1. Controller and contact

The controller is the operator of Legalize, established in Spain and identified in the legal notice. Privacy contact: privacy@legalize.dev.

2. Data, purposes and legal bases

• Account and service: email, optional country and use case, authentication identifiers, organisation, hashed API keys, usage, preferences, invitations, feedback and webhook configuration. These are used to create and operate the account, authenticate, provide API/MCP, support and take pre-contractual steps or perform the B2B contract.
• Security and operation: temporary IP hashes, API route and method, parameter names —never values—, status, latency, MCP tool and aggregate outcome. Legitimate interests in preventing abuse, diagnosing faults and protecting the service. Legalize does not retain search terms.
• Signup origin: when you create an account we retain one category for how it began: following links from a law (only the corpus country), connecting an AI assistant (only the assistant's name, such as Claude or ChatGPT), or the website. We also keep the dates of first API/MCP use. Legitimate interests in evaluating which channels bring service users. We do not store the law consulted or a browsing history, add analytics cookies, or share acquisition reports outside the service; reports are aggregated. These data are deleted with the account.
• Messages: authentication, security and service messages are transactional. Marketing is sent only after separate, affirmative and revocable consent; only the date, notice version and source are retained as evidence. There is no profiling or automated decision-making with legal effects.

Required fields are needed for the requested function; all others are optional. Data comes from you, an organisation that invites you or, if selected, the social/MCP identity provider.

3. Providers and transfers

• Google Cloud hosts the application, database and backups in the EU under its data processing terms.
• Resend delivers email and processes metadata and content in the US; its DPA includes the applicable contractual safeguards.
• Google and GitHub act as identity providers only when selected. Legalize asks Google only for openid and email, and GitHub for read-only access to the verified email.
• Stytch, a Twilio company, handles MCP connector identities, sessions and grants and may process those data in the US. On an erasure request we try to revoke and delete those objects before the local account; if the provider does not confirm it, local deletion stops and can be completed through privacy@legalize.dev.
• jsDelivr serves the API reference viewer and Stytch client on those pages and receives normal web-request metadata.

We do not sell personal data. Disclosure is limited to necessary processors, legal obligations, or legal claims. Where a provider processes data outside the EEA, the safeguards in its applicable processing terms are used.

4. Retention

• Account and configuration: while active, then deleted after associated Stytch identities, sessions and grants are revoked or deleted automatically or through a verified provider process.
• Signup/login attempts: 24 hours. Magic links: until used or expired. Invitations: until accepted or expired after 7 days.
• API request logs: 7 days (Free) or 30 days (paid). API events and aggregate MCP usage: 90 days. Parameter values and searches are not stored.
• Minimal email delivery log and webhook deliveries: 30 days. Webhook events: 90 days. Minimal audit events: 180 days.
• Monthly usage: 13 months. Campaign drafts: 90 days; sent campaigns: one year.
• Ordinary Google Cloud logs: 30 days; Google-required audit logs: 400 days. Daily database backups and point-in-time recovery: 7 days.
• Resend publishes 30 days for email data on applicable plans, 7 days for backups and up to 90 days to remove remaining customer data after account termination. Stytch publishes a default 30-day event-log window.

Application cleanup runs daily. Data is kept longer only for a specific legal obligation or claim.

5. Strictly necessary cookies and storage

We do not use Google Analytics, advertising or analytics cookies, so no consent banner is shown. We use only:

• __session: authentication, language and OAuth state; 7 days for an authenticated session, up to one year for language, and 10 minutes for an OAuth flow.
• legalize_auth: an identity-free UI sign-in hint; 7 days.
• localStorage: visited country, code-example language and law index state; retained until cleared in the browser.
• Stytch may use strictly necessary session storage during MCP authorisation.

You can clear this storage in browser settings; doing so signs you out or removes preferences.

6. Rights and complaints

Request access, correction, deletion, restriction, portability or objection, or withdraw consent without affecting earlier processing, at privacy@legalize.dev. We normally respond within one month and may request proportionate identity verification.

You may also complain to the Spanish Data Protection Agency (AEPD).

7. Legislation served by Legalize

Legalize transforms and serves legislation published by official sources, but is not an official source. Coverage and reuse rights depend on each source and jurisdiction; always check the official gazette or portal linked from the text.

Customers pay for the technical layer —transformation, search, history, API, MCP, webhooks and capacity— not to own legislative texts.