GDPR Compliance and Data Privacy Policy

Data Processing: All data processed within the EU (Helsinki and Nuremberg, Hetzner data centres). Retention: Uploaded documents 90 days after processing, analysis results for subscription duration +30 days, account data until deletion +30 days. Your GDPR Rights: Access, correction, deletion (right to be forgotten), export, object to processing. DPA: Standard Data Processing Agreement available - contact legal@bluenotelogic.com. Encryption: TLS 1.3 in transit, AES-256 at rest. Data Isolation: Each client has isolated vector collections, strict tenant isolation at database level.