated AI service provided through Amazon Bedrock. Under the current configuration, contract text is processed within the European Union. Inputs and outputs are not used to train or improve foundation models, are not shared with the model provider, and are not written to durable storage by the AI service. Lepinguluup uses the contract text only to produce the report. This privacy notice will be updated before any configuration with materially different processing geography, retention or provider-sharing practices is adopted.

Technical and usage data

If analytics is switched on, Lepinguluup may collect limited event data, such as the language used, file type and size range, analysis duration, the number and topic of findings, and feedback choices. This data does not include contract text, extracted clauses, your situation description, file name, wage, names, employer name, email address, phone number, personal ID code, address, or PDF content.

The purpose is to measure and improve service reliability. The legal basis is Klapib OÜ's legitimate interest in operating and developing the service. Event data is retained for up to 12 months and is then deleted or irreversibly aggregated. You have the right to object to this processing. To protect the service against overload and abuse, the request IP address is additionally processed for a short time for rate limiting (a 10-minute window), and the hosting provider's technical logs may contain the IP address and technical request data for a limited period; neither is linked to the content of a report.

Cookies

Lepinguluup uses a language-choice cookie. A temporary session cookie is also used so that the report can be downloaded as a PDF. An access cookie is used only if the service is temporarily open through a private access link alone. Where possible, the Secure, HttpOnly, and SameSite attributes are used to protect them.

These cookies are necessary to provide the function or service you have chosen. Lepinguluup does not use advertising cookies, third-party tracking cookies, or session recording.

Recipients of data

Personal data may be processed for the purposes described by:

• Amazon Web Services, as the provider of the cloud-based AI service used to analyse your contract;
• Render (render.com), application hosting in Frankfurt, and Neon (neon.tech), the analytics database in the AWS Frankfurt region (eu-central-1), to the extent they may have technical access.

Processors are governed by the data-processing terms that apply to them and by the safeguards required under Article 28 of the GDPR. Where data is processed outside the European Economic Area, an applicable adequacy decision or another GDPR-compliant safeguard is used. Information about the specific safeguard is available at info@lepinguluup.ee.

Automated processing

Lepinguluup uses automated analysis to produce the informational report. Lepinguluup does not make decisions about you that produce legal effects or similarly significantly affect you. You decide yourself whether and how to use the report.

Your rights

To the extent applicable, you have the right to:

• ask for access to your personal data;
• request correction of inaccurate data;
• request deletion of data or restriction of processing;
• object to processing based on legitimate interest;
• receive the data you provided in a machine-readable form and have it transmitted to another controller, where the right to data portability applies;
• withdraw consent, where processing is based on consent;
• lodge a complaint with the Estonian Data Protection Inspectorate, www.aki.ee.

To exercise your rights, write to info@lepinguluup.ee. We respond without undue delay and generally within one month. Some information cannot be deleted before a statutory retention period has passed.

Changes to this notice

This privacy notice states its effective date and version. Material changes are announced on the website before they take effect, where reasonably possible.