Your Personal Data

Information We Collect

When you use our website and services, we collect information which may include your name, email address, and profile information associated with your account. When you send us an enquiry or join one of our lists, we keep with it the campaign labels and any advertising click code that were part of the link by which you have reached our site, and the page through which you have entered it, so that we can optimise our traffic sources, press releases or campaigns. We keep this in our own records only and do not share it with any advertising platform. We use only the first-party cookies listed in our Cookie Policy, which keep the website working, and no advertising or tracking cookies.

We Do Not Sell or Share Your Information

RINDOGATAN LLC does not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising purposes. We use your data only for the purposes described in this policy.

Purposes of the Processing

We are not fond of polluting our systems with your personal information, so we only collect it for very specific purposes:

• •If you open an account on the hosted TODO.LAW platform you will need an email address to both access the platform (thus avoiding bots and spammers) and remember the information you choose to store in it, or the paid features you subscribe to. This can be provided through the "Magic Link" or "Login with Google" options.
• •If you decide to download a "Skills" package for your own local deployment, the licensing platform will need your name and email address for proper allocation and future reference.
• •If you sign up for a waitlist (e.g., to join a course on how to deploy TODO.LAW repositories on your own hardware) we will need your email address, nothing else.
• •Online payments are processed by Stripe. It is them who keep your card details, etc. but we will not get ahead of ourselves with the role that each party plays…
• •We use Sealmetrics, an analytics service that sets no cookies, to count visits to our pages. Your browser loads its script from Sealmetrics' servers, which receive your IP address with that request; we use the results only as aggregated figures.
• •If you send a request to exercise your data protection rights through a privacy request form that one of our customers publishes with DPO Central, we handle it only on that customer's behalf, as its processor. The customer decides what happens to your request and answers it, and the customer's own privacy notice applies, not this one. To exercise your rights over that request, contact the customer.
• •If you join the TODO.LAW updates list, we keep your email address and the date on which you confirmed it or asked to be removed, so that we can send you occasional updates about the TODO.LAW offering. We keep your address until you leave the list. If we email you to ask whether you want to stay on the list and you do not confirm, we delete your address within 30 days of that email. Every message carries a link to leave the list, and you can also write to us at privacy@rindogatan.com. The messages are sent through Resend and the list is kept in Upstash (both listed below).
• •Press and investor contacts. When we write to journalists, editors or investors about TODO.LAW, we use the professional name, role, organisation and e-mail address that they or their organisation publish, and we keep a record of our messages and of any replies, so that we can manage that contact. We rely on our legitimate interest in presenting our business to the press and to investors. We keep these records for up to 24 months after our last exchange. You can ask us to stop at any time, by replying to our message or by writing to privacy@rindogatan.com; we then keep only your address on a list of people we must not contact again. The messages are sent through Google Workspace (Gmail) or Resend, and the records are kept in Upstash and in our own files (all listed below).

Lawful Bases for Processing

We process your personal data under the following lawful bases as defined by the GDPR:

• •Legitimate Interest: We rely on this basis to request your email address when you join a Waitlist, and to contact journalists and investors as described above. We also rely on legitimate interest to run a statistical analysis of traffic to our various pages. That analysis sets no cookies, and we use it only as aggregated figures.
• •Contractual Necessity: We rely on this basis when you join our platform (providing your email address) or subscribe to one of our add-on, paid features.

Data Processors and Transfers to Third Parties

We use Stripe to manage payments on TODO.LAW. They are both our data processor (insofar as they collect money on our behalf) and an independent data controller (as it relates to their own compliance with applicable laws) (location: United States and other countries; safeguard: Data Privacy Framework and standard contractual clauses).

The TODO.LAW website and the hosted products that link to this policy (DPO Central, AI Sentinel, VendorWatch, Clausemaster, Seneca and Gavel) rely on these providers. Each entry gives where the provider processes the data and the safeguard for transfers outside the EU and the UK:

• •Vercel is our hosting platform: for DPO Central, AI Sentinel and VendorWatch in Frankfurt (EU); for this website and its forms, Clausemaster and Gavel in the United States (Washington, D.C.); for Seneca in the United States (San Francisco) (safeguard: Data Privacy Framework and standard contractual clauses) (Privacy Policy)
• •Neon is our cloud database: in Frankfurt (EU) for DPO Central, AI Sentinel and VendorWatch (safeguard: Data Privacy Framework and standard contractual clauses) (Privacy Policy)
• •Resend is the email service that sends our sign-in links, account and licence messages, the TODO.LAW updates messages and some of our messages to investors (location: United States; safeguard: Data Privacy Framework and standard contractual clauses) (Privacy Policy)
• •Google LLC: if you choose "Login with Google", Google receives your sign-in as an independent controller, under its own privacy policy; it is not our processor (Privacy Policy)
• •Upstash stores licence and purchase records, sign-in tokens, what you send through our contact, waitlist, pilot and contract-signing forms, the TODO.LAW updates list, and our records of contacts with investors (location: Frankfurt (EU), with a read copy in London (UK); safeguard: Data Privacy Framework, otherwise standard contractual clauses)
• •Google Fonts serves the typefaces this website uses; your browser requests them from Google's servers, which receive your IP address (location: United States) (Privacy Policy)
• •Sealmetrics counts visits to our pages without cookies, as described above (location: Ireland and France, EU; the data does not leave the EU, as the provider states) (Trust page · Public attestation)
• •Anthropic, PBC provides the AI models behind Gavel's dispute resolution and behind Clausemaster for accounts that use our platform key; it receives the text sent for analysis (location: United States; safeguard: standard contractual clauses, as the provider's documents state) (Privacy Policy)
• •OpenRouter, Inc. is our AI gateway: when AI features are switched on in DPO Central or AI Sentinel, it routes the details of the record being drafted to the model chosen (location: United States; safeguard: standard contractual clauses, as the provider's documents state) (Privacy Policy)
• •Cal.com, Inc. handles the booking of calls on our "Talk to us" page: when you click to open the booking calendar on that page, your browser loads it from Cal.com, which receives your IP address; if you book a call it receives your name, e-mail address and what you write in the booking form (location: United States; safeguard: Data Privacy Framework, as the provider states) (Privacy Policy)
• •Vimeo.com, Inc. plays the videos on Gavel's home page; when a video player loads, Vimeo receives your IP address and information about your browser (location: United States; safeguard: Data Privacy Framework, as the provider states) (Privacy Policy)
• •Google Workspace (Gmail) is the e-mail service we use to write to journalists and investors, as described under "Press and investor contacts" (location: United States and other countries; safeguard: standard contractual clauses or the transfer solution Google publishes) (Privacy Policy)
• •GitHub, Inc. hosts our source code, which has contained some of the professional contact details of journalists and investors described under "Press and investor contacts" (location: United States; safeguard: Data Privacy Framework and standard contractual clauses) (Privacy Policy)
• •Free Law Project (CourtListener) receives the search terms that Seneca sends to its public case-law service when you run a search; they may include names you type (location: United States; it acts under its own terms, not as our processor)

Your California Privacy Rights

As a California resident, you have the following rights:

• •Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• •Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• •Right to Correct: You may request correction of inaccurate personal information.
• •Right to Opt-Out: While we do not sell or share your information, you have the right to opt-out of such practices.
• •Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.