Privacy Notice

1. Data Controller

The data controller responsible for processing your personal data under this Privacy Notice is:

2. Data We Process

We collect and process only the minimal information necessary to provide the service:

• Submitted Scope / SOW Text: The proposal, statement of work, or project scope text that you paste into the analyzer.
• Analysis Results: The structured findings, scores, risk evaluations, and suggested replacement clauses generated for your input.
• Authentication Information (Optional): If you choose to sign in with Google to save analyses, we process your Firebase Authentication User ID (UID), Google account name, Google account email address, and Google profile photo URL.
• Saved Analyses: When signed in, saved analysis titles, original scope text, analysis results, and creation timestamps.
• Abuse Prevention & Security Data: A random, opaque first-party security token stored in a temporary cookie and its server-side cryptographic hash, used solely to enforce rate limits and prevent automated misuse. We do not store raw IP addresses, user-agent fingerprints, or scope text for rate limiting.
• Technical Infrastructure Information: Standard operational connection logs generated by Google Cloud and Firebase infrastructure (such as HTTP status codes, request timestamps, and user agent strings) necessary for routing and site reliability.

We do not collect payment information, postal addresses, phone numbers, or track your activity across third-party websites.

3. Purpose and Legal Basis for Processing

Under the EU General Data Protection Regulation (GDPR), we process your data under the following legal bases:

• Providing AssumptionCheck Services (GDPR Art. 6(1)(b) - Contractual Necessity):Processing submitted scope text to generate risk evaluations, authenticating you with Google, storing and retrieving your saved analyses, and enabling your account data export and deletion. This processing is strictly necessary to deliver the service you request.
• Security, Rate Limiting & Abuse Prevention (GDPR Art. 6(1)(f) - Legitimate Interests):Tracking anonymous request counts via hashed security identifiers to enforce rate limits, detect automated bot abuse, protect the service from denial-of-service disruptions, and manage operational AI inference costs. Our legitimate interest is safeguarding application availability, security, and financial viability for all legitimate users.
• Compliance with Legal Obligations (GDPR Art. 6(1)(c) - Legal Obligation):To the extent we may be required by applicable statutory laws (such as Danish accounting rules or lawful requests from public authorities) to retain minimal operational records.

We do not rely on user consent as the legal basis for core application functions.

4. AI Processing & Google Gemini

To generate the analysis, your submitted scope text is transmitted securely over HTTPS to Google's Gemini API infrastructure (Google Cloud).

5. Third-Party Infrastructure Processors & Recipients

We do not sell, rent, or trade your personal data or submitted scope text to third parties or data brokers. We share data only with trusted cloud service providers acting as data processors under binding data protection agreements:

• Google Ireland Limited / Google LLC:
  • Firebase App Hosting (Cloud Run): Secure container hosting for our Next.js web application.
  • Firebase Authentication: Secure Google OAuth sign-in and session tokens.
  • Cloud Firestore: Encrypted document database for storing saved analyses.
  • Google Gemini API: Large language model inference for scope risk detection.

6. International Data Transfers

While AssumptionCheck is operated from Denmark, Google infrastructure may process data in data centers located outside the European Economic Area (EEA), including in the United States, where necessary for global service provision (such as specialized AI model inference capacity).

Where data is transferred outside the EEA, transfers are governed by Google Cloud's Data Processing Addendum (DPA), which incorporates European Commission Standard Contractual Clauses (SCCs) in compliance with GDPR Article 46. Because exact technical routing and GPU capacity allocation depend on Google Cloud's dynamic infrastructure, specific geographic routing locations cannot be unilaterally guaranteed.

7. Data Retention Policy

8. Browser Storage & Cookies

AssumptionCheck uses only strictly technically necessary browser storage:

• Firebase Authentication Tokens (IndexedDB / LocalStorage): Required to keep you signed in to your Google account across page refreshes when you use the saved analyses feature.
• Security Token Cookie (__ac_sec): An opaque, random first-party cookie used strictly for rate limiting and bot mitigation. It contains no personal information, expires in 24 hours, and is transmitted over HTTPS only.

No Advertising or Behavioral Tracking: We do not use Google Analytics, Firebase Analytics, Meta Pixel, Hotjar, Microsoft Clarity, session replay tools, or any behavioral tracking cookies. Because we only use strictly necessary storage, no cookie consent banner is required under EU/EEA ePrivacy regulations.

9. Automated Decision-Making

AssumptionCheck does not engage in automated decision-making or profiling that produces legal or similarly significant effects under GDPR Article 22.

The service provides automated, advisory evaluations of commercial proposals and suggested wording. It does not approve, reject, or legally bind users or projects. Human users review all results and retain complete autonomy over whether to adopt or reject any suggestion.

10. Your Rights & Lodging Complaints

Under European and Danish data protection laws, you have the right to:

• Access & Inspect: View your stored analyses at any time in the My Analyses area.
• Data Portability: Export all saved analyses and associated account records in JSON format via the “Download my data” button on the Account page.
• Erasure (Right to be Forgotten): Delete any individual saved analysis or permanently delete your entire account and all associated data with immediate effect.
• Inquiries & Requests: Contact us directly at info@mantodea.io regarding any privacy questions or data protection requests.