Ochrana osobních údajů
- Last reviewed: 2026-10-29
1. Who we are
Redactic is a document redaction service operated by KS Agents ("KS-Agents di LR", P.IVA IT01430680320), Trieste, Italy. For the personal data described in this policy, KS Agents is the data controller. Contact: [email protected].
2. What this policy covers (and what it does not)
This policy covers the data we process to run your Redactic account and our website: registration data, billing data, and usage data. It does not cover the personal data contained in the documents you submit for redaction. That content is processed under the Redactic Data Processing Agreement, where you are the controller and we are the processor, and it is ephemeral and not retained.
3. Personal data we process
- Account data: name, email address, company / organisation name, password (stored hashed), language preference.
- Billing data: billing name and address, VAT number, purchase history, and payment metadata handled by our payment processor (we do not store full card numbers).
- Usage data: login events, credit usage counts, and basic technical logs needed to operate and secure the Service.
- Technical data: IP address and request metadata processed by our infrastructure and security layer.
- Aggregate analytics: cookieless, non-identifying traffic measurement (see §7 and the Cookie Policy).
We do not profile you for advertising and do not sell your personal data.
4. Purposes and legal bases (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Create and operate your account, provide the Service | Performance of a contract (Art. 6(1)(b)) |
| Process payments and issue invoices | Contract + legal obligation (Art. 6(1)(b), (c)) |
| Secure the Service, prevent abuse and fraud | Legitimate interests (Art. 6(1)(f)) |
| Aggregate, cookieless usage measurement | Legitimate interests (Art. 6(1)(f)) |
| Send service / transactional emails | Contract (Art. 6(1)(b)) |
| Comply with tax and accounting obligations | Legal obligation (Art. 6(1)(c)) |
5. Service providers (processors)
Redactic uses a deliberately small set of providers. Workspaces in the EU data region, which is the default, use only EU-hosted AI model providers:
| Provider | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting and compute | EU (Helsinki / Germany) |
| Cloudflare, Inc. | CDN, DNS, security, cookieless analytics, transactional email (EU tenant) | EU jurisdiction / global edge |
| Stripe, Inc. | Payment processing and invoicing | USA / Ireland (SCCs) |
| AI model providers (EU-hosted) | AI processing of masked text only (see DPA) | EU |
| Anthropic PBC (Claude API), only for workspaces in the US data region | AI processing of masked text only (see DPA, Annex E) | USA (SCCs) |
AI providers receive only masked text and are bound by no-training terms; Zero Data Retention applies where the provider offers it or our routing service declares it. Document content is never sent to them in clear form.
6. International transfers
Account and billing data are processed within the EEA, except for payment processing by Stripe, which may involve a transfer to the USA under the European Commission's Standard Contractual Clauses (2021/914). For workspaces in the EU data region, which is the default, AI processing of masked text is performed by EU-resident providers, so no masked content leaves the EEA. For workspaces in the US data region (workspaces billed to an address in the United States or a US territory), masked text sent to Claude models is processed by Anthropic PBC in the United States under the Standard Contractual Clauses (2021/914); see the DPA, Annex E.
7. Retention
We keep account and billing data for as long as your account is active and thereafter only as required by law (for example, invoices for the statutory tax-retention period). On account closure, account data is deleted or returned at your choice within 30 days, except data we must retain by law (see DPA §3.7). Document content is not retained at any time.
8. Your rights
You have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interests. You may lodge a complaint with a supervisory authority (in Italy, the Garante per la protezione dei dati personali). To exercise any right, contact [email protected]; we respond within one month as required by the GDPR.
9. Cookies
Redactic uses only strictly-necessary cookies plus cookieless analytics, so no consent banner is required. See the Redactic Cookie Policy for details.
10. Changes and contact
We will update this policy if our processing changes and will note the revision date. Questions or requests: [email protected]. Data controller: KS Agents ("KS-Agents di LR"), P.IVA IT01430680320, Trieste, Italy.
11. Language
This policy is provided in more than one language. The English version is authoritative; translations are for convenience only and the English version prevails in case of discrepancy.