Prawai privacy notice

1. Controller and roles

AMRAS sp. z o.o., ul. Starowiejska 38B, 55-080 Smolec, Poland; KRS 0001192617, NIP 8961656734; share capital PLN 5,000. Registry court: Sąd Rejonowy dla Wrocławia-Fabrycznej we Wrocławiu, IX Wydział Gospodarczy Krajowego Rejestru Sądowego.

For privacy matters, contact [email protected] with “Prawai” in the subject or write to the registered address. AMRAS controls account, contact, security and its own billing data. It processes case material on a client controller's instructions under the Data processing terms where that relationship applies. Roles depend on the actual purpose, not an account label.

2. Information and sources

We receive registration and profile details, email, workspace name, roles, privacy choices, messages, files, drafts, revision history and necessary billing details. A workspace owner may invite a member. Authorized users supply case material relating to clients, parties, representatives, witnesses and others. Legal sources come from the separate MaxiLex library and its identified sources.

Necessary technical information includes IP address, time, session and operation identifiers, request outcomes and usage. Passwords are hashed; files and sensitive-value mappings are encrypted. Pseudonymization is reversible and does not make the information anonymous. Originals and restoration mappings stay within Prawai infrastructure.

3. Purposes and legal bases

Individual account and requested functionality rely on contract performance (GDPR Article 6(1)(b)). Business representative contact, abuse prevention, security and claims protection rely on proportionate legitimate interests (f). Statutory accounting and rights handling may rely on legal obligations (c). Separate optional purposes requiring consent rely on (a). Consent does not replace contractual or transparency duties.

Accepting terms forms the agreement; privacy acknowledgement records receipt of information. Optional AI authorization enables a chosen function. It does not itself authorize processing other people's health or conviction data. Those require the applicable Article 9 or 10 conditions and confidentiality requirements. Registration does not require marketing consent.

4. Providers and transfers

Microsoft Azure provides hosting and storage. Cloudflare protects and proxies website traffic. Resend (Plus Five Five, Inc.) delivers account emails, receiving recipients, message contents and delivery information; its sending region is configured as Ireland. This does not guarantee all ancillary provider access stays within the EEA.

After AI is separately enabled, the selected available OpenAI or Anthropic model receives pseudonymized text, relevant conversation context and tool results. Original files and restoration dictionaries are not sent to those models. Not every provider is used for every function. Staff access is limited to their task; staff or owner status alone does not authorize general private-content access.

Provider operations may involve countries outside the EEA, including the USA. Transfers require an applicable basis, such as an adequacy decision or standard contractual clauses and necessary safeguards. You may request information about recipients and copies of applicable safeguards from AMRAS. We do not represent that Prawai has a special zero-retention agreement with AI providers; see the AI notice.

5. Retention and deletion

Active accounts and materials are kept as needed to provide chosen functions. On termination or deletion requests, we determine what to delete, return or retain for a legal obligation, others' rights or a specific claim. Billing records and minimal contract/choice evidence may require longer retention, not the entire private case file.

Security logs are retained as needed to protect the service and investigate events; support records for handling and justified claims protection. Backups are not used for ordinary access after deletion. Fulfilment determines the scope and timing, including remaining copies and necessary exceptions. We do not promise immediate deletion of every copy or a complete automatic export merely upon clicking a button. Account requests have a status and are separately fulfilled.

6. Your rights

You may request access, correction, deletion, restriction and, where applicable, portability. You may object to legitimate-interest processing and withdraw consent without affecting previous lawful processing. Submit requests in My account or to [email protected]. Identity checks are proportionate; we do not routinely require ID copies.

We respond without undue delay, normally within one month, explaining any legally permitted extension. Any restriction requires a reason. You may complain to the Polish data protection authority (Prezes UODO) or seek a judicial remedy. For entrusted data, we assist the responsible controller.

7. Choice, automation and changes

Providing information is voluntary, but without necessary details we cannot provide the chosen function. Declining AI preserves account and rights access but prevents generation requiring an external model. AI produces suggestions for human assessment; Prawai does not automatically make legal decisions for you.

Browser storage is described in the Cookies notice. Material changes are communicated appropriately; a new version does not overwrite choice history or automatically enable new purposes.