Privacy notice

In short

• The client and firm data you enter in the tools stays on this device. It is never sent to a server.
• The registers you choose to keep are encrypted in your browser with your passphrase. Avlex can neither read nor recover them.
• We process data about you only if you unlock the firm features or report a problem, and to the extent technically needed to run the site.
• Each type of communication requires a separate consent, which you can withdraw at any time. Unlocking does not depend on it.
• We do not sell any data.

Controller

Avlex Belgium SRL (Avlex), Boulevard de l'Empereur 10, 1000 Bruxelles, enterprise number 1036.582.778.

For any question about your data: legal@avlex.be.

Your clients' data stays on this device

What you enter in the tools (names of clients and parties, details of the matter, answers to the questions, options chosen) stays in the tab's memory. What you choose to keep is saved in your browser's storage, and nowhere else:

• your firm profile (name, address, bar, contact details, logo), in localStorage;
• the registers you save in the vault: AML file notes, the AI tools register, the conflict register and its check log, CPD entries, the GDPR record of processing.

This data is never sent to a server, neither to Avlex nor to any third party. Avlex therefore has no access to it: for that data, Avlex is neither a controller nor a processor. Your clients' data remains the sole responsibility of your firm. The only exception, and on your initiative: a problem report attaches the tool's non-personal options (see below).

The encrypted vault

• The registers are encrypted in your browser (AES-GCM, 256-bit key) before they are stored in this browser's IndexedDB database normalex-vault.
• The key is derived from your passphrase (PBKDF2-SHA-256, 600,000 iterations). Neither the passphrase nor the key ever leaves the device, and neither is ever stored.
• Avlex can neither read nor recover the vault. If you forget your passphrase, nobody can open it again, not even Avlex.
• The vault locks itself after 15 minutes without activity.
• You can export it to an encrypted backup file (.normalexvault) and import it again. The site keeps only the date of the last export (normalex.vault.backup), to remind you to make a new backup.
• The "Delete all local data" command erases the vault from this browser.
• The encryption protects against casual access to the browser's storage. It does not protect against malware installed on the device.

Check it yourself

1. Open your browser's developer tools (the F12 key, or Cmd+Option+I on a Mac), Network tab.
2. Use a tool: answer the questions, generate and export a document, save a register in the vault.
3. Go through the requests: none of them contains what you entered.

The meter in the header adds up every byte the page sends. It stays at 0 bytes while you type, generate documents or use the vault. Unlocking, a problem report and the usage counters, which are sent when you leave the page, do send data: the meter shows them too.

Data processed, purposes and legal bases

Unlocking the firm features

When you ask to unlock, our server passes your request to Avlex's contact registry, which Avlex's sites share. The registry processes:

• your e-mail address and the interface language;
• the tool from which you make the request;
• the date on which you confirmed your address;
• the issue of your licence (see below).

Avlex sends you the confirmation e-mail, through Resend. The link it contains is valid for 7 days.

Purpose: verifying your address, issuing the licence and checking that it is valid.

Legal basis: performance of the free service you request (GDPR, Article 6(1)(b)).

Your e-mail address is needed to unlock. Without it, the tools, their results, their documents and every export remain fully usable.

Licence

After confirmation, your browser keeps a signed licence in its local storage (localStorage). It contains a SHA-256 hash of your e-mail address (not the address itself), a licence identifier and its issue and expiry dates. It is valid for 12 months. Avlex's registry records that the licence was issued.

Every firm feature (the firm's letterhead, the vault, the "new client" pack) checks the licence in your browser, without sending anything.

Legal basis: performance of the free service you request (Article 6(1)(b)).

Communications you choose

When you unlock, or later, you can agree to each of the following communications separately. No box is pre-ticked, and unlocking does not depend on them.

Legal basis: your consent (Article 6(1)(a)). For advertising by e-mail, Article XII.13 of the Belgian Code of Economic Law also requires your prior consent.

Your phone number and preferred time for the call are only passed on if you accept the call. If you withdraw that consent, the number is erased.

Proof of your consent

For each consent, Avlex's registry records the date and time, the purpose, the exact version of the text you saw and the site of origin. It also records a salted hash (HMAC-SHA-256) of your IP address and of your browser's identifier (User-Agent). The IP address itself is not stored.

Legal bases:

• date, purpose and text version: the obligation to be able to demonstrate your consent (Article 7(1), with Article 6(1)(c));
• IP and browser hashes: our legitimate interest in proving that the confirmation is genuine and in detecting fraudulent requests (Article 6(1)(f)). The impact on your privacy is limited, since only hashes are kept.

Security and abuse prevention

Our server limits the rate of requests using a keyed hash (HMAC) of your IP address. This hash stays in working memory for the length of the rate-limit window, then disappears. Avlex's registry also sends at most three confirmation e-mails per address per 24 hours.

Instead of a CAPTCHA, the unlock form and the problem report form have your browser solve a small calculation (proof of work) set by our own server. The site loads no third-party script, no analytics and no tracking cookie.

Legal basis: our legitimate interest in protecting the service, and the people whose address might be entered without their knowledge (Article 6(1)(f)).

Optional profile fields

You can give your full name, profession, bar and firm size. These fields are optional. They help us understand who uses the tools and, if you have agreed to communications, tailor them to your profession. They are separate from the firm profile, which stays in your browser.

Legal basis: our legitimate interest (Article 6(1)(f)). You can object at any time.

E-mail preferences page

After unlocking, your browser keeps a preference token. The E-mail preferences page sends it in the body of the request, never in the address, to show and change your choices.

Legal basis: the obligation to make withdrawing consent as easy as giving it (Article 7(3), with Article 6(1)(c)).

Problem reports

Every tool has a "Report a problem" form. When you send it, we receive:

• the description you write;
• your e-mail address, if you choose to give it, used only to reply to you;
• the tool and page concerned, and the interface language;
• the date on which the rules applied were verified;
• the non-personal options you chose in the tool (for example the type of client or the language of the document); never names, never your clients' data, never the content of the vault.

The form asks you not to write names or case references. The report is sent as a single e-mail, through Resend, to Avlex's support team (support@avlex.be). The site keeps none of it. Your address is never added to Avlex's contact registry and never used for marketing.

Purpose: correcting the tools and, if you gave your address, replying to you.

Legal basis: our legitimate interest in correcting the tools (Article 6(1)(f)). The reply address is processed only if you give it, on your own initiative.

Usage counters

The site sends Avlex's registry aggregate counters per tool, for example the number of documents generated or the number of assessments per risk level. They are plain integers: they contain no content, no identifier and no cookie, and are linked to no person. They are not personal data.

The host's technical logs

As with any website, the host records technical logs when your browser requests a page: IP address, date and time, address requested, browser, response code. They are used for security and troubleshooting.

Legal basis: our legitimate interest in keeping the site running and secure (Article 6(1)(f)).

Recipients and processors

Your data is not sold or rented. It is processed by Avlex and by the following processors, bound by contract (Article 28):

The e-mails you agreed to are sent by Avlex. If Avlex uses a sending service for them, that service acts as a processor on the same terms.

Transfers outside the European Economic Area

The registry's database is hosted in the European Union. Supabase and Resend are companies established in the United States: access from outside the European Economic Area may occur, for example for technical support or to deliver the e-mails.

These transfers rely on the safeguards provided by the GDPR: the adequacy decision on the EU-US Data Privacy Framework, for companies that participate in it (Article 45), and/or the European Commission's standard contractual clauses (Article 46(2)(c)). You can obtain a copy by writing to legal@avlex.be.

Retention periods

• Confirmation link: valid for 7 days. A request that is never confirmed is deleted after 30 days.
• Consent: lapses after 36 months without interaction. Interactions are: a confirmation, a change to your preferences and an unlock. Merely submitting the unlock form is not one.
• No active consent left (withdrawn or lapsed): your data is deleted 5 years after the last consent event or interaction. Until then, it is kept as proof in case of a complaint or a claim (Article 6(1)(f)).
• Verified address with no consent at all (unlock only): deleted 12 months after the last interaction, and not before 12 months after your last licence ended.
• Erasure: a permanent deletion. A hash of your address stays on a suppression list, so that your opt-out continues to be honoured.
• Problem reports: in Avlex's support mailbox, only as long as needed to handle the report. The site keeps none of it.
• Rate limiting: in working memory, for the length of the window.
• Host's logs: a short period set by the host for security and troubleshooting, then deleted.
• Firm profile and vault: in your browser only, until you delete them. Avlex keeps none of it.

Your rights

At any time, you can:

• access your data (Article 15) and have it corrected (Article 16);
• have it erased (Article 17) or have its processing restricted (Article 18);
• receive the data you provided in a structured format (portability, Article 20);
• object to processing based on our legitimate interest (Article 21);
• withdraw your consent, without affecting the lawfulness of processing before the withdrawal (Article 7(3)).

To withdraw a consent: use the E-mail preferences page, from the browser in which you unlocked the firm features; the unsubscribe link in every e-mail; or a message to legal@avlex.be.

For your other rights: write to legal@avlex.be. We reply within one month (Article 12(3)). We may ask you to confirm that the address concerned is yours. The data you keep in your browser (firm profile, vault) never reaches us: you view and delete it yourself, on your device.

Complaints: you can contact the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, dataprotectionauthority.be.

Automated decisions

No decision producing legal effects concerning you, or similarly significantly affecting you, is taken solely on the basis of automated processing (Article 22). The assessments the tools suggest (for example an AML risk level) are calculated in your browser and remain subject to your judgement as a lawyer.

Changes

We may update this notice. The date of the last update is shown on this page. We announce significant changes on the site. Any new use based on consent will require a new consent.