What happens to your data.

Accounts, matters, uploaded documents, conversations and backups are kept in storage of Cloudflare, Inc. created with EU jurisdiction. For this storage, residence in the Union is a technical constraint, not a preference.

The limit. Outside this constraint are the semantic search indexes of documents (numbers and identifiers, without the text), some temporary working memory, the technical logs of the service, and processing by the models, which may also take place outside the EU.

Cloudflare

Infrastructure, storage, document indexing, models run on its platform, access to third-party models, visit statistics for the public pages of the site (no cookies).Receives questions and documents, to store, index and process them.

Google Gemini

Writing the answer, in-depth research, selecting and ranking sources, transcribing images and scanned pages.Receives the question and the passages of the sources the answer needs, including those of uploaded documents, and the images to transcribe.

Google Gemini API

Computing the vectors used by the search, with a key dedicated to Chiostro.Receives text only, never files or images: the question and its search variants, the text of uploaded documents split into fragments, the texts of public sources. It returns the vectors, which we store on Cloudflare.

Anthropic Claude

Breaking the question down into the issues to research.Receives the text of the question, not the uploaded documents.

Meta Muse Spark, Standard mode

Rephrasing the question for the search.Receives the text of the question, not the uploaded documents.

You.com SuSea, Inc.

Web search, limited to a closed list of legal sites: results become sources of the answer, with the site name and the link.Receives only a short version of the question (up to 300 characters), first cleaned of names, tax codes, emails, phone numbers, IBANs, plates and dates; if it cannot be cleaned safely, the search does not start. Never the uploaded documents, files or conversations.

If your question refers to a source of the previous answer, the text of the question carries that source's title.

To write the answer, the Google, Anthropic and Meta models are reached through Cloudflare's gateway, which does not keep the requests in its cache. Only the computation of vectors goes directly to Google's paid Gemini API service, with a key dedicated to Chiostro. The other recipients, such as the payment and newsletter services, are listed in the privacy notice (in Italian).

We do not train or fine-tune models. We do not use questions and documents for our own purposes, except for an answer you send us with the “Report” button.

Cloudflare states that it does not use customer content to train the models it runs. The terms Google and Anthropic apply to their paid API services exclude training on content. From Meta we use only the “Standard” mode, for which Meta's documentation excludes it; the mode that trains on content is blocked in our code.

The limit. For the models that write the answer we have no direct contract with Google, Anthropic or Meta: we reach them through Cloudflare, which manages the access on our behalf. For computing vectors we use Google's paid Gemini API service directly, under its terms.

Questions, answers and documents are opened in three cases only: if you ask us to for support, if the law requires it, or if you send us an answer with “Report”.

Before every report we tell you what reaches us: the question, the answer, the titles of the sources and your note. Not the uploaded documents, nor the other questions of the matter. The answer may however contain passages of the documents it quoted. You can ask us to delete it.

At your request we remove documents, indexed text, conversations and files. With every new version of the service an automatic test creates an account with documents and conversations, deletes it and checks live that nothing is left in the database or in the file storage.

Deleted data remain in the backups, kept in the EU, for at most 30 days.

The limit. You delete documents and conversations yourselves, in the application. The whole account is deleted today by our staff, at your request to ciao@chiostro.legal.

Chiostro states that it is an artificial intelligence system on every screen. Exported Word documents carry a visible notice and a machine-readable marking, with a fingerprint of the text and a signature. Copies and printouts carry the notice too.

Chiostro is meant for research and drafting by professionals. The Terms exclude use by judicial authorities, arbitrators and public administrations deciding on rights and benefits.

Every source has a record with its licence. The Source coverage page (in Italian) says what is there and what is missing.

Sentences in quotation marks that refer to a source are compared automatically with the text of the source, word for word, ignoring capitals, accents and punctuation.

The limit. Quotations shorter than 25 characters and paraphrases are not checked automatically. That is why every statement points to the source to verify.

The infrastructure Chiostro runs on (Cloudflare) is certified to ISO/IEC 27001, 27018 and 27701, has an annual SOC 2 Type II report and adheres to the EU Cloud Code of Conduct. These are Cloudflare's certifications, not Chiostro's.

• ISO/IEC 27001
• ISO/IEC 27018
• ISO/IEC 27701
• SOC 2 Type II
• EU Cloud CoC

• ISO/IEC 27001 since 2019, now in the 2022 version; ISO/IEC 27018 since 2022; ISO/IEC 27701 since 2021, as processor and as controller. They cover Cloudflare's global cloud platform and its offices (Cloudflare page).
• SOC 2 Type II: issued every year by an independent auditor, on security, confidentiality and availability. Cloudflare provides it to its customers under a non-disclosure agreement (Cloudflare page).
• EU Cloud Code of Conduct: Cloudflare is listed in the Code's public register (Cloudflare GDPR page).

The privacy notice, with the list of providers, and the Terms, which contain the agreement on processing data on behalf of the firm (Art. 28 GDPR), are public, in Italian. For any question about data, write to ciao@chiostro.legal.