Privacy Policy

The controller responsible for processing your personal data under the EU General Data Protection Regulation ("GDPR") is:

Devoreo UG (haftungsbeschränkt)
Kölner Straße 12, 60327, Frankfurt am Main, Hesse, Germany
Commercial Register: Amtsgericht Frankfurt am Main
Registration Number: HRB 142035
Managing Director: Muhammad Abdullah Nagori
Email: privacy@statuly.com
Website: https://statuly.com

Statuly is an AI-powered platform that provides general legal information based on user questions, uploaded documents, and retrieved legal sources.

Statuly does not provide legal representation and is not a substitute for advice from a qualified lawyer. Information generated by artificial intelligence may be incomplete, outdated, or inaccurate. Users should consult a qualified legal professional before making decisions with legal consequences.

Depending on how you use Statuly, we may process the following categories of personal data.

3.1 Account and authentication data

When you create or manage an account, we may process:

• Email address
• Display name
• Password in cryptographically hashed form
• Account creation and modification dates
• Authentication and session information
• One-time verification codes and their expiry status
• Login-related security information

Passwords and verification codes are not stored in readable plain text.

3.2 Google sign-in

If you choose "Sign in with Google," Google may provide us with:

• Your name
• Email address
• Google account identifier
• Profile information you have authorised Google to share

Using Google sign-in is optional. You may create and use a Statuly account through the alternative registration method, where available.

Google separately processes personal data in connection with its own services. More information is available in Google's privacy policy.

3.3 Chat and legal-query data

When you use Statuly, we process:

• Questions and instructions submitted to the service
• Generated answers
• Retrieved legal passages and citations
• Recent chat history provided to the AI model to maintain context
• Chat titles, timestamps, and session identifiers
• Feedback submitted about generated answers

Your questions may contain personal data about you or other people. Please avoid entering names, addresses, identification numbers, financial details, medical information, criminal allegations, confidential client information, or other sensitive information unless it is strictly necessary and you are legally permitted to provide it.

3.4 Usage and subscription data

We may process:

• Subscription plan and status
• Monthly prompt or usage count
• Feature usage
• Account limits
• Payment status
• Technical error and security logs
• IP address, browser type, device information, and timestamps where required for security and operation

3.5 Billing data

If you purchase a subscription, Stripe may process:

• Name and email address
• Billing address
• Payment method and transaction information
• Tax-related information
• Stripe customer, payment, and subscription identifiers

Devoreo does not directly receive or store complete card numbers or card-security codes. These are processed by Stripe.

We process personal data for the following purposes:

Where processing is based on legitimate interests, you may object for reasons arising from your particular situation.

Google sign-in is optional, but selecting it does not automatically mean that consent is the appropriate GDPR legal basis. We primarily process the authentication data needed to provide the requested login service under Article 6(1)(b) GDPR.

Legal questions and uploaded documents may reveal special categories of personal data under Article 9 GDPR, including information concerning health, religious beliefs, political opinions, trade-union membership, ethnicity, sexual orientation, or biometric and genetic information.

Statuly is not intended for the routine processing of such information. Users should remove or anonymise sensitive and third-party information before submitting content.

If Statuly intends to permit special-category data, Devoreo must establish an applicable exception under Article 9(2) GDPR and implement appropriate safeguards before that processing takes place. A general acceptance of this Privacy Policy is not, by itself, valid explicit consent for processing all sensitive data.

To generate an answer, Statuly may send the following information to an external AI provider:

• Your question
• Relevant passages retrieved from legal sources or uploaded documents
• Limited recent chat history required to understand the context
• Technical instructions needed to generate the response

Statuly's answers are generated automatically. However, Statuly does not make legally binding decisions about users and does not carry out automated decision-making that produces legal or similarly significant effects within the meaning of Article 22 GDPR.

User content will not be used to train Devoreo's or a third party's general-purpose AI models unless this is clearly disclosed and a valid legal basis has been established.

Devoreo uses service providers to operate Statuly. They may process personal data only to the extent required for their respective services.

Devoreo must enter into data-processing agreements under Article 28 GDPR with processors where legally required.

Some providers, such as Stripe or Google, may also act as independent controllers for certain processing activities they determine themselves. Their respective privacy policies apply to those activities.

Personal data may also be disclosed where required by law, a court order, or a competent public authority.

Some service providers may process personal data outside Germany or the European Economic Area.

Where personal data is transferred to a country without an EU adequacy decision, Devoreo will use an appropriate transfer mechanism under Articles 44–49 GDPR, such as the European Commission's Standard Contractual Clauses, and will implement supplementary safeguards where required.

Before this policy is published, Devoreo must verify and document for each provider:

• The actual processing locations
• Whether an adequacy decision applies
• The applicable Standard Contractual Clauses
• Whether a transfer-impact assessment is required
• Any supplementary technical or contractual safeguards

You may contact privacy@statuly.com for further information about applicable transfer safeguards.

We store personal data only for as long as necessary for the relevant purpose or as required by law.

When an account is deleted, active account data, chat sessions, and personally uploaded documents will be deleted or anonymised without undue delay. Residual copies may remain in encrypted backups for up to 30 days and will be removed through the normal backup-rotation process.

Information may be retained for longer where necessary to establish, exercise, or defend legal claims or comply with a statutory obligation.

Statuly does not currently use analytics or advertising cookies.

Statuly uses browser local storage or similar technologies where technically necessary to:

• Maintain an authenticated session
• Protect account security
• Remember essential service settings
• Provide features explicitly requested by the user

Where storage or access is strictly necessary to provide a service requested by the user, it may be used without consent under Section 25(2) TDDDG. If Statuly later introduces non-essential analytics, advertising, or tracking technologies, prior consent will be requested where required.

Certain information, such as an email address and authentication credentials, is required to create an account and provide Statuly's services. Without this information, we may not be able to create your account or process your requests.

Submitting legal questions, uploading documents, and using Google sign-in are voluntary. However, Statuly cannot analyse content that you do not provide.

Devoreo implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction.

These measures include, where appropriate:

• Encryption of data in transit using TLS
• Cryptographic password hashing
• Signed and time-limited authentication tokens
• Access controls and restricted administrative access
• Logging and monitoring of security-related events
• Regular updates and vulnerability management
• Backup and recovery procedures
• Data-minimisation measures

No online system can guarantee absolute security. Users are responsible for protecting their login credentials and should notify us if they suspect unauthorized use of their account.

Subject to the applicable legal requirements, you have the right to:

• Request access to your personal data under Article 15 GDPR
• Request correction of inaccurate data under Article 16 GDPR
• Request deletion of your data under Article 17 GDPR
• Request restriction of processing under Article 18 GDPR
• Receive eligible data in a structured, commonly used, machine-readable format under Article 20 GDPR
• Object to processing based on legitimate interests under Article 21 GDPR
• Withdraw consent at any time under Article 7(3) GDPR, without affecting processing carried out before withdrawal
• Lodge a complaint with a data-protection supervisory authority under Article 77 GDPR

To exercise your rights, contact privacy@statuly.com.

We may need to request information necessary to verify your identity before fulfilling a request.

You may complain to any competent data-protection supervisory authority, particularly the authority in the EU member state where you live, work, or believe an infringement occurred.

The supervisory authority responsible for private companies based in Hesse is:

The Hessian Commissioner for Data Protection and Freedom of Information
Wilhelmstraße 7
65185 Wiesbaden, Germany
Telephone: +49 611 1408-0
Email: poststelle@datenschutz.hessen.de
Website: https://datenschutz.hessen.de

Statuly is not intended for children under the age of 16. We do not knowingly create accounts for or collect personal data directly from children under 16.

If you believe that a child has provided personal data to Statuly, please contact privacy@statuly.com.

Account-verification codes, security alerts, subscription notices, and other messages necessary to provide Statuly are transactional communications.

We will send newsletters or promotional emails only where permitted by law. Where consent is required, you may withdraw it at any time using the unsubscribe link or by contacting us.

We may update this Privacy Policy when Statuly's functionality, service providers, or legal obligations change.

Material changes will be communicated through the service or by email where appropriate. The current version and its effective date will always be available on the Statuly website.

For questions about this Privacy Policy or the processing of your personal data, contact:

Devoreo UG (haftungsbeschränkt)
Privacy contact: privacy@statuly.com
Kölner Straße 12, 60327, Frankfurt am Main, Hesse, Germany