Nautilus
Privacy Notice
Version 2026-09-01
Summary
This summary is provided for convenience. The full notice below governs.
- How your questions are handled. When you submit a legal question, we search our database of legislation and court decisions and send your question, together with the relevant provisions, to an AI model that generates the answer. Your question, the text extracted from any document you upload, and the output are stored in your account so that you can return to them.
- Information, not advice. Output is generated by an AI system, may be incorrect, and is not a substitute for advice from a lawyer. Communications with Nautilus are not covered by legal professional privilege.
- Sensitive information. Legal questions often reveal information about health, family life, religion or finances. If you hold a consumer account, we ask for your explicit consent before processing it, and you may withdraw that consent at any time in account settings.
- Criminal matters. If you hold a consumer account and your question concerns a criminal charge, investigation or conviction, we decline it and refer you elsewhere. The message is not stored.
- Lawyer accounts. For the personal data in a lawyer's matters, the lawyer is the controller and Nautilus acts as processor on the lawyer's instructions.
- Your data stays in the European Union. See section 9.
- Self-service rights. You can download all data we hold about you, or delete your account, directly from account settings.
- No sale, no advertising, no model training. We do not sell your data, we do not show you advertising, and we do not train AI models on your content.
Test phase. Nautilus is currently in a test phase. It is operated by a private individual rather than a company, access is by invitation only, and the service is free of charge.
1. Controller and contact
Nautilus is operated by Snezhana Boots, a natural person resident in the Netherlands ("Nautilus", "we", "us").
Contact for all privacy matters: contact@nautilus.legal
1.1 Roles by account type
The role Nautilus plays depends on the type of account. The account type is set when the account is created and is shown in account settings.
Lawyer accounts. A lawyer account is held by an individual practising lawyer. For the personal data contained in the matters a lawyer brings to Nautilus — concerning clients, opposing parties, witnesses and others — the lawyer is the controller and Nautilus acts as processor under Article 28 GDPR. We process that data only on the lawyer's documented instructions, under a data processing agreement concluded with the lawyer. A person whose data appears in a lawyer's matter should address requests about it to that lawyer.
Nautilus remains the controller of the lawyer's own account data and of the operational, security and usage records described in section 2.3.
Consumer accounts. A consumer account is held by a private individual for personal purposes. Nautilus is the sole controller of everything the account holder submits, uploads and receives, and every obligation in this notice applies to us directly.
2. Personal data we process
We process only the data required to provide the service. We use no tracking pixels, no advertising identifiers and no behavioural profiling.
2.1 Account data
| Data | Source |
|---|---|
| Email address (used as your username) | You, at registration, or Google sign-in |
| Password, stored only as a salted hash | You, at registration |
| Email verification status | Our verification process, or Google |
| Google account identifier and email address | Google, only if you use Google sign-in |
| Account type; age confirmation (consumers); acceptance of the terms and, for lawyers, of the data processing agreement | You, at registration |
| Enabled legal domains, administrator status, usage allowance | Us |
| Invite code used to register | You |
2.2 Content you provide
| Data | Notes |
|---|---|
| Messages you send | Stored as part of the conversation |
| Numerical representation (embedding) of your question | Computed to find relevant legal sources and discarded once the search is complete; never stored |
| Uploaded documents | We extract the text and keep it, first in a short-lived working cache and then as part of the conversation in which it was used. The original file is not stored. Uploads are limited to 150 pages per conversation |
| Answers and drafts | Stored so that you can return to them, including draft titles, the description of a requested draft and any instructions you give for revising it |
| Document templates you create | Stored in your account for use in your drafts |
| Feedback and issue reports | Including any free text you write |
Scanned documents are processed by optical character recognition — see section 6.1.
2.3 Operational data
| Data | Purpose |
|---|---|
| Usage and cost per request | Calculating consumption of your allowance |
| Retrieval records for each question | Recording which legal sources the search considered and how they were ranked, so that we can measure and improve search quality. Deleted with the conversation |
| Sign-in sessions | Keeping you signed in, and allowing you to sign out of all devices |
| Failed sign-in and request-rate records | Preventing password guessing and abuse |
| Consent records | An append-only record of each grant and withdrawal, with the notice version in force at the time |
| Audit records | Consent decisions, data subject requests, account deletions, and every access by an administrator to customer content |
| Server and application logs | Technical operation, error diagnosis and security. During the test phase, these logs also record the full content of requests to and responses from the AI model, so that errors can be diagnosed |
We do not use marketing analytics, session replay or non-essential cookies. Any usage statistics we compile are aggregate and for internal operational use only.
3. Sensitive data
3.1 Special categories of personal data (Art. 9 GDPR)
Legal questions routinely contain special categories of personal data: a dismissal question may involve health data, a family matter data about children, and a question about religious holidays at work religious belief. Such information cannot be separated from the legal question itself.
Consumer accounts. We ask for your explicit consent (Art. 9(2)(a) GDPR) before your first question, in a separate step that is not bundled with these terms or with registration. Until consent is given, the service does not search or answer: the request stops before any retrieval takes place and nothing is sent to the AI model.
You may withdraw consent at any time in account settings; withdrawal takes effect from your next question. Withdrawal does not affect the lawfulness of processing carried out before it, and does not delete your history — for that, use the right to erasure described in section 8.
Lawyer accounts. The processing rests on the lawyer's own lawful basis as controller — typically Art. 9(2)(f) GDPR (establishment, exercise or defence of legal claims), supported by the lawyer's professional secrecy obligations — and we process the data on the lawyer's instructions. We do not seek consent from lawyers, as it would not be ours to obtain.
3.2 Criminal-offence data (Art. 10 GDPR)
Personal data relating to criminal convictions and offences — including suspicions, charges and allegations — may be processed only under the control of official authority or where authorised by Union or Member State law. Consent is not a sufficient legal basis.
Consumer accounts. Where a question concerns a criminal matter, we decline it and refer you to a criminal defence lawyer or the appropriate public service. The message is not stored; if you reopen the conversation, a placeholder appears in its place. This restriction applies in every market we currently serve and will be lifted in a market only where a national legal provision authorises the processing.
Lawyer accounts are not subject to this restriction, as lawyers process such data under their own professional authorisation.
3.3 No legal professional privilege
If you hold a consumer account, your communications with Nautilus are not privileged and do not enjoy the protection from disclosure that applies to communications with a lawyer you have instructed. Please consider this before describing matters you would not wish to be disclosed.
3.4 Minimum age
Consumer accounts are available only to persons aged 18 or over, who confirm their age at registration. We do not verify identity, as that would require collecting more personal data. If we learn that an account belongs to a minor, we will close it and erase its data.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and operating your account; authentication | Art. 6(1)(b) GDPR — performance of the contract |
| Answering questions, storing conversations, generating drafts, storing your templates | Art. 6(1)(b); for consumer accounts additionally Art. 9(2)(a) — explicit consent — for special categories of data |
| Sending verification, password-reset, data-export and account emails | Art. 6(1)(b) |
| Google sign-in, where you choose it | Art. 6(1)(b) |
| Rate limiting, abuse prevention and security logging | Art. 6(1)(f) — our legitimate interest in keeping the service and the material entrusted to it secure. A summary of the balancing test is available on request |
| Error diagnosis during the test phase | Art. 6(1)(f) — our legitimate interest in identifying and correcting faults before general release |
| Calculating usage against your allowance | Art. 6(1)(b) |
| Consent and access audit records | Art. 6(1)(c) together with Art. 5(2) — the obligation to demonstrate compliance |
| Handling data subject requests | Art. 6(1)(c) |
| Processing content in a lawyer's matters | Art. 28 — on the lawyer's documented instructions, under the lawyer's own legal basis |
We do not use your content to train, fine-tune or evaluate AI models. Should we wish to do so in future, we will ask for separate, opt-in consent, and you will be free to refuse without any effect on the service.
5. Automated processing
Nautilus produces legal research and draft documents. Decisions on what to do with them are taken by a person — you, or your lawyer. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR.
Before an answer is generated, the following automated steps take place:
- Triage assesses whether the question is one the service can answer and, for consumer accounts, whether it concerns a criminal matter. It considers only your own messages, not your uploaded documents or previous answers.
- Pre-search analysis determines which legislation, and which reference date, the search should use. It may pause the conversation to ask you a clarifying question.
- Template selection, for document drafts, chooses a suitable document template where you have not chosen one.
None of these steps produces a decision about you. If you believe a question was declined in error, contact us and the matter will be reviewed by a person.
In accordance with Art. 50 of the EU Artificial Intelligence Act, every answer states that it was generated by an AI system.
6. Recipients
6.1 Processors
The following service providers process personal data on our behalf and only on our instructions:
| Provider | Service | Location | Data concerned |
|---|---|---|---|
| Hetzner Online GmbH | Hosting, database, file storage and backups | Finland and Germany (EU) | All data, at rest |
| Amazon Web Services EMEA SARL (Amazon Bedrock) | Generation of answers and drafts, by an Anthropic Claude model | AWS regions within the EU | Your question, uploaded document text, and the retrieved legal sources |
| Mistral AI SAS | Optical character recognition of scanned uploads | France (EU) | Scanned documents you upload |
| Scaleway SAS | Transactional email | France (EU) | Your email address and the content of account emails |
Each provider is bound by a data processing agreement under Art. 28(3) GDPR, covering confidentiality, security, and deletion or return of data at the end of the service. Amazon Bedrock does not store the content of requests or use it to train models, and does not share it with the model provider.
We keep this list up to date and will inform you by email before adding or replacing a provider.
6.2 Independent controllers
Google Ireland Limited, only if you use "Sign in with Google". We request
only the openid and email scopes and store three items: Google's stable
identifier for your account, your email address, and whether Google has verified
it. We do not request access to your mailbox, files or contacts, and we hold no
Google refresh token. Google processes the sign-in as an independent controller
under its own privacy policy. You can revoke our access at any time at
myaccount.google.com/permissions.
6.3 Building the legal database
To build the database of legislation and court decisions that Nautilus searches, we process published legislation and published judgments — public documents, not your content. This work uses OpenAI, L.L.C. (United States) for text extraction. It never involves customer accounts, conversations or uploads. We mention it because published judgments may contain personal data of the parties to the proceedings.
6.4 Other recipients
We disclose personal data to public authorities only where legally required to do so, and to professional advisers bound by confidentiality. If the service is transferred to another operator, your data may be transferred with it subject to this notice; we will inform you in advance.
We do not sell your data or share it for advertising purposes.
7. Retention
| Data | Retention period |
|---|---|
| Account data and conversations | For as long as your account exists |
| Conversations you delete | Permanently deleted 30 days after deletion |
| Uploaded document text in the working cache | 12 hours |
| Uploaded document text in a conversation | For the life of that conversation |
| Original uploaded files | Not stored |
| Templates you create | For as long as your account exists, unless you delete them |
| Feedback and issue reports | 24 months. Feedback on a conversation is deleted earlier, when the conversation is permanently deleted. An issue report is kept for the full 24 months but is unlinked from the deleted conversation |
| Sign-in sessions | 30 days, or until you sign out |
| Failed sign-in and request-rate records | 1 day |
| Email verification, password-reset and Google registration links | Single use; valid for a short period only (at most 1 hour) |
| Data export archives | Deleted as soon as you download them, and in any event 1 hour after the download link is issued |
| Inactive consumer accounts | Notified by email after 24 months of inactivity; erased after 30 months |
| Accounts for which deletion has been requested | Erased 14 days after the request — see section 8 |
| Consent records | For the life of the account, as evidence of what you agreed to; erased with the account, while the audit record of each decision is kept as set out below |
| Audit records | Consent decisions, data subject requests and account deletions: 5 years, counted for a consent from the day it ends (on withdrawal or account erasure). Administrator access to customer content: 24 months. Records retained after account erasure carry an irreversible pseudonym in place of your identity |
| Server and application logs | 90 days |
| Backups | 7 days — see section 8 |
Retention periods are enforced by a scheduled automated process.
8. Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, objection to processing and data portability, and the right to withdraw consent at any time. Exercising these rights is free of charge and does not affect the service you receive.
8.1 Self-service
| Right | How to exercise it |
|---|---|
| Access and portability (Art. 15 and 20) | Account settings → Download my data. We compile a machine-readable (JSON) archive and email you a download link. The archive contains your questions and our answers, uploaded document text, drafts, templates, feedback and issue reports, your account details, your consent history with the notice version of each decision, your past data subject requests, the account emails we sent you, the sign-ins to your account with the device used, and your usage total. The link can be used once, expires after one hour and requires you to be signed in. You may request a new archive at any time |
| Erasure (Art. 17) | Account settings → Delete my account. Access ends immediately; erasure follows after a 14-day grace period |
| Withdrawal of consent (Art. 7(3)) | Account settings → sensitive-data consent setting. Effective from your next question |
| Rectification (Art. 16) | Account settings, for your email address and account details; otherwise by email |
We do not ask a signed-in user for proof of identity to exercise these rights, as you are already authenticated and requesting identification would itself be excessive.
8.2 Content not included in the archive
The archive contains your personal data, not the internal workings of the service. Each archive lists the following omissions and the reasons for them:
- Retrieval records (section 2.3). These describe our search system and the public legal corpus — internal reference codes and ranking scores — rather than you. The sources an answer relied on are named in the answer itself, which the archive contains in full. Art. 15(4) GDPR and Recital 63 permit withholding information that would disclose trade secrets, and Art. 20 does not extend to data we have derived.
- Internal identifiers, such as database keys, session identifiers and storage paths. These have no meaning outside our systems. Conversations in the archive are numbered from the oldest, and related items such as feedback refer to that number.
- The invite code record, which belongs to the person who issued the code and refers to other users. Your registration is nevertheless removed from it when your account is erased.
- Automatic session renewals. While you use the service, your sign-in is renewed in the background every few minutes. The archive lists each sign-in with its device, not each renewal.
- Your password hash, as disclosing it would put your account at risk.
If you believe something is missing, contact us at the address in section 14.
8.3 Effect of account deletion
Signing in during the 14-day grace period cancels the deletion, and we confirm the cancellation by email. After the grace period:
- Erased: your account, all conversations (including deleted ones) and the uploaded document text they contain, drafts, templates, feedback and issue reports, sign-in sessions and any Google link.
- Retained without identifying you: usage totals, with the account reference removed, so that aggregate figures remain accurate; and audit records, with your identity replaced by a pseudonym, as we must be able to demonstrate that the erasure took place.
Erasure takes effect immediately in the live system. Backups are kept for 7 days, so a copy may remain in a backup for up to that period. Backups are used solely for disaster recovery, and if a backup is ever restored, erasures made since it was taken are applied again before the system is used.
8.4 Restriction and objection
Requests for restriction or objection should be sent to contact@nautilus.legal. We respond within one month and will inform you if the extension permitted by the GDPR for complex requests is required.
8.5 Persons whose data appears in a lawyer's matter
If your data appears in a matter brought to Nautilus by a lawyer, the lawyer is the controller and you should address your request to the lawyer. If you send it to us, we will forward it to the lawyer and inform you that we have done so.
8.6 Complaints
Please contact us first at contact@nautilus.legal so that we can try to resolve the matter. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU/EEA Member State of your habitual residence, your place of work or the place of the alleged infringement. Our competent supervisory authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). In Switzerland, the competent authority is the Federal Data Protection and Information Commissioner; in Montenegro, the Agency for Personal Data Protection and Free Access to Information.
9. International transfers
All processing of your content takes place within the European Union: hosting and backups in Finland and Germany, AI generation in AWS regions within the EU, optical character recognition in France and email delivery in France. No transfer mechanism under Chapter V GDPR is therefore required for these flows.
Google sign-in (section 6.2) is governed by Google's own privacy policy.
10. Security
- Encrypted transport (TLS) for all connections.
- Passwords stored only as salted hashes; we cannot see your password.
- Short-lived access tokens (15 minutes) combined with rotating, hashed refresh tokens, so that signing out, changing your password or deleting your account ends active sessions immediately.
- Rate limiting on sign-in, registration and email requests, and identical responses for unknown addresses and incorrect passwords, so that the sign-in form cannot reveal who holds an account.
- Google sign-in using the authorisation-code flow with PKCE; a Google identity is never linked to an existing account on the basis of a matching email address alone.
- Access to customer content restricted to administrator accounts, with every such access recorded in the audit log. Creating invite codes requires an additional key held only by internal tooling.
- Key-based server access, limited to the persons operating Nautilus.
- Daily database backups kept on separate storage.
In the event of a personal data breach, we notify the competent supervisory authority within 72 hours where required, and inform you without undue delay where the breach is likely to result in a high risk to your rights and freedoms.
11. Cookies and local storage
We use your browser's local storage solely to keep you signed in. This is strictly necessary to provide the service you requested, so no consent banner is required and none is shown.
We use no advertising cookies, analytics cookies or third-party trackers. Should this change, we will ask for your consent first, and refusing will be as easy as accepting.
12. Language
This notice is published in English. Should translations be published, any substantive discrepancy between a translation and the English text may be reported to us so that it can be corrected.
13. Changes to this notice
We will update this notice as the service develops. The version identifier at the top shows which version you are reading, and your consent records state the version in force when you made each decision. We will notify you of material changes by email and, where a change affects processing based on your consent, ask for your consent again.
14. Contact
Snezhana Boots (Nautilus) Netherlands Email: contact@nautilus.legal