Last updated: 30 November 2025
This Privacy Policy describes how Legislator (hereinafter “we”, “us”, “our”) processes personal data in connection with the use of our solution and website legislator.ch (collectively the “Solution”).
We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the General Data Protection Regulation (EU) 2016/679 (GDPR).
For all User Content provided to the Solution by the customer or its end-users, including documents, prompts, uploaded files, queries, and other materials, we act as a data processor within the meaning of Art. 5 lit. j FADP. The customer/user remains the data controller and is responsible for ensuring a lawful basis for the processing and for the content submitted to the Solution.
For administrative, billing, website, and support data, Legislator acts as a data controller (Art. 5 lit. i FADP / Art. 4(7) GDPR, where applicable).
When we act as controller, we process in particular Account and Administrative Data (see 4.1)
When we act as processor, we process all data submitted to the Solution for processing, including:
User Content may include particularly sensitive personal data under Art. 5 lit. c FADP (e.g. health data, data relating to criminal proceedings). We process such content only on documented instructions from the customer.
As data processor, we process User Content solely for the following purposes:
As data controller, we process Account and Administrative Data for the following purposes: * Account creation and management * Subscription administration and payments * Technical maintenance and security * Compliance with Swiss retention requirements * Communication with users (e.g. operational messages, support, product information)
We do not use User Content to train, fine-tune, or improve our proprietary models. Under our Data Processing Agreements, third-party AI providers act as subprocessors and are contractually prohibited from using Customer Data for model training or model improvement. AI processing is performed solely to generate the response to the specific request and for security and abuse‑prevention purposes where strictly necessary.
User Content and Account Data that must be stored persistently are stored on servers located in Switzerland.
AI inference tasks are executed using trusted third-party providers.
We engage specialized third‑party providers as subprocessors (e.g. cloud infrastructure, AI model providers, email and payment providers). A current list of subprocessors is available upon request at legal@legislator.ch.
Where subprocessors are located outside Switzerland:
User Content, including history data, drafts, previous versions, and generated outputs, is retained until deleted by the customer or according to the retention settings chosen by the customer. Upon deletion by the customer or upon request, User Content is promptly removed from our active systems. Residual copies may persist temporarily in encrypted backups, which are automatically purged after their standard lifecycle (maximum 30 days).
Account and Administrative Data are stored for the duration of the contractual relationship. Business records (e.g. invoices, contract documents) are retained for 10 years as required by Swiss law.
Technical logs on our systems and on subprocessor systems are retained only for short periods (generally ≤ 30 days) for security, abuse monitoring and operational purposes and are not used for model training.
Legislator processes User Content exclusively on the documented instructions of the customer. Legislator does not determine the purposes or means of processing User Content. Subprocessors are engaged in accordance with Section 8. Upon instruction by the customer, Legislator deletes User Content as described in Section 9.
The Customer is solely responsible for ensuring that the submission of User Content to the Solution complies with applicable laws, including any professional secrecy, confidentiality, or data-protection obligations.
The Customer acknowledges that AI-generated outputs may contain errors and must be reviewed by the Customer.
We implement appropriate technical and organizational measures to protect personal data, including in particular:
User Content is processed automatically by the Solution for the purposes described in Section 5. Human access to User Content occurs only where strictly necessary to:
Any human access is restricted to specifically authorized personnel, is subject to confidentiality obligations, and is logged.
Where feasible, we use aggregated, pseudonymized, or otherwise minimized data for monitoring, troubleshooting, and quality improvement, and avoid accessing full documents.
Where we act as controller, individuals have, under the conditions and within the limits of applicable law, the following rights:
Where we act as processor, requests must be addressed to the data controller (the customer). Customers may request the deletion of User Content, including historical versions. We implement such deletions without undue delay in accordance with the customer’s instructions.
Requests may be sent to legal@legislator.ch.
We use strictly necessary cookies for authentication, session management and essential functionality of the Solution.
We do not use third‑party tracking cookies or analytics cookies. If we introduce analytics or additional cookies in the future, we will update this Privacy Policy and, where required, obtain your consent.
We may amend this Privacy Policy from time to time for example to reflect changes in our processing activities or in applicable law.
Material changes will be communicated through the Solution and/or by email. The current version of the Privacy Policy is available at https://legislator.ch/privacy and replaces all previous versions.