This Privacy Policy describes how Treyst (“we”, “us”, or “our”) collects, uses, and protects your personal data when you access or use the Treyst legal automation platform (the “Platform”).

It is drafted in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR), Articles 12–14 (transparency obligations), and applicable national data protection laws.

1. Data Controller

The data controller for personal data processed through the Platform is:

Company Name: Treyst Solutions ehf. (operating as Treyst)

Address: Kristnibraut 95, 113 Reykjavík, Iceland

Data Protection Officer: dpo@treystai.com

Where Treyst processes personal data on behalf of your organisation (as a B2B customer), Treyst acts as a data processor and your organisation is the data controller for that processing activity. This Policy covers both roles.

2. Data We Collect

The Platform is designed for use by legal and regulatory professionals and is not directed at children or individuals under the age of 18. We do not knowingly collect personal data from anyone under 18 years of age. If we become aware that personal data has been collected from a person under 18, we will take steps to delete that information promptly.

We collect and process the following categories of personal data:

2.1 Account & Identity Data

• First name, last name, email address, phone number

• Encrypted password (bcrypt-hashed; never stored in plain text)

• Role within your organisation (User / Admin)

• Profile picture (optional)

• Account status and verification data

2.2 Organisation Data

• Organisation name, slug, and status

• Organisation membership and role assignments

2.3 Document & Legal Content Data

The Platform processes legal documents you upload, including PDFs, Excel files, and national legislative texts. These documents may contain personal data if referenced in the legislation (e.g., named individuals in legal instruments). We process this content solely to provide the AI-assisted legal analysis services you request, including:

• EU directives and EFTA legal acts fetched from EUR-Lex and EFTA portals

• National transposition documents you upload

• Adaptation, amendment, auditing, and gold-plating analysis outputs

• Folder and file organisation metadata

2.4 Usage & Activity Data

• Features accessed and processing jobs created (job type, status, timestamps)

• Processing events and usage statistics per user and organisation

• Notification interactions

2.5 Technical & Security Data

• IP address (captured at consent recording for audit purposes)

• Authentication tokens (JWT, stored in your browser’s localStorage)

• Error and crash reports (via Grafana)

• Server-side access logs

2.6 Consent Records

• Record of acceptance of Terms of Service and Privacy Policy (timestamp, version)

• Cookie notice acknowledgement (stored locally)

2.7 Monitoring & Alerts Data

The Platform’s legal monitoring module continuously tracks public legal and regulatory sources and produces personalised alerts. To do so, we process the following categories of data:

Monitoring profile configuration — profile name, description, industry, legal activities, fields of law, practice area, strict-classification flag, and notification preferences (frequency, format, email enabled flag, vacation dates).

Scraped legal case content — titles, summaries, links, status names and source identifiers retrieved from public legal databases (see §5 for the full list of sources, e.g. Alþingi, Samráðsgátt, Stjórnartíðindi, Icelandic courts and regulators, EUR-Lex, the European Commission and the EFTA Surveillance Authority). This content may incidentally include personal data of individuals named in publicly available legislative or judicial documents.

AI relevance classifications — for each case and each of your monitoring profiles, the resulting relevance label (e.g., “Highly Relevant”, “Not Relevant”), the AI-generated reasoning text and the analysis timestamp.

Monitoring notifications — title, content, full report HTML body, source, report type, case counts, metadata, the recipient user identifier, the associated profile identifier, read status and timestamps.

Case feedback — free-text feedback messages you submit to challenge or comment on a relevance classification, the admin reply thread, the feedback status (Pending / Reviewed / Replied / Resolved), and timestamps. Each feedback message is linked to the user identifier of its author.

Scheduled task execution data — operational records of when scraping, classification and notification jobs ran, their status, and any error messages (used for reliability and audit purposes; not user-facing).

Monitoring data is stored in a separate monitoring database hosted in the EU (see §6.1). User and profile identifiers in monitoring records reference the corresponding records in the main Treyst database for access control and personalisation.

2.8 Website Enquiry Data

When you submit the contact form on our public website (treystai.com), we collect the details you enter: name, email address and, optionally, job title, phone number, organisation, country, subject and message. We also record the date and time of submission, the page the enquiry was sent from, and the fact that you accepted the consent statement shown beside the form, including its exact wording.

Each enquiry is delivered to Treyst in two ways: (i) as an email to our contact inbox through our configured SMTP relay hosted within the EU/EEA, and (ii) as a contact record and form submission in our HubSpot customer relationship management (CRM) system, hosted in HubSpot’s EU data centre (see §5 and §6.1), so that we can respond to and follow up on your enquiry.

We do not send your IP address, the reCAPTCHA spam-protection token or any tracking identifier to HubSpot, and the website does not load HubSpot tracking code or set HubSpot cookies. Submitting the form does not subscribe you to marketing communications.

You may withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal, by contacting dpo@treystai.com; we will then delete your enquiry from HubSpot and from our contact inbox (see §7.1 and §8).

3. Purposes of Processing and Legal Bases (GDPR Arts. 6 & 13)

In accordance with GDPR Art. 13(1)(c), the following table maps each processing purpose to the specific personal data categories involved and the legal basis relied upon:

Legitimate interest basis: We have conducted a legitimate interest assessment (LIA) for security logging. Our interest in maintaining platform security does not override your fundamental rights, given the limited nature of the data retained and the security safeguards applied.

De-Identified and Aggregated Data. Treyst may derive de-identified, aggregated data from Customer Data by irreversibly removing all information that identifies or could be used to identify any individual person or Customer. Such de-identified data is not personal data within the meaning of GDPR and may be used by Treyst for service improvement, benchmarking, analytics, and other lawful purposes without restriction. This processing does not affect your rights under GDPR with respect to your personal data.

4. AI-Assisted Processing and EU-Hosted AI Sub-Processors

A core feature of the Platform is AI-assisted legal document analysis. When you submit documents or request analysis, relevant content (legal text, document excerpts) is sent to one or more EU-hosted Large Language Model (LLM) providers acting as data processors under GDPR Art. 28. All AI processing takes place on infrastructure located within the European Union; no document content is transferred to providers outside the EU/EEA.

We do not use OpenAI’s public API (api.openai.com). Where OpenAI-developed models are used, they are accessed exclusively through Microsoft Azure OpenAI Service deployed in EU regions, which provides separate processor commitments, EU-data-residency and EU-only data processing under our Microsoft Online Services DPA.

We have entered into Data Processing Agreements (DPAs) with each provider under GDPR Art. 28. Providers process data only for the purpose of generating the analysis you request and are contractually prohibited from using your content to train their models.

Data persistence at AI providers: Document content transmitted via API is not permanently stored by the AI providers. Azure OpenAI Service is configured to disable abuse monitoring / human review where eligible, so input and output are not retained beyond the API request; Google Gemini (Vertex AI) and Mistral AI do not retain prompt content beyond the API request on the paid / enterprise tiers we use. Full details are provided in §7.4.

You should avoid uploading documents containing unnecessary personal data. If you process documents that include personal data of individuals (e.g., named parties in legislation), you are responsible as data controller for ensuring an appropriate legal basis exists for transmitting that content.

4.1 Automated Relevance Classification (Monitoring)

What is sent to the AI provider: the case summary text and your monitoring profile context (profile name, description, industry, legal activities, fields of law, practice area, strict-classification flag). No account or contact identifiers (name, email, phone) are transmitted.

Where it runs: the same EU-hosted LLM providers listed in the table above (Microsoft Azure OpenAI Service, Google Vertex AI Gemini and, optionally, Mistral AI). The same GDPR Art. 28 DPAs, the same EU-only data residency, and the same no-training contractual restrictions apply.

How it is triggered: automatically and periodically by scheduled tasks (cron-driven) — not on a per-user request basis. The classification result and AI-generated reasoning are stored in the monitoring database.

Human oversight: classifications are filtering aids for professional review, not binding determinations. You can challenge any classification through the in-platform feedback mechanism (see §2.7) or by contacting dpo@treystai.com. See §8 for the related Art. 22 information.

Source content: case content is scraped from public legal and regulatory sources (see §5). Where this content incidentally names individuals, that personal data is processed solely to produce the relevance classification you have configured.

5. Data Sharing and Sub-Processors

We do not sell your personal data. We share data only with the following categories of recipients, each subject to appropriate data processing agreements:

All sub-processors are evaluated for GDPR compliance before onboarding. A current list of sub-processors is available upon request at dpo@treystai.com.

Where Treyst is required to disclose Customer Data by applicable law, regulation, or order of a court or governmental authority, Treyst shall (to the extent legally permitted) give Customer prompt written notice of such requirement and reasonably cooperate with Customer in any effort to contest or limit such required disclosure, at Customer’s expense.

6. International Data Transfers (GDPR Ch. V)

EU-only processing principle. Treyst is designed as an EU/EEA-only platform. All personal data, uploaded documents and AI processing are stored and processed on infrastructure located within the European Union. We do not rely on any third-country processor (such as OpenAI Inc. in the United States) for AI processing of customer content.

6.1 Data Locations

Cloudflare is used solely as a CDN, DNS provider and frontend host. The content of uploaded documents and AI processing data is never routed to or stored on Cloudflare; only minimal connection metadata (IP, request headers) is processed at the edge.

6.2 Supplementary Measures

Even though all processing takes place in the EU, we apply the following safeguards aligned with EDPB Recommendations 01/2020:

• Encryption in transit — all API calls use TLS 1.2+ end-to-end.

• Encryption at rest — cloud storage and database backups are encrypted at rest in EU regions.

• Data minimisation — only the document content strictly necessary for the requested analysis is transmitted to AI providers; no account, identity or organisation data is sent.

• Contractual restrictions — providers are contractually prohibited from using transmitted content for model training, sub-licensing, or any purpose beyond fulfilling the API request.

• EU data-residency enforcement — Azure OpenAI, Google Vertex AI, AWS S3 and Azure Blob deployments are pinned to EU regions; we routinely audit configurations to detect drift.

6.3 Onward Transfers by Sub-Processors

Some EU-based sub-processors (notably Microsoft, Google and HubSpot) are ultimately part of US-headquartered groups. Where any incidental access from outside the EU/EEA could occur (e.g., for technical support), it is governed by the EU Standard Contractual Clauses (EU Commission Decision 2021/914) and the supplementary measures described above. A Transfer Impact Assessment (TIA) for these scenarios is available on request.

You may request a copy of any applicable DPA, SCCs or TIA summary by contacting dpo@treystai.com.

7. Data Retention (GDPR Art. 5(1)(e) — Storage Limitation)

In accordance with the storage limitation principle (GDPR Art. 5(1)(e)), we retain personal data only for as long as strictly necessary to fulfil the purpose for which it was collected, or as required by applicable law. This section defines retention periods, deletion triggers, and procedures for every data category.

7.1 Retention Schedule

7.2 Deletion Triggers

In addition to the time-based retention periods above, data is deleted or anonymised upon any of the following events:

7.3 Uploaded Document Lifecycle

Upload: Documents are stored in cloud storage (AWS S3 or Azure Blob) within an EU region. Each file is associated with the uploading user and organisation.

Processing: When an AI analysis job is initiated, relevant document content is extracted and transmitted to the AI provider via API. Content is held in the provider’s memory only for the duration of the API request (see §7.4 below).

Retention: The original file is retained in cloud storage for 12 months from the upload date.

Early deletion: Users may delete any document at any time via the Platform interface. Organisation administrators may delete all documents within their organisation.

Automatic purge: Documents exceeding the 12-month retention window are permanently deleted by an automated daily process. Deletion is irreversible.

Account or subscription termination: All documents are permanently deleted within 30 days of account deletion or subscription termination.

7.4 Data Retention by Third-Party AI Processors

Document content transmitted to AI providers for analysis is subject to the following retention commitments, as established by our Data Processing Agreements (DPAs):

We select API configurations that minimise data retention at the provider level. No account, identity, or organisation data is transmitted to AI providers — only the document content required for the requested analysis.

7.5 Backup and Disaster Recovery Retention

Database backups are retained for a maximum of 30 days on a rolling basis for disaster recovery purposes. Backups are encrypted at rest and stored in EU-region infrastructure. When data is deleted from the live database (e.g., following an account deletion request), the deletion propagates to backups as they rotate out within the 30-day window. No data is restored from backups except in the event of a system failure.

7.6 Post-Retention Procedures

After the applicable retention period, data is securely deleted or irreversibly anonymised using methods appropriate to the storage medium. Account deletion requests are processed within 30 days in accordance with GDPR Art. 17.

When you delete your account, all personal identifiers (name, email, phone number, profile picture) are irreversibly replaced with non-reversible placeholders and your uploaded documents are permanently removed from storage. The anonymised account record is retained solely to preserve referential integrity of audit and consent logs, but cannot be linked back to any identifiable person.

7.7 Monitoring Data Lifecycle

The legal monitoring module maintains a separate retention regime that mirrors §7.1 but is summarised here for clarity:

• Monitoring profiles: retained for the duration of the organisation subscription + 30 days, and then permanently deleted together with all associated relevance analyses, notifications and feedback for that profile.

• Scraped case content: retained while the source content remains publicly available and useful for ongoing monitoring; reviewed at least annually.

• AI relevance classifications and reasoning: retained for the duration of the associated monitoring profile subscription + 30 days.

• Monitoring notifications (in-app records and stored email HTML): permanently deleted 12 months after creation, or earlier on user account deletion.

• Case feedback and feedback messages: retained for the duration of the user’s account + 30 days; then permanently deleted with the user account.

• Scheduled task execution history: retained for 6 months on a rolling basis, then automatically purged.

Email delivery: the configured SMTP relay used to deliver monitoring digests is operated within the EU/EEA and retains delivery logs only as needed for secure delivery and incident handling.

On account deletion (GDPR Art. 17), monitoring notifications and case feedback authored by the deleted user are removed from the monitoring database within 30 days. Where a feedback thread also contains admin replies, the admin reply text is preserved with anonymised authorship to maintain the integrity of resolved threads, unless the admin’s own account is also being deleted.

8. Your Rights Under GDPR (Arts. 15–22)

You have the following rights regarding your personal data. To exercise any right, contact dpo@treystai.com. We will respond within 30 calendar days (extendable by 2 months for complex requests, with notice).

Note on automated relevance classification (Art. 22). The monitoring system uses automated AI classification to categorise public legal cases by relevance to your monitoring profile. This determines which cases are surfaced in your alerts and digests. We consider that this processing does not produce legal effects or similarly significant effects within the meaning of Art. 22(1) GDPR because: (a) classifications serve as a filtering aid for professional review by qualified legal users, not as a binding legal determination; (b) all cases remain accessible regardless of their classification — relevance is used to prioritise, not to exclude; and (c) you can challenge any classification through the in-platform feedback mechanism (see §2.7) or by contacting dpo@treystai.com. You may at any time request human review of any automated classification, express your point of view, and contest the result.

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with your national supervisory authority. Find your authority at edpb.europa.eu.

9. Cookie Policy and Browser Storage

This section constitutes our Cookie Policy in accordance with the ePrivacy Directive (2002/58/EC) and GDPR. It describes all cookies, local storage items, and similar technologies used by the Platform. We use only strictly necessary cookies and browser storage — no analytics, marketing, or tracking technologies are deployed.

9.1 What Are Cookies?

Cookies are small text files stored on your device by your browser. We also use browser localStorage for certain technical purposes. Both are described below.

9.2 Strictly Necessary Cookies and Storage

These are essential for the Platform to function. They do not require consent under the ePrivacy Directive.

9.3 Managing Your Preferences

This platform does not use analytics, marketing, or tracking cookies. You can view cookie details at any time via the “Manage Cookies” link in the footer, or by adjusting cookie settings in your browser. Disabling necessary cookies may impair Platform functionality.

For more information about cookies in general, visit allaboutcookies.org.

10. Security Measures

We implement appropriate technical and organisational measures (TOMs) in accordance with GDPR Art. 25 (data protection by design and by default) and Art. 32:

• TLS/HTTPS encryption in transit for all communications

• Password hashing using bcrypt with salt rounds

• JWT-based stateless authentication with expiry

• Role-based access control (RBAC) at API level (Admin / User roles)

• Organisation-level data isolation (multi-tenancy)

• Error monitoring and observability with Grafana (no sensitive personal data included in logs)

• Cloud storage with access control policies (AWS S3 / Azure Blob)

• Redis in-memory queue — data not persisted beyond job lifecycle

In the event of a personal data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, in accordance with GDPR Arts. 33–34.

11. Business Customers — Data Processing Agreement

The Platform is designed as a business-to-business (B2B) tool. When your organisation subscribes to Treyst:

• Your organisation is the data controller for the personal data of its employees and the documents it uploads.

• Treyst acts as a data processor on your behalf for the purpose of providing the Platform services.

A Data Processing Agreement (DPA) under GDPR Art. 28 is available and incorporated into our subscription terms. Contact legal@treystai.com to request a copy.

Breach Notification (Processor Role). In its capacity as data processor, Treyst shall notify the Customer (as data controller) without undue delay upon becoming aware of a personal data breach affecting Customer Data, in accordance with GDPR Art. 33(2). Such notification shall include, to the extent available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach.

11.1 Processor Data Retention and Deletion Obligations

In its capacity as data processor, Treyst commits to the following under GDPR Art. 28(3)(g):

Retention during subscription: Uploaded documents and AI processing outputs are retained only for the duration specified in §7.1, or until earlier deletion by the controller.

Data return on termination: Upon subscription termination, the controller may request an export of all data (documents, AI outputs, account data) in a structured, machine-readable format (JSON) within the 30-day post-termination window.

Data deletion on termination: After the 30-day post-termination window (or immediately upon written instruction from the controller), all personal data processed on behalf of the controller is permanently deleted from live systems. Database backups containing such data rotate out within 30 days (see §7.5).

Sub-processor retention: Treyst ensures that all sub-processors (including AI providers) delete or return personal data upon termination of the sub-processing relationship, as required by the DPA chain. AI provider data persistence is described in §7.4.

Certification of deletion: Upon request, Treyst will provide written confirmation that all data processed on behalf of the controller has been deleted, unless retention is required by EU or member state law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent in-platform notice at least thirty (30)days before changes take effect. The “Last updated” date at the top of this page will always reflect the most recent version. Previous versions are available upon request.

13. Contact & Complaints

For any privacy-related question, request, or complaint:

Email: dpo@treystai.com

Post: Treyst Solutions ehf., Attn: Data Protection, Kristnibraut 95, 113 Reykjavík, Iceland

You also have the right to lodge a complaint with your local supervisory authority (e.g., CNIL in France, ICO in the UK, BfDI in Germany) at any time.

© 2026 Treyst. All rights reserved.