How this site handles information
Last updated: 26 July 2026 · Mode: public-demo
This notice describes the safeguards built into this deployment template. A public operator must review it against their actual hosting, subprocessors and legal obligations before inviting uploads. It is not a certification of GDPR compliance.
Who is responsible
This copy is operated by John Mangan. Privacy questions and rights requests can be sent to [email protected].
What the service processes
- Agreement files you choose to upload, including text and metadata contained in them.
- A random, first-party session identifier stored in a strictly necessary cookie.
- Your network address temporarily in memory for abuse and rate-limit controls. AgreementAtlas does not write it into an application analytics database.
- Generated clauses, legal rules, graph relationships, model answers and cited evidence.
Agreements may themselves contain names, signatures, contact details or other personal data. Do not upload material unless you are authorised and have a lawful basis to process it.
Purpose and model processing
The information is used only to provide the requested document conversion, graph extraction, retrieval, local model enrichment and question-answering service; protect the service from abuse; and delete the session. This release sends model prompts only to the operator-controlled LM Studio endpoint. It does not send agreement content to Kimi, OpenAI or another cloud model.
Retention and deletion
Your temporary session receives an absolute 6-hour expiry when you first visit the site. Uploaded originals and all generated data—including extracted text, graphs, model output and chat history—are stored together in that isolated session and automatically deleted when it expires. The upload area shows the exact deletion time. “Delete my documents” requests immediate removal. The application does not create backups of session workspaces; an operator must disclose separately if their infrastructure does.
Recipients and transfers
In local mode, processing remains on the machine running AgreementAtlas and LM Studio. A public deployment may also involve its hosting or network-security provider, which the operator must identify here. Cloud inference must remain disabled until the operator has documented a suitable processor agreement, retention position and any required international-transfer safeguard.
Cookies
AgreementAtlas uses one first-party, HTTP-only session cookie to keep each visitor’s workspace separate. It expires with the session and is not used for advertising or analytics. The service cannot safely provide isolated uploads without it.
Your choices and rights
You can avoid processing by not uploading, and erase the session with the deletion control. Depending on applicable law, you may also have rights of access, rectification, restriction, objection or complaint to a supervisory authority. Contact the operator above. UK users may complain to the Information Commissioner’s Office at ico.org.uk.
Security and incidents
The template uses isolated random workspaces, upload quotas, type checks, restrictive browser headers, rate limits, short retention and content-safe rendering. No internet service is risk-free. Do not put confidential, privileged, security-sensitive or special-category personal data into a demonstration deployment. Operators must maintain an incident-response and breach-assessment process.