Privacy notice

Who we are. Kritia makes compliance software for small organisations that use AI. It also publishes Law Watch and public research on EU AI and data rules. The controller for the processing described here is Kritia, Cork, Ireland. Contact: marcos@kritia.ai.

Law Watch subscriptions. Subscribing does not require an account. We store the email address you enter, when and where you asked, whether you confirmed the address, and whether you later unsubscribed. We do not record your IP address. The legal basis is consent under Article 6(1)(a) GDPR. A pending address is not sent an issue until its confirmation link is clicked. Every issue includes a one-click unsubscribe link. Unsubscribing excludes the address immediately; we retain the withdrawal record so we can prove that the address must not be mailed. We do not sell or share the subscriber list for another organisation’s marketing.

Email delivery. Resend delivers every email we send — sign-in links, generated documents, scan reports, Law Watch issues, and the reminders the compliance officer sends to an organisation’s owners. It receives the address and the message, and sends from its Ireland region.

Website analytics. Vercel Analytics counts page views and helps us understand which public pages readers use. It sets no analytics cookie and builds no cross-site advertising profile. Our legal basis is legitimate interest under Article 6(1)(f) in operating and improving the service and its public resources.

The free tools. The scope check runs in your browser and stores nothing until you choose to save a result to an account. When you scan a website we fetch that one page once from our servers, identifying ourselves as Kritia, and keep the address and the report’s fingerprint in the evidence ledger described below. When you use the policy generator or the full website scan we send the document or report to the address you give, and that address, with the company name or the site address you entered, is added to a launch-updates list. We have not mailed that list and will not without asking first.

Software accounts. An account holds your email address and the first and last name you give at sign-up; an organisation holds its name, country and size band, and the records you build in it — scope assessments, the AI inventory (the names, vendors, purposes and users you enter), issued documents, the people on your roster and their Article 4 measures, connected integrations, and the evidence ledger. We process these to provide the service you signed up for (Article 6(1)(b)); billing records under the same basis and our tax obligations (Article 6(1)(c)); and the evidence ledger, the website scanner and the sign-up notice below under our legitimate interest in running a service whose records can be shown to be unaltered (Article 6(1)(f)). If you sign in with Google or GitHub we receive your email address and name from them; we do not store a photo. When an account is created, we email ourselves the address and organisation name so a person can follow up.

Account data is hosted by Supabase in Ireland (eu-west-1) and the application runs on Vercel, with its functions in Dublin. Stripe handles payments: it receives your email address and organisation name from us, and your card details on its own page; Kritia never receives card numbers. An accountant or adviser who created or linked your organisation as their client can see its records.

Two things are public by design. Every document Kritia issues carries the SHA-256 of its text, and anyone holding a copy can check at kritia.ai/verify whether that fingerprint was recorded and when; the answer names the organisation the document was issued for and nothing else. And if you switch on a public record page (a Plus feature), your organisation’s name, the names, dates, versions and fingerprints of the records on file, and counts (AI systems recorded, people on the roster, measures, ledger entries) are published at kritia.ai/r/<your address> until you switch it off. Never the documents themselves, your answers or any person.

Cookies and browser storage. Signing in sets authentication cookies. A second cookie, kritia-org, remembers which organisation you last opened, for one year. Neither is used for tracking. The website scanner keeps a pending scan in your browser’s local storage for an hour so it survives sign-up, and Ask Kritia keeps the current conversation in session storage; neither leaves your browser. No consent banner is shown because no cookie is set for any purpose other than running the service.

Integrations. If an administrator connects a directory (Google Workspace, Microsoft 365, BambooHR), an advertising account (Meta, Google, LinkedIn), GitHub, HubSpot, or a destination (Slack, Teams, Asana, Google Drive, OneDrive), the read passes through Composio, a connector service in the United States that also holds the access token; its data processing agreement is put in place before a customer’s first connection. Kritia stores only what the People page and the screening records show: work email, name, organisational unit, group names and account status for staff, and account and campaign identifiers for advertising — never ad copy, targeting payloads, mail, files or messages. Nobody is deleted from a roster; leaving is recorded with a date. Your organisation is the controller of its staff’s data and Kritia processes it on your instructions. An evidence pack exported to Google Drive or OneDrive contains the staff names and email addresses in your literacy records.

Ask Kritia and your data. Ask Kritia is an AI assistant. When you ask a question, we send that question, the conversation you are having, any record you pin, and your organisation’s name, country, size band and plan to OpenAI, a provider in the United States, which generates the answer; when the question needs them, the assistant also reads your full AI inventory, your latest scope assessment and the text of any document we issued you, and those are sent too. OpenAI’s API terms provide that data sent this way is not used to train its models; we rely on those terms. The assistant explains; it never writes the policies or obligation text we issue — those come from fixed templates, which is why a document we generate can be reviewed and signed off and a chat answer cannot. If you would rather nothing left our own infrastructure, do not use Ask Kritia; every other part of Kritia works without it. Text extracted from a file you attach is sent with that question and is subject to the same terms. The file itself never leaves your browser: the text is extracted there, trimmed, and sent once with that question. Kritia keeps no copy of the file or of the text. OpenAI receives the question, the conversation, any pinned record and that text, and retains them under its API data policy; Kritia cannot delete what OpenAI holds.

Automated decisions. Kritia makes no decision about an individual that produces legal effects. The engine classifies AI systems and derives duties for an organisation from the answers you give, on fixed rules you can read in the result; Ask Kritia only explains.

Where data goes. Supabase, Vercel, Stripe, Resend, OpenAI and Composio are, or are owned by, companies in the United States. Data is stored in Ireland where the service allows it. Where a provider processes data in the United States, the transfer rests on the standard contractual clauses in that provider’s terms and, where the provider is certified, on the EU–US Data Privacy Framework.

Retention. Newsletter consent records are kept while the subscription is active, and withdrawal records are retained to maintain the suppression list. Account and organisation records are kept while the account exists. There is no automated deletion today: a request to close an account or erase data is handled by hand, within a month. Evidence ledger entries are not deleted, because removing them would defeat the integrity record they exist to provide; where an entry must refer to a person outside an organisation it carries a hash of the address, not the address. Roster rows are never deleted — a person who leaves is marked as left, with the date. Billing records are kept for six years under tax law. The launch-updates list and our own sign-up notices are kept until reviewed.

Children. Kritia is for businesses and is not directed at anyone under 18.

Your rights. You may request access, correction, erasure, restriction, portability or object to processing by emailing marcos@kritia.ai; we answer within a month. You can also complain to Ireland’s Data Protection Commission. Newsletter withdrawal is available directly from every issue without sending an email.

See the terms of use for the service’s legal limits.

Last updated: 9 September 2026.