1. ABOUT US AND THIS POLICY
Maksym Oleksiiovych Kobzov, a sole proprietor registered under the laws of Ukraine, taxpayer identification number 3029203717 (referred to as “we”, “us”, “our” or the “Company”), is the data controller under the Law of Ukraine “On Personal Data Protection”.
This Privacy Policy (the “Policy”) explains how we collect, use, retain and protect your personal data in connection with your use of our Service: a professional AI platform for Ukrainian legal professionals, attorneys and accountants that provides access to legislation, guidance, analysis and AI Features (the “Service” or the “Platform”).
The Service is available at www.mitralex.com (the “Website”).
This Policy applies to everyone who visits our Website, registers on the Platform, uses our services, including through the official Mitralex MCP Connector, or otherwise provides us with personal data.
2. DEFINITIONS
AI Features means the Platform’s functionality powered by artificial intelligence technologies, including large language models, that enables automated request processing, document analysis, text generation and other intelligent functions of the Service.
Personal data means information, or a set of information, relating to an identified or identifiable individual.
Data controller means an individual or legal entity that determines the purpose of processing personal data, the data to be processed and the procedures for processing it.
Processing of personal data means any operation or set of operations performed wholly or partly in an information system and/or filing systems, involving the collection, recording, accumulation, storage, adaptation, alteration, updating, use, disclosure, anonymization or destruction of information relating to an individual.
Data subject means an individual whose personal data is processed.
Consent of the data subject means any freely given indication of an individual’s wishes authorizing the processing of their personal data for the stated purpose.
Content means any data, information, requests or materials that a user enters or uploads to the Platform to interact with the AI Features, or transmits to Mitralex in the parameters of an MCP Connector call.
Mitralex MCP Connector means the official software interface that allows compatible third-party applications to search for and retrieve Mitralex materials on your behalf using the Model Context Protocol (MCP).
External AI Service means a third-party application you choose, such as Claude or ChatGPT, in which you connect the Mitralex MCP Connector. That application is governed by its own terms and privacy policy.
3. LEGAL BASES FOR PROCESSING PERSONAL DATA
We process your personal data on the following legal bases under Article 11 of the Law of Ukraine “On Personal Data Protection”:
your consent to the processing of personal data;
the necessity of performing a contract to which the data subject is a party, or taking steps at the data subject’s request before entering into such a contract;
the necessity of complying with a legal obligation of the data controller;
the Company’s legitimate interest, provided that it does not conflict with the rights and freedoms of the data subject.
For the analytics and advertising measurement described in Section 12 in relation to visitors in Ukraine, we rely on our legitimate interest in improving the Website and evaluating the effectiveness of the promotion of our services, taking into account users’ rights and freedoms and their ability to opt out of such tracking.
This Policy does not limit your rights under applicable data protection law.
4. PERSONAL DATA WE COLLECT
4.1. Data you provide directly
When you register for and use the Service, we may collect the following personal data:
last name, first name and patronymic;
email address;
telephone number;
account sign-in and identification information, including information received from the authentication provider;
other information you voluntarily provide when contacting support.
4.2. Professional information
To improve the Service and personalize your experience, we may collect professional information:
the name of your company, organization or law firm (employer);
job title;
work email address;
area of practice, such as corporate law, criminal law, tax law or accounting.
4.3. Payment information
To pay for the Service, you are redirected to a secure page operated by LiqPay, the payment provider of JSC CB “PRIVATBANK”. We do not collect, process or store your payment card details. All payment information is processed directly by LiqPay in accordance with its privacy policy.
We receive only the payment status confirmation (successful or unsuccessful), transaction identifier and payment amount from the payment provider, to keep records of the services provided.
4.4. Subscription information
We retain information about your subscriptions to our Service, including the subscription type, start and end dates, and payment history.
4.5. Technical data
When you use the Platform, we automatically collect certain technical data:
IP address;
browser type and version;
operating system;
device type;
language settings;
time zone.
Technical data is used to operate and secure the Platform. Section 12 describes data processing through analytics and marketing technologies on the Website.
4.6. Log files and metadata
For security, diagnostics and improvement of the Service, we maintain log files that may contain:
the time you access the Platform;
session duration;
AI request metadata, such as the time and request type, but not the content of the request itself;
information about errors and technical failures;
system activity, such as signing in, signing out and changing settings.
4.7. Cookies
We use strictly necessary cookies and similar technologies. The use of Website analytics and advertising technologies depends on the regional approach described in Section 12 and your saved choices. We also retain records of your cookie choices to apply and demonstrate those choices. Section 12 explains the purposes of these technologies and how to manage your choices; Section 9 explains data retention.
4.8. Data processed when you use the MCP Connector
When the MCP Connector is called, Mitralex receives the parameters of the specific request transmitted by the External AI Service: search text, filters, document identifiers or references to parts of documents. If these parameters contain personal data, we process that data to fulfill the request. Do not include information that is unnecessary to search for or retrieve the requested material.
Connecting the connector does not give Mitralex automatic access to your full conversation history, memory, conversation summaries or files in the External AI Service. We receive only the data actually transmitted in a specific tool call.
To authorize access and verify your entitlement to use the Service, we process your account identifier, authorization information, permissions and subscription information. To enforce usage limits, diagnose issues and prevent abuse, we process operational counters and technical records, including the time, duration and status of a request, error details and, where applicable, a subscription identifier. Request parameters are used to fulfill the request, not for advertising, profiling or model training.
We do not maintain a history of the content of your MCP requests or the results returned to you. This does not exclude temporary processing of a request to provide a response, or retention of the operational data described above. Retention periods are set out in Section 9.
Materials returned by the connector may contain information from official legal sources, including court and tax documents. This information is distinct from your account data and the content of your request.
5. USER CONTENT AND RESPONSIBILITY
5.1. Responsibility for Content
Platform users may enter data (Content) to interact with the AI Features. That Content may include personal data relating to third parties.
Users are solely responsible for the lawfulness of processing the personal data they enter into the Platform, including obtaining any necessary consent from the data subjects concerned.
In this situation, the Company acts as a data processor, processing data on the user’s behalf. We take all reasonable technical and organizational measures to protect user Content.
5.2. Content protection and no use for AI training
We do not use your Content to train or improve artificial intelligence models. For the Platform’s built-in AI Features that we provide through API providers, we ensure the following:
Commercial provider plans. For its built-in AI Features, the Platform uses only enterprise and commercial API plans offered by AI technology providers, including OpenAI, Anthropic and Google, whose terms expressly prohibit the use of customer data for model training.
Data retention by API providers for built-in AI Features. Our terms with AI technology providers for the use of large language models (LLMs) provide that user Content is either not retained on the providers’ servers after a request is processed or is retained for the minimum technical period solely for abuse monitoring, without use for any other purpose. This is subject to the API providers’ data retention policies for abuse monitoring, which may allow temporary retention for up to 30 days without access by third parties.
Content is used to fulfill your specific request. Operational authorization and subscription data and technical records are also processed to provide access, diagnose issues and ensure security in accordance with this Policy.
The guarantees in this subsection concerning API providers for built-in AI Features do not apply to the External AI Service you choose. That service’s terms, your plan and your settings govern the retention of conversations and MCP results within it and any use of data by its provider.
6. PURPOSES OF PROCESSING PERSONAL DATA
We process your personal data for the following purposes:
providing access to the Service and its features;
creating and administering your account;
processing payments and managing subscriptions;
communicating with you about the Service, technical support and updates;
sending marketing communications with your consent;
personalizing and improving the quality of the Service;
analytics and improvement of the Service;
promoting our services and measuring advertising effectiveness as described in Section 12;
complying with legal obligations under Ukrainian law;
preventing fraud and abuse, and maintaining the security of the Platform;
investigating and responding to security incidents;
internal audits and compliance;
defending against claims and legal proceedings, and collecting supporting evidence;
research and development to improve the AI system, without using user Content to train models;
protecting the Company’s legitimate interests.
7. SHARING DATA WITH THIRD PARTIES
We may share your personal data with third parties in the following circumstances:
7.1. Service providers
To provide the Service, we use service providers and may engage contractors as needed, including:
payment providers, to process payments;
CRM systems, to manage customer relationships;
email services, to send communications;
analytics and advertising service providers, including Google for Google Analytics 4 and Meta for Meta Pixel, to analyze Website visits and measure advertising effectiveness as described in Section 12;
CookieYes Limited, to manage users’ cookie choices and retain records of those choices as described in Section 12;
hosting providers and providers of cloud infrastructure, authentication, search and monitoring services, including Microsoft Azure and Microsoft Entra for the MCP Connector, to process data, verify access and operate the Service;
technical contractors, if we engage them to maintain or support the Service.
Service providers and any contractors we engage receive access to personal data only to the extent necessary for their tasks. Where they process data on our behalf, before granting access we ensure that they are contractually bound to maintain confidentiality, protect the data and process it only on our instructions, without using it for their own purposes, except as provided by law. Processing by the payment provider is also governed by its own privacy policy, as stated in Section 4.3.
7.2. Employers of B2B users
If your employer, such as a law firm, company or organization, provides your access to the Service, we may share certain information about your use of the Service with your employer for internal audit and compliance purposes, including metadata about your activity in the system.
7.3. Law enforcement and public authorities
We may disclose your personal data at the request of competent authorities in the circumstances provided for by Ukrainian law.
7.4. Protection of rights
We may disclose personal data where necessary to protect our lawful rights and interests or the rights of third parties.
7.5. External AI Services you choose
When you use the MCP Connector, Mitralex returns the result of the call to the External AI Service from which the request originated. That service and its provider receive the relevant results and process them under their own terms and privacy policy. Connecting the service does not, by itself, make the External AI Service provider our technical contractor. Review its data processing practices before connecting it.
8. INTERNATIONAL DATA TRANSFERS
Because we use technology services and cloud infrastructure from AWS, Microsoft Azure, Google, OpenAI, Anthropic and Meta, your personal data may be transferred outside Ukraine, including to European Union countries and the United States.
These transfers are made in accordance with Article 29 of the Law of Ukraine “On Personal Data Protection” to countries that ensure an adequate level of personal data protection, namely:
member states of the European Economic Area;
countries that have signed the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data;
countries whose capital market regulators are signatories to the IOSCO Multilateral Memorandum of Understanding, including the United States.
We also protect your data by using providers that comply with international data protection standards.
Personal data is not transferred for any purpose other than the purpose for which it was collected.
For an External AI Service you choose independently, its provider determines the processing locations and international transfer arrangements. The location of Mitralex’s infrastructure does not, by itself, restrict the countries in which that service processes data.
9. DATA RETENTION
We retain your personal data for as long as necessary to achieve the purposes for which it was collected, or for the period required by Ukrainian law.
In particular:
account data is retained for as long as the account is in use; deletion requests are handled under Section 11.1. Certain financial and other records whose retention is reasonably necessary are retained only on the grounds and for the periods set out below;
financial data is retained as required by tax and accounting laws, generally for at least 7 years;
Platform log files and technical data, other than the MCP categories, Google Analytics 4 data and CookieYes cookie-choice records listed below, are retained for up to 12 months from collection;
retention of user-level and event-level data in Google Analytics 4 is configured for 14 months, without resetting that period upon new activity. After the period expires, Google deletes the relevant data through its regular deletion cycle. This setting does not limit retention of standard aggregated Google Analytics reports;
CookieYes records of cookie choices are retained to store and apply your choices and to record consent, where given, rejection and subsequent changes to your choices for as long as necessary for those purposes, within the retention limits of our CookieYes plan. The lifetimes of the cookies themselves are listed in the separate Cookie Policy available through the cookie management interface. A cookie’s lifetime is not the retention period for all data collected through it;
technical records of MCP requests, errors and interactions between components are retained for up to 90 days from creation, including any archival retention;
MCP usage-limit records in the counter store are retained for up to 24 hours;
sign-in and authorization logs and other technical copies relating to MCP are retained for the periods necessary to provide access, maintain security and investigate incidents, in accordance with the retention settings of the authentication systems and infrastructure.
data for marketing communications is retained until you withdraw your consent;
data needed to defend against claims is retained for the limitation period prescribed by law.
At the end of the retention period, personal data is destroyed or anonymized.
Residual personal data in backups, if such backups are created, is deleted or overwritten in accordance with the established backup rotation cycle. Until deletion, access is restricted and the data is not used in the ordinary provision of the Service. If data is restored following a failure, previously received deletion requests are reapplied.
10. PERSONAL DATA SECURITY
We take organizational and technical measures to protect your personal data against unauthorized access, accidental loss, destruction or damage:
encrypting data in transit and at rest;
restricting access to personal data to authorized persons who need it to perform their employment or contractual duties;
regularly backing up data;
using firewalls and antivirus protection;
maintaining log files to detect and investigate security incidents;
training employees on personal data protection;
regularly reviewing and improving security measures.
Despite these measures, no method of transmission over the internet or data storage is completely secure. If we become aware of a personal data breach, we will notify you and the relevant authorities as required by law.
11. DATA SUBJECT RIGHTS
Under the Law of Ukraine “On Personal Data Protection”, you have the following rights:
the right to know the sources from which your personal data is collected, where it is held and the purposes of its processing;
the right to access your personal data;
the right to receive information about the conditions under which access to your personal data is granted, including information about third parties to whom your data is disclosed;
the right to receive a response, no later than 30 calendar days after receipt of your request, confirming whether your personal data is being processed, and to receive the content of that data;
the right to object by submitting a reasoned request objecting to the processing of your personal data;
the right to rectification or destruction by submitting a reasoned request to rectify or destroy your personal data if it is processed unlawfully or is inaccurate;
the right to protection of your personal data against unlawful processing and accidental loss, destruction or damage;
the right to lodge a complaint about the processing of your personal data with the Ukrainian Parliament Commissioner for Human Rights or a court;
the right to place conditions on the scope of permitted processing of your personal data when giving consent;
the right to withdraw consent to the processing of your personal data;
the right to know how your personal data is processed automatically;
the right to protection against an automated decision that has legal consequences for you.
To exercise your rights, please contact us using the details in this Policy.
11.1. Deletion of your account and personal data
You may request deletion of your account and the associated personal data by emailing info@mitralex.com. If necessary, we will promptly ask for the minimum information needed to verify that the request comes from the account holder.
We delete or irreversibly anonymize the relevant data in active systems within 30 calendar days of receiving the request, unless applicable law requires us to fulfill it sooner.
Certain data may be retained for longer only to the extent necessary and on a lawful basis to comply with legal obligations, investigate a specific security incident or protect rights in a specific dispute. Such records and backups are retained on the grounds and for the periods set out in Section 9, and are used only for those purposes. We notify the user when the request has been fulfilled or explain why it cannot be fulfilled in full. If any records are retained, we state the reason and the period or criteria for their continued retention.
Disconnecting the MCP Connector in an External AI Service is not a request to delete your Mitralex account. Deleting your Mitralex account does not automatically delete conversations or previously transmitted results in an External AI Service. To manage them, use the tools and procedures provided by that service’s provider.
12. COOKIES AND SIMILAR TECHNOLOGIES
The analytics and advertising technologies and cookie management interface described below are used on the public Website at www.mitralex.com. This approach to the use of analytics and advertising technologies does not extend to the separate account application or the MCP Connector.
For visitors in Ukraine, analytics and advertising technologies are enabled by default unless a rejection has previously been saved. You may disable them at any time through the cookie management interface.
For visitors in other countries, or where the country cannot be determined, these technologies remain disabled until the relevant consent has been obtained.
12.1. Strictly necessary technologies
We use strictly necessary cookies and similar technologies to operate and secure the Website and Platform, maintain user sessions, prevent fraud and unauthorized access, implement settings or functionality expressly requested by the user, and remember cookie choices.
These technologies are not used for analytics or advertising. They remain enabled regardless of choices regarding non-essential cookies where they are needed for the Website or functionality you expressly request to work.
12.2. Analytics technologies
In accordance with the approach described in this Section, we use Google Analytics 4, provided by Google, to analyze Website visits, performance and user interactions, and to improve our services. Analytics may cover technical information about browsers and devices, page views, referral sources and interactions with the Website.
12.3. Advertising technologies
In accordance with the approach described in this Section, we use Meta Pixel, provided by Meta, to measure interactions with the Website, evaluate the effectiveness of Mitralex advertising, and attribute visits and conversions to marketing sources.
Activation of analytics and advertising technologies depends on the regional approach described above and your saved choices. They may transmit technical information about your browser and device, referral source and interactions with the Website to Google or Meta. Processing by these providers is also governed by their respective terms and privacy policies.
12.4. Managing cookie choices
We use CookieYes, provided by CookieYes Limited, to display the cookie notice and preferences, store your choices and manage the relevant Website technologies.
The banner for visitors in Ukraine allows you to leave analytics and advertising technologies enabled or disable them. For visitors in other countries, or where the country cannot be determined, the interface allows you to consent to non-essential cookies or reject them. Closing the banner, scrolling or continuing to use the Website does not constitute consent and does not change the current settings. A previously saved rejection remains in effect. Strictly necessary technologies remain available as described in Section 12.1.
12.5. Google Consent Mode
We use Google Consent Mode together with CookieYes to communicate settings to Google technologies in accordance with the approach described in this Section and your choices. Google Consent Mode does not, by itself, constitute user consent or establish a legal basis for processing personal data.
12.6. Changing your choices
You may change your choices regarding non-essential cookies at any time, including rejecting them or withdrawing previously given consent, using the persistent cookie management button on the Website, which reopens CookieYes preferences. After you opt out, we stop further analytics and advertising tracking by the relevant technologies. This does not, by itself, delete data already transmitted. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Rejecting non-essential cookies does not prevent access to the core functions of the Service.
You may also configure your browser to block or delete cookies. Blocking strictly necessary technologies may affect certain Website or Platform functions.
12.7. Cookie Policy
Details of the cookies and similar technologies used on the Website, their categories, purposes and lifetimes are set out in the separate Cookie Policy available through the cookie management interface. We update it when the technologies we use change. Retention of analytics data and records of cookie choices is described in Section 9.
13. AGE RESTRICTIONS
Our Service is intended exclusively for professional use by legal professionals, attorneys and accountants. The Service is not intended for anyone under the age of 18.
We do not knowingly collect personal data from minors. If you become aware that a minor has registered on our Platform, please notify us immediately.
14. MARKETING COMMUNICATIONS
We may send you marketing emails with your consent. You can opt out of these communications at any time by:
clicking the unsubscribe link in an email;
changing your account settings;
contacting us using the details below.
Opting out of marketing communications does not affect service-related messages concerning the operation of your account and the provision of services.
15. LINKS TO THIRD-PARTY WEBSITES
Our Website may contain links to third-party websites. We are not responsible for their privacy policies or personal data processing practices. We recommend reviewing the privacy policy of each third-party website before providing it with your personal data.
16. CHANGES TO THIS POLICY
We may update this Policy from time to time to reflect changes in our data processing practices or legal requirements.
We will notify you of material changes by:
publishing the updated Policy on the Website with the date of the update;
sending a notice to your email address, if available.
We recommend reviewing this Policy periodically to stay informed about how your personal data is processed.
This Policy is written in Ukrainian and translated into English. If the language versions differ, the Ukrainian version prevails. This provision does not limit any rights of the user that cannot be limited under applicable law.
17. CONSENT
When registering an account on the Platform, you confirm that:
you have read this Privacy Policy;
where consent is the legal basis for processing, you consent to the processing of your personal data on the terms set out in this Policy;
you have been informed of the procedures, purposes and other conditions for processing personal data in accordance with Articles 6, 8, 10 and 11 of the Law of Ukraine “On Personal Data Protection”;
you have full legal capacity to give such consent.
You acknowledge that you have read the Policy and give consent, where required, by selecting the relevant checkbox when registering your account. This does not constitute consent to non-essential cookies, analytics or advertising technologies. Connecting the MCP Connector to an existing account does not replace this process. Managing connector permissions in an External AI Service is separate from accepting Mitralex’s legal documents.
Where the use of non-essential cookies, analytics or advertising technologies requires your consent, it is requested separately through the interface described in Section 12. Registering an account, accepting the Terms or acknowledging this Policy does not, by itself, constitute such consent.
You may refuse non-essential cookies or later withdraw consent without withdrawing your acceptance of the Terms or requesting deletion of your account. Refusal does not, by itself, terminate or prevent access to the core Service. Particular optional functionality may be unavailable if it depends on a technology to which you have not consented. You can change your choices through the cookie management interface described in Section 12.6.
18. CONTACT INFORMATION
If you have questions about this Policy or the processing of your personal data, or wish to exercise your rights as a data subject, please contact us:
Data controller: Maksym Oleksiiovych Kobzov, sole proprietor
Address: Office 2, 17 Shchipnyi Lane, Odesa, Odesa Region, 65020, Ukraine
Email: info@mitralex.com
We will make every effort to review your request and respond as soon as possible.