Privacy Policy

VAARIO is a legal technology platform that allows law firms and legal professionals to upload, compare, and analyse contract documents with AI assistance.

We are established in Estonia, so our lead supervisory authority is the Estonian Data Protection Inspectorate — Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn. We are subject to the GDPR and to the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).

Data Protection Officer: none appointed. We have assessed that we are not currently required to designate one under Art. 37(1) — we do not carry out large-scale systematic monitoring, and we do not process special-category data as a core activity (see section 5). We keep this under review as our client base grows. Data protection enquiries go to the privacy contact above.

We respond to all data protection enquiries within 30 days.

This distinction determines who you should approach about your data, so we state it plainly rather than leaving it to the small print.

For document content we act only on the instructions of the account holder. We do not decide what is uploaded, we do not use document content for our own purposes, and we do not use it to train any AI model — ours or anyone else's.

What this means in practice: if you are a client of a law firm that uses VAARIO and you want to know what is held about you, or want it deleted, the firm is your point of contact — it is the controller. We assist the firm in answering you, as our agreement with them requires. If you are unsure who holds your data, write to us anyway and we will point you in the right direction.

Account holders (registered users)

AI usage records contain no document content — only counts and labels. They are kept for 13 months (see section 7).

Guest reviewers (share-link visitors)

Guest data is tied to the comparison it was entered on and is deleted when that comparison or its parent contract is deleted.

Technical / infrastructure data

We do not use advertising cookies, analytics trackers, fingerprinting, or any third-party marketing technology. The only cookie we set is an essential authentication cookie. Document content is never written to our logs.

When you request an AI analysis, chat response, or suggested edit, the relevant part of your document text is sent for processing to Amazon Web Services (AWS), which hosts the Claude language model on Amazon Bedrock.

The processing stays inside the European Union. We use a Bedrock EU inference profile that can route a request only to data centres in Ireland, Germany, Sweden, France, Italy or Spain — all EU member states. Our access permissions deny requests to every other region, so a request cannot be served from outside the EU even if the provider adds regions later.

We send only what the feature needs. Depending on the feature, that is the detected changes, the clauses relevant to your question, or the paragraphs being edited — each under a size limit set per feature. We want to be accurate about what this does and does not mean: for a short contract, the paragraphs an editing feature needs may amount to most of the document. What we can tell you is that every feature has an enforced ceiling, that nothing is sent that is not part of what you asked for, and that we never send a document you have not asked us to work on.

AWS acts as our processor under the AWS Data Processing Addendum. Because the processing takes place entirely within the EU, no international transfer occurs on this leg. See section 8 for the limits of that statement.

Your content is not used to train models — not ours, not AWS's, and not any third party's. The provider retains nothing on our behalf after a request completes, and we have provider-side request logging switched off in all six EU regions.

AI does not decide anything about you

No decision with legal or similarly significant effect is made automatically (Art. 22 GDPR). Everything the AI produces is a suggestion:

• Suggested edits are stored as proposals. A person must approve or reject each one. Nothing an AI proposes is ever applied to a document on its own — there is no path in the software that does that.
• Impact ratings order and colour a reviewer's queue. They decide nothing.
• The decision that matters — whether to sign, amend, or refuse a contract — is made by a lawyer.

You are told when you are dealing with AI

AI features are labelled as such in the interface, and AI-proposed edits carry a marker asking a person to review before approving. This meets our transparency duty under Art. 50(1) of the EU AI Act, which has applied since 2 August 2026.

On accuracy. AI output can be wrong, incomplete, or confidently mistaken. It is a drafting and review aid, not legal advice, and it does not replace a lawyer reading the document. Where our AI analysis is degraded or partial, we aim to say so in the interface rather than present a partial result as a complete one.

Contracts name people: counterparties, signatories, directors, employees, beneficiaries. Those people are data subjects too, and most will never have heard of VAARIO. We would rather state our position than leave it unsaid.

For that data we are a processor, not a controller (section 2). The account holder — usually a law firm — decides to upload the document and is the controller. Its lawful basis is the same one that lets it review the contract at all: typically its own or its client's legitimate interests, or the establishment, exercise or defence of legal claims.

We do not contact people named in uploaded documents to tell them we hold their data. Under Art. 14(5) GDPR that notification is not required where it would involve disproportionate effort, or where the data is subject to a professional secrecy obligation. Both apply: the documents are encrypted and we do not read them, so identifying and contacting the people named inside would mean examining privileged material we otherwise never look at — a greater intrusion than the notice would cure. And the material is covered by legal professional privilege in the hands of the firm that uploaded it.

If you believe your personal data is in a document held on our platform, write to privacy@vaario.app. We will not search documents on request — we cannot read them, and doing so would breach the privilege attached to them — but we will identify the responsible account holder where we lawfully can, and pass your request to them as the controller.

Special categories of data

We never ask for special-category data (Art. 9) or criminal-offence data (Art. 10). But contracts contain what contracts contain: a settlement may recite a medical condition, an employment contract may reveal union membership, a dispute file may recite allegations.

We cannot detect this and we do not try to. Instead, every document is treated as if it were sensitive: all extracted text is encrypted at rest, access is restricted to the owning account, content is never logged, and every AI request is size-limited. Where a lawful basis is needed for this material it belongs to the uploading firm — typically Art. 9(2)(f), the establishment, exercise or defence of legal claims.

The self-service tools above cover the data we hold as controller (section 2). For data inside uploaded documents, see section 5 — the account holder is the controller and we will route your request.

We respond within 30 days. Complex requests may take up to 3 months, and we will tell you if that applies. Exercising these rights is free; we will only charge for manifestly unfounded or excessive repeat requests, and we will say so first.

Complaints. You may lodge a complaint with our lead supervisory authority, Andmekaitse Inspektsioon (Tatari 39, 10134 Tallinn, Estonia — info@aki.ee). You may also complain to the supervisory authority where you live or work, wherever that is in the EU/EEA (Art. 77) — you do not have to bring a complaint in Estonia. A list of all EU authorities is published by the European Data Protection Board.

We do not delete your documents on a timer while you use your account. A matter can run for years, so your documents stay until you remove them or close your account. That is a deliberate choice, and it means the decision about how long privileged material lives on our platform is yours. If you want a shorter retention period applied to your account, contact us.

An account that is not used is deleted. If nobody signs in to or uses your account for 30 days, we delete the account and everything in it, exactly as if you had deleted it yourself. We email the account's address 7 days before that date, and signing in at any time before it keeps the account. We do this so that privileged material does not stay on our platform after its owner has stopped using it.

When you delete your account via Settings → Delete Account, we permanently and immediately delete your email address, all contracts and document versions, all comparisons and AI outputs, all comments and review states, all chat sessions, all your review guidelines (uploaded guideline files and written rules), your AI usage records, all audit log entries, and the associated storage files. This is irreversible.

Each sub-processor is bound by a Data Processing Agreement, and where data leaves the EU/EEA we rely on Standard Contractual Clauses. We will give at least 30 days' notice before adding or replacing a sub-processor.

We do not sell personal data to anyone.

Access by non-EU authorities

We want to be direct about a limit of EU-only processing, because it matters for attorney–client material.

Several of our sub-processors — including AWS, which processes your document excerpts for AI features — are subsidiaries of US-headquartered companies. Keeping your data in EU data centres means it is not transferred outside the EU and we hold it under EU law. It does not by itself put the data beyond the reach of US legal process: under laws such as the US CLOUD Act, a US-headquartered provider may in principle be served with an order for data it controls, wherever that data is stored.

We cannot make that risk zero while using any provider with a US parent. What we do instead:

• We keep the exposure small. AI requests carry only the excerpt a feature needs. Your documents themselves live encrypted with our EU database and storage provider, not with the AI provider, and the AI provider stores nothing on our behalf.
• We rely on our providers' published commitments to challenge overbroad or unlawful government requests, to redirect them to the customer, and to notify the affected customer unless legally prohibited.
• We will tell you if we receive a government access request affecting your data, unless we are legally barred — in which case we will disclose whatever we lawfully can.

If your engagement cannot tolerate this residual risk, contact us before uploading material so we can discuss whether the platform is appropriate for that matter.

Technical and organisational measures under Art. 32:

• Encryption at rest: extracted document text is encrypted with Fernet (AES-128-CBC) at the application layer, independent of database-level encryption. The key is held only in the backend environment, never in the database.
• Encryption in transit: all connections use TLS 1.2 or higher.
• Access control: database row-level security ensures an account can reach only its own data. The service-role key never reaches the browser.
• Document access: files are reachable only through signed URLs with a maximum 1-hour expiry.
• Secrets management: API keys and service credentials live only in server-side environment variables; none are exposed to the browser or included in client-side code.
• Content is never logged: audit and application logs record actions, timestamps and record IDs — never document content.
• AI processing kept in the EU: AI requests are restricted at the access-control layer to EU data centres, so a request cannot be served from outside the EU.
• Data minimisation in AI requests: each AI feature sends only what it needs, under a per-feature size limit, rather than the whole document.
• Human review of AI suggestions: AI-proposed edits are never applied automatically. Each is presented for a person to approve or discard.
• Rate limiting on uploads, comparisons, AI calls and sharing endpoints.
• Access is restricted to approved accounts during our current closed availability.

No system is perfectly secure, and we do not claim otherwise. These measures are reviewed whenever we change how documents are processed.

If a breach occurs that is likely to result in a risk to people's rights and freedoms, we will notify Andmekaitse Inspektsioon within 72 hours of becoming aware of it (Art. 33). Where the breach is likely to result in a high risk, we will also notify the people affected without undue delay (Art. 34). Where we act as processor (section 2), we will notify the controlling account holder without undue delay so it can meet its own obligations.

To report a suspected breach to us: privacy@vaario.app, subject line "DATA BREACH".

VAARIO is a professional legal platform and is not directed at children. We do not knowingly collect data from individuals under 18. If you believe a minor has submitted data to us, contact us and we will delete it.

We will notify registered users of material changes by email at least 14 days before they take effect. The "Last updated" date at the top reflects the most recent revision. Continued use after the effective date constitutes acceptance of the updated policy.

For any question, rights request, or complaint: