Privacy Policy

Template notice: This is a structured starting point. Ladylight GmbH must complete the bracketed details and have this policy reviewed by legal counsel before launch to ensure DSGVO/GDPR compliance.

This Privacy Policy explains how Ladylight GmbH ("we", "us") collects, uses, and protects personal data when you use the Ladylight platform.

1. Controller

The controller responsible for data processing is Ladylight GmbH, [street address], [postal code, city], Germany. Contact: [email]. See our Imprint for full details.

2. Data we process

Account data: name, email address, profile picture, and role.
Usage data: chats, generated documents, requirement answers, and aggregated usage/cost metrics.
Technical data: language preference and standard server logs.

3. Purposes & legal basis

We process this data to provide the service (Art. 6(1)(b) GDPR — performance of a contract) and to operate and secure the platform (Art. 6(1)(f) GDPR — legitimate interests).

4. Processors and third parties

AI providers (e.g. OpenAI): chat content is sent to the AI provider configured by your team to generate responses. Each team supplies its own provider key.
Google Drive: profile images are stored on Google Drive.
Email delivery: transactional emails (invitations, password resets) are sent via our email service provider.

[List each processor with a data-processing agreement (AVV) reference.]

5. Retention

We retain account and usage data for as long as your account is active and as required by law. [Specify retention periods.]

6. Your rights

You have the right to access, rectification, erasure, restriction, data portability, and objection, and the right to lodge a complaint with a supervisory authority. To exercise these rights, contact [email].

7. Changes

We may update this policy. The current version is always available here.

Last updated: [date].