Privacy Policy
1. Controller Information
The data controller responsible for the processing of your personal data is:
MindTheGap AI
[Legal entity form TBD — e.g. GmbH / Sàrl]
[Registered address TBD — Switzerland]
[UID / CHE number TBD]
Email: privacy@mtgap.ai
For data protection inquiries contact: privacy@mtgap.ai
2. Data Processing Overview
Silmera is an AI-powered legal intelligence platform. In providing the service, we process the following categories of personal data:
- Research queries — the questions and search parameters you submit to the platform
- Uploaded documents — documents you upload for AI-assisted analysis (voice notes are processed client-side)
- Session history — records of your research sessions, generated outputs, and evidence maps
- Account data — email address, display name, subscription tier, and authentication credentials
- Billing data — payment method details (processed by Stripe; we do not store card data)
- Usage analytics — anonymised interaction events for product improvement
3. Legal Bases (FADP + GDPR)
We rely on the following legal bases under the Swiss Federal Act on Data Protection (nDSG / FADP) and, where applicable, the EU General Data Protection Regulation (GDPR):
3.1 Contract Performance
Art. 31 nDSG Art. 6(1)(b) GDPR
Processing your queries, generating research outputs, managing your account, and delivering the subscribed service. This is the primary basis for all core service functionality.
3.2 Legitimate Interest
Art. 31 nDSG Art. 6(1)(f) GDPR
Fraud prevention, platform security, aggregated and anonymised usage analytics to improve service quality, and abuse detection. Our interests are proportionate to your privacy rights and we have conducted balancing assessments.
3.3 Consent
Art. 6 nDSG Art. 6(1)(a) GDPR
Optional features (such as newsletter communications, optional research personalisation features) where we rely on your freely given, specific, informed, and unambiguous consent. You may withdraw consent at any time without affecting lawfulness of prior processing.
3.4 Legal Obligation
Art. 31 nDSG Art. 6(1)(c) GDPR
Compliance with Swiss and EU legal requirements, including mandatory retention periods for invoicing and accounting records.
4. Data Categories and Purposes
| Category | Data | Purpose | Basis |
|---|---|---|---|
| Account data | Email, name, subscription tier, password hash | Authentication, account management | Contract |
| Research data | Queries, outputs, evidence maps, session logs | Service delivery, session history, workspace | Contract |
| Uploaded documents | Text extracted from user-uploaded files | AI-assisted analysis per user instruction | Contract |
| Voice data | Processed client-side only; raw audio never transmitted to servers | Voice-to-text conversion (local) | Contract |
| Payment data | Subscription status, credit balance; card data held by Stripe | Billing, credit management | Contract / Legal obligation |
| Usage analytics | Anonymised interaction events (no query content) | Product improvement, abuse detection | Legitimate interest |
Voice processing note: Voice notes recorded in Silmera are transcribed entirely within your browser using the Web Speech API. No raw audio data is ever transmitted to or stored on our servers.
5. Data Residency
All personal data is processed and stored within Switzerland. Our primary infrastructure runs on AWS eu-central-2 (Zurich, Switzerland). No personal data leaves Swiss or EEA jurisdiction in the normal course of service delivery.
- Database: AWS Aurora PostgreSQL — eu-central-2 (Zurich)
- Compute: AWS Lambda + ECS Fargate — eu-central-2 (Zurich)
- AI inference: Azure OpenAI — Switzerland North (Zurich region)
- AI inference fallback: AWS Bedrock — eu-central-2 (Zurich)
Switzerland is recognised by the European Commission as providing an adequate level of data protection (Adequacy Decision 2000/518/EC). The nDSG provides equivalent protection to the GDPR for Swiss-resident users.
6. Subprocessors
We engage the following sub-processors who may process personal data on our behalf:
| Subprocessor | Purpose | Location | Safeguard |
|---|---|---|---|
| Microsoft Azure (OpenAI) | AI inference for research generation | Switzerland North | DPA + SCCs |
| AWS (Bedrock) | AI inference fallback | eu-central-2, Zurich | DPA + SCCs |
| Stripe | Payment processing | EU (Ireland) | DPA + SCCs |
| Resend | Transactional email delivery | EU | DPA + SCCs |
We maintain data processing agreements with all subprocessors and conduct periodic reviews of their compliance posture.
7. Attorney-Client Privilege & Confidentiality
We understand that legal professionals use Silmera for sensitive research. Accordingly:
- No human review of query content. Research queries and generated outputs are processed by automated AI systems. No MindTheGap AI employee reads your queries or outputs in the ordinary course of service delivery.
- Stateless processing. AI inference calls are stateless — the AI model does not retain your query content between sessions.
- No training on your data. Your research queries, outputs, and uploaded documents are not used to train or fine-tune AI models.
- Privileged material. If you upload documents covered by attorney-client privilege or legal professional privilege, we process them solely to deliver the service you request. We do not assert any rights over privileged content.
8. Data Retention
| Data type | Retention period |
|---|---|
| Research sessions and outputs | Account lifetime; deleted within 30 days of account deletion |
| Account data | Account lifetime; deleted within 30 days of account deletion |
| Billing records / invoices | 10 years (Swiss accounting law, OR Art. 958f) |
| Usage analytics (anonymised) | 24 months rolling |
| Security logs | 12 months |
You may request early deletion of your research data at any time by contacting privacy@mtgap.ai. Mandatory retention periods for accounting records cannot be shortened.
9. Your Data Subject Rights
Under the nDSG and GDPR, you have the following rights:
- Right of access — obtain a copy of your personal data we hold
- Right to rectification — correct inaccurate personal data
- Right to erasure ("right to be forgotten") — request deletion of personal data, subject to retention obligations
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interest
- Right to withdraw consent — withdraw consent at any time for consent-based processing
- Right to lodge a complaint — with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or a supervisory authority in your EU Member State
To exercise any right, contact: privacy@mtgap.ai. We will respond within 30 days. Identity verification may be required.
10. FDPIC & Supervisory Authority
Where required by Art. 22 nDSG (high-risk data processing), we conduct and document Data Protection Impact Assessments (DPIAs) and consult the Federal Data Protection and Information Commissioner (FDPIC) where indicated.
You have the right to lodge a complaint with the FDPIC at: www.edoeb.admin.ch
EU residents may also contact the supervisory authority in their Member State of habitual residence.
12. Updates to this Policy
We may update this Privacy Policy from time to time. For material changes, we will notify you by email at least 14 days before the change takes effect. The "last updated" date at the top of this page reflects the most recent revision.
Continued use of Silmera after the effective date constitutes acceptance of the updated policy, to the extent permitted by applicable law.
For questions about this policy: privacy@mtgap.ai