Privacy Policy

Last updated: October 28, 2026

1. Controller

Oscar Rojas
Alt-Mariendorf 50
12107 Berlin, Germany
Email: contact@klarlaw.de

2. What we collect and why

When you submit our contact form, we process the data you provide: your name, email address, phone number, city, the category of your legal need, how urgent it is, your optional description of what happened, and any document you choose to upload. We use this data to understand your request and connect you with a suitable English-speaking German lawyer (Art. 6(1)(b) GDPR — steps prior to entering into a contract, taken at your request).

If your request is about a rental deposit, you can also tell us your landlord's name, postal address and email and the address of the flat. We share these only with the lawyer who takes your case, so they can write to your landlord, and we delete them together with your request (Art. 6(1)(b) GDPR for your details; Art. 6(1)(f) GDPR for your landlord's — your legitimate interest in getting your deposit back).

With your request we also store how you reached our form: the page you submitted it from, the name of the website that linked there (for example a search engine, but never the full address you came from), and any campaign label in our own link (such as "reddit"). This uses no cookies. After you confirm your email we may also ask how you found us; answering is optional, and we store your answer with your request. The same applies to lawyers who apply through our page for lawyers. We use this only in aggregate, to see which channels bring people to us (Art. 6(1)(f) GDPR — our legitimate interest in understanding and improving how people find the service).

When you use the guide search on our home page, we store the words you type and which guides matched, to see which topics people look for. We store no IP address, cookie or other link to you, and delete searches after 6 months (Art. 6(1)(f) GDPR — our legitimate interest in writing the guides people need).

Your description and uploaded documents may reveal sensitive information — for example about alleged criminal offences. We process such details only because you choose to share them with us for the purpose of finding you a lawyer (Art. 9(2)(a) GDPR — explicit consent expressed by submitting them). Share only what you're comfortable with; a rough idea of your situation is enough.

3. Email verification

After you submit the form, we email you a 6-digit verification code, which you enter on the page where you submitted. We only begin processing your case once your email address is confirmed this way. This protects you from someone submitting a request in your name, and us from processing data of people who never asked (Art. 6(1)(f) GDPR — legitimate interest in verified requests).

3b. ChatGPT connection

If you connect Klarlaw to ChatGPT, we verify your email with a code entered on Klarlaw and create a client connection. ChatGPT can send the intake fields you choose to share, save a draft, submit a version you approve on Klarlaw, and retrieve limited progress for requests made through that connection. We do not request your entire chat history. Do not put email codes or documents in plugin calls; enter codes and upload documents on Klarlaw.

Unsubmitted drafts expire after 24 hours and are removed by hourly cleanup. On submission we remove the separate draft copy of your intake fields; the request follows the retention rules below. We retain the submitted revision, sharing-authorization version and timestamp, and retry receipt for up to 365 days. Email-code records expire after 15 minutes and are removed by cleanup. Access credentials are stored as hashes. Your client connection remains until you request its deletion. You can revoke assistant access on the connection page; this does not close your submitted cases. ChatGPT's handling of information in your conversations is governed by its own settings and policies. No analytics are loaded on Klarlaw's plugin workflow pages.

3a. Automated pre-assessment (AI)

After you confirm your email, an AI system (Claude, operated via Amazon Web Services and processed within the European Union) writes a short summary of your request and assesses how clearly the situation is described, so lawyers can review cases efficiently (Art. 6(1)(b) and 6(1)(f) GDPR). The AI never receives your name, email address, or phone number, nor anything in your case file, and your data is not used to train AI models. This assessment alone never rejects your request: if it flags a request as unclear, a human reviews it before any decision, and every update email we send lets you reply to request human review (Art. 22(3) GDPR safeguards).

4. Who we share it with

We share your request — including your description and any uploaded document — with the independent lawyer(s) we match you with, so they can assess and take on your case. We do not sell your data, and we do not share it with anyone else except our technical service providers (hosting by Hetzner in Germany; email delivery and our mailbox, which receives replies to our emails, by mailbox.org in Germany) bound by data processing agreements (Art. 28 GDPR).

4a. Your case file

Once a lawyer takes your request, you can use a case file with them on Klarlaw (Terms, section 4a). Using it is optional. For what you and your lawyer put into it — notes and documents — your lawyer is the controller and Klarlaw processes it on their behalf as their service provider (Art. 28 GDPR, § 43e BRAO), only as far as needed to run the case file. We open it only after you agree on your case page, and we record when you agreed and to which version of the terms. The fact and date of contact attempts and status changes on your case remain our own records (Art. 6(1)(b) and 6(1)(f) GDPR).

When something is added, we email the other side that there is something new, without its content. If your lawyer hands your case back and another lawyer takes it, the new lawyer does not see what was written while the previous one held it, and we ask for your agreement again. No AI processes the content of your case file.

5. Hosting and log files

Our website, application database and uploaded documents are hosted by Hetzner Online GmbH in Germany, within the European Union. Besides its data processing agreement, Hetzner is bound to professional secrecy under § 203 StGB by a separate agreement. We back them up daily; no backup is kept for longer than 30 days, so data we delete is gone from the backups within 30 days.

Our web server processes technical data (IP address, timestamps, requested pages, browser information) in server logs to provide the site securely and detect abuse (Art. 6(1)(f) GDPR). Log files are retained for a maximum of 30 days unless needed as evidence of an attack.

6. Cookies and analytics

We use only functional cookies that the site needs to work, such as protecting forms against misuse and keeping you signed in to your case page. We use no advertising or tracking cookies, so no consent banner is required. YouTube videos load only if you press play (see 6b).

For aggregate visitor statistics we use Plausible Analytics (data policy), a privacy-friendly, EU-based service that uses no cookies and stores no personal data — we see counts like page views and referrers, never individuals (Art. 6(1)(f) GDPR). Analytics is not loaded on any page that handles your case data.

6a. Marketing emails (only if you ask)

If you opt in, we email you occasional tips on other legal problems in Germany, and offers from our partners. You can unsubscribe at any time.

6b. YouTube videos (only if you press play)

Some guides include a short video from our YouTube channel. Nothing loads from YouTube until you press play; before that you see a still image we host ourselves. When you press play, the video loads from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in privacy-enhanced mode. Google then receives your IP address, browser information and the page you are on, and YouTube may store information on your device. Google may process this data in the USA; it is certified under the EU-US Data Privacy Framework. The legal basis is your consent when you press play (Art. 6(1)(a) GDPR, § 25(1) TDDDG). We don't remember your choice, so each video asks again. Google's privacy policy: policies.google.com/privacy.

7. How long we keep your data

If you never confirm your email address, your request is deleted after 30 days. Confirmed requests, including the case file and its documents, are kept while your matching is active and deleted 12 months after your case is closed, unless statutory retention duties (§ 147 AO, § 257 HGB) require longer storage of individual records. A case closes when you or your lawyer close it, automatically 30 days after its matching window if no lawyer took it, or six months after the last activity on it. You can request earlier deletion at any time.

8. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future. To exercise any right, email contact@klarlaw.de. You also have the right to lodge a complaint with a supervisory authority — for Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit.

9. Lawyers we write to by post

To invite lawyers to join Klarlaw, we write to some of them once, by post. For this we process a lawyer's name and academic title, firm, office address, practice area, bar association, and a note of where their firm says it works in English. We take these details from public sources, such as the legal notice (Impressum) on the firm's website, and name the source in the letter. We process them only to send that one letter, based on our legitimate interest in direct marketing (Art. 6(1)(f) GDPR). We don't email or call lawyers for this. The letter is printed and posted for us by LetterXpress (A&O Fischer GmbH & Co. KG, Winsen (Luhe), Germany), which processes the name and address only on our instructions under a data processing agreement (Art. 28 GDPR). We don't share these details with anyone else.

We delete these details six months after the letter, or straight away if the lawyer objects. To keep our promise of a single letter, and to respect an objection, we keep only a one-way hash of the name and postcode, and of the firm and postcode. It can't be turned back into those details, but it lets us recognise the same lawyer or firm if they come up again. Lawyers can object at any time by writing to contact@klarlaw.de (Art. 21(2) GDPR); the other rights in section 8 apply as well.

10. Lawyers on Klarlaw

If you apply to or take part in Klarlaw as a lawyer, we process:

  • Your application and profile: name, email, phone, firm, city, bar registration, practice areas and languages, and how you found us (for example the campaign or partner link you came through).
  • Your account and contract: your login (the password only as a secure hash), when you accepted which version of the participation terms, your plan (price, monthly or yearly payment, start and end dates), and the name and address for your invoices.
  • Invoices and payments: the invoices we issue to you and whether they have been paid.
  • Your activity on requests: which requests we sent you, and whether you opened, took, passed on, released or closed them, with the contact records you add; and whether clients tell us that you reached them.

We use this to run your participation: to send you requests, to give you access to the cases you take, to invoice the plan, and to keep the service reliable for clients, as the participation terms describe (Art. 6(1)(b) GDPR). We keep invoices because tax law requires it (Art. 6(1)(c) GDPR). We note how you found us, and check that our emails reach you, in our legitimate interest in running and improving the platform (Art. 6(1)(f) GDPR).

Your data is hosted by Hetzner in Germany; our emails are sent through mailbox.org in Germany, where our mailbox, including the list we use to write to participating lawyers, is too. Both work for us under data processing agreements (Art. 28 GDPR). When you take a request, the client learns your name. We pass invoice data to tax advisors or authorities only where the law requires it.

Your activity on a request is deleted together with that request (see section 7). Invoices are kept for as long as tax law requires, currently eight years (§ 147 AO, § 14b UStG). Everything else is deleted when your participation has ended and it is no longer needed for claims under the contract: at the latest three years after the end of the year in which your participation ended. Your rights under section 8 apply in full. The data of clients in requests and case files is covered by the participation terms, not by this section.

11. Changes

We will update this policy when our processing changes and indicate the date of the latest revision above.