Privacy Policy
Comprehensive Privacy Policy governing personal data, legal work product, database metadata, and AI processing across Legalpunkt aOS, Datapunkt aOS, and the Agentpunkt Marketplace.
Enterprise AI Confidentiality & Non-Training Guarantee
Agentpunkt Marketplace ("Agentpunkt", "we", "us", or "our") enforces strict confidentiality controls across all our operating environments, including Legalpunkt aOS and Datapunkt aOS. We NEVER use your confidential legal documents, contract files, work product, proprietary database schemas, or agent prompts to train public or foundational artificial intelligence models without your explicit, affirmative, written opt-in consent.
This Privacy Policy ("Policy") sets forth the comprehensive standards and operational procedures governing the collection, processing, storage, disclosure, protection, and international transfer of personal data and confidential technical assets by Agentpunkt Marketplace, operating out of the European Union. This Policy applies to all visitors, account holders, legal operators, corporate subscribers, developers, and enterprise clients accessing our website, applications, APIs, hosted agent runtimes, and specialized AI operating systems: Legalpunkt aOS, Datapunkt aOS, and the Agentpunkt Marketplace (collectively, the "Services").
Please read this Policy carefully to understand our practices regarding your data and how we fulfill our legal obligations under the European Union General Data Protection Regulation (EU GDPR), the United Kingdom General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the EU Artificial Intelligence Act (EU AI Act), and other applicable global data protection regimes.
1. Categories of Data Collected & Processed
We collect and process various categories of data depending on the specific product, operating system tier, or interface you engage with across our platform ecosystem.
1.1 Legalpunkt aOS Data Assets & Legal Work Product
Legalpunkt aOS serves as our specialized AI Agent Operating System designed for legal search, legal project execution, legal contract redlining, legal playbooks, legal skills execution, legal artifact creation, and legal billing tracking. In connection with Legalpunkt aOS, we process:
- Legal Documents & Case File Data: Uploaded contracts, litigation briefs, discovery transcripts, judicial filings, regulatory compliance submissions, corporate governance records, legal search queries, and structured prompt inputs ("Legal Inputs").
- Generated Legal Artifacts & Work Product: Contract redlines, clause recommendations, legal research syntheses, statutory risk analyses, due diligence reports, and automated legal memorandum outputs ("Legal Outputs").
- Legal Practitioner Identifiers: Professional bar affiliation credentials, attorney license numbers, law firm or corporate employer entity names, business addresses, professional role designations (e.g., General Counsel, Managing Partner, Senior Associate, Paralegal), and billable rate structures.
- Legal Audit Trails & Compliance Telemetry: Immutable, timestamped logs documenting legal search queries, playbook execution histories, version control deltas, and time-tracking metrics required for professional bar compliance and enterprise billing audits.
1.2 Datapunkt aOS Technical Metadata & Engineering Data
Datapunkt aOS serves as our specialized AI Agent Operating System designed for enterprise data engineering, metadata extraction, automated code generation, data lineage tracking, data modeling, synthetic data generation, and IT data support. In connection with Datapunkt aOS, we process:
- Database Metadata & Schemas: Relational and non-relational database table schemas, DDL definitions, column data types, foreign key relationships, SQL query scripts, Python data pipeline code, and data lineage mapping definitions. Database connection credentials are end-to-end encrypted and managed in isolated secrets vaults.
- Synthetic Dataset Specifications: Parameters, distribution constraints, schema mappings, and seed rules utilized to synthesize non-personally identifiable artificial testing data.
- Data Pipeline Performance Logs: Query execution durations, data transformation telemetry, error tracebacks, schema drift alerts, and memory utilization logs.
1.3 Agentpunkt Marketplace & Account Data
The Agentpunkt Marketplace allows users, businesses, and developers to discover, license, buy, sell, and hire specialized AI agents. In connection with Marketplace operations, we process:
- Account Identity Data: Full legal name, business email address, account password (hashed using bcrypt), username, avatar, and authentication tokens.
- Financial & Billing Information: Payment card tokens, bank account details for payout processing, transaction receipts, VAT numbers, subscription invoices, and credit usage ledgers. Payments are processed securely via PCI-DSS Level 1 compliant payment gateways (e.g., Stripe).
- Marketplace Interactions & Ratings: Agent reviews, star ratings, merchant developer listings, support tickets, community forum contributions, and communication records between Buyers and Sellers.
1.4 Automated Technical Telemetry & Device Data
When you access or interact with any part of our platform, our servers automatically record standard internet telemetry:
- Network & Device Identifiers: IP address, browser user-agent string, operating system type and version, language settings, network service provider, and general coarse location derived from IP lookup.
- Session Analytics & Cookies: Essential session cookies, security tokens, page response metrics, clickstream patterns, and feature usage analytics collected via first-party diagnostic tools.
2. Lawful Bases & Specific Purposes of Data Processing
Under the EU GDPR and global privacy frameworks, we only process personal data when we have an established legal basis. The table below details our processing purposes and corresponding lawful bases:
| Processing Purpose | Data Categories Processed | Lawful Basis (GDPR Art. 6) |
|---|---|---|
| Operating Legalpunkt aOS legal search, contract analysis, playbook execution, and legal billing tracking | Legal Work Product, Contracts, Attorney Data, Audit Logs | Performance of Contract (Art. 6.1.b) |
| Operating Datapunkt aOS metadata extraction, code generation, data lineage, and synthetic data modeling | Database Schemas, Metadata, SQL/Python Scripts, Logs | Performance of Contract (Art. 6.1.b) |
| Processing marketplace orders, subscriptions, developer payouts, and credit accounting | Financial & Account Data, Transaction Records | Performance of Contract (Art. 6.1.b) |
| Ensuring platform security, threat detection, preventing prompt injection, and audit trail retention | IP Addresses, Telemetry, System Logs, Account Data | Legitimate Interests (Art. 6.1.f) |
| Fulfilling tax reporting, statutory accounting, EU AI Act compliance, and legal process obligations | Invoices, Business Identifiers, Audit Trail Records | Legal Obligation (Art. 6.1.c) |
3. AI Infrastructure, Zero-Data-Retention & Subprocessors
To provide the state-of-the-art intelligence powering Legalpunkt aOS and Datapunkt aOS, we integrate with enterprise artificial intelligence foundation model infrastructure providers. We maintain rigid contractual safeguards with all subprocessors:
Enterprise Zero-Data-Retention (ZDR) Endpoints
All AI model inference requests generated through Legalpunkt aOS and Datapunkt aOS are transmitted strictly over secure TLS 1.3 connections to enterprise model endpoints governed by binding Zero-Data-Retention (ZDR) agreements. Under these agreements, third-party model providers process your input prompts and files in volatile RAM solely for the millisecond duration required to generate the output completion, after which all memory buffers are immediately erased. No customer data is written to disk or retained by third-party model hosts.
Vetted Cloud Infrastructure Subprocessors
Our core database systems, encrypted vaults, and application servers are hosted in top-tier ISO 27001 and SOC 2 Type II certified data centers operated by Amazon Web Services (AWS) and Google Cloud Platform (GCP) located in the European Union. All subprocessors operate under signed Data Processing Agreements (DPAs) containing Standard Contractual Clauses (SCCs).
4. Data Storage, Encryption & Security Architecture
Agentpunkt employs a multi-layered technical and organizational security framework designed to protect high-value legal work product and enterprise data infrastructure against unauthorized access, loss, or exfiltration:
5. Data Retention, Erasure & International Transfers
We retain personal data and legal project records only for as long as necessary to fulfill the purposes outlined in this Policy, or as required to comply with statutory legal, tax, accounting, and professional audit obligations.
- User-Controlled Vault Destruction: Users and law firm administrators can trigger permanent deletion of specific Legalpunkt aOS legal projects, contract files, or Datapunkt aOS metadata schemas at any time. Upon deletion, data is purged from active databases immediately and wiped from encrypted cold backups within 30 days.
- International Transfers: Where data is transferred outside the European Economic Area (EEA) or United Kingdom, we rely on official European Commission Adequacy Decisions, the EU-U.S. Data Privacy Framework, or execute European Commission Standard Contractual Clauses (SCCs) supplemented by Transfer Impact Assessments (TIAs).
6. Your Statutory Rights (GDPR, CCPA/CPRA & Global Privacy Laws)
Depending on your place of residence, you hold comprehensive statutory data privacy rights regarding your personal information:
7. Contact Information & Privacy Office
To exercise any of your statutory data rights, submit privacy inquiries, or request an enterprise Data Processing Agreement (DPA) containing Standard Contractual Clauses for Legalpunkt aOS or Datapunkt aOS, please contact our Compliance Office:
Agentpunkt Data Protection & Compliance Office
Official Contact Email: info@agentpunkt.com