Privacy notice

In short

• Your documents are never collected. They are processed in your browser.
• We process data about you only if you unlock the AI features, and to the extent technically needed to run the site.
• Each type of communication requires a separate consent, which you can withdraw at any time.
• We do not sell any data.

Controller

Avlex Belgium SRL (Avlex), Boulevard de l'Empereur 10, 1000 Bruxelles, enterprise number 1036.582.778.

For any question about your data: legal@avlex.be.

Your documents are never collected

Documents, extracted text, detected data and restore keys are processed only in your browser. They are not sent to Avlex or to any third party, including when you use the AI features, which run on your device.

Avlex therefore has no access to the personal data contained in your documents. For that data, Avlex is neither a controller nor a processor. See the Security page.

Data processed, purposes and legal bases

Unlocking the AI features

When you ask to unlock, we process:

• your e-mail address and the language you chose;
• the page your request came from and, where applicable, the campaign parameters in its address (utm);
• the date on which you confirmed your address;
• your licence data: identifier, expiry date (12 months), status (active, expired or revoked), and a SHA-256 hash of your e-mail address, which is included in the licence.

Purpose: verifying your address, issuing the licence and checking that it is valid.

Legal basis: performance of the free service you request (GDPR, Article 6(1)(b)).

Your e-mail address is needed to unlock. Without it, the core of the tool remains fully usable.

Licence checks when downloading AI files

When your browser downloads an AI model file or OCR data, it sends your licence. Our server checks its signature and asks Avlex's registry whether it is active. Downloads are counted per day to apply a daily limit.

Legal basis: performance of the service (Article 6(1)(b)) and our legitimate interest in preventing licences from being shared or circumvented (Article 6(1)(f)).

Communications you choose

When you unlock, or later in the tool, you can agree to each of the following communications separately. No box is pre-ticked, and unlocking does not depend on them.

Legal basis: your consent (Article 6(1)(a)). For advertising by e-mail, Article XII.13 of the Belgian Code of Economic Law also requires your prior consent.

Your phone number and preferred time slot are only passed on if you accept the call. If you withdraw that consent, the number is erased.

Proof of your consent

For each consent, Avlex's registry records the date and time, the purpose, the exact version of the text you saw and the site of origin. It also records a salted hash (HMAC-SHA-256) of your IP address and of your browser's identifier (User-Agent). The IP address itself is not stored.

Legal bases:

• date, purpose and text version: the obligation to be able to demonstrate your consent (Article 7(1), with Article 6(1)(c));
• IP and browser hashes: our legitimate interest in proving that the confirmation is genuine and in detecting fraudulent requests (Article 6(1)(f)). The impact on your privacy is limited, since only hashes are kept.

Security and abuse prevention

Our server limits the rate of requests using a keyed hash of your IP address. This hash stays in working memory for the length of the rate-limit window, then disappears. Avlex's registry also sends at most three confirmation e-mails per address per 24 hours.

Legal basis: our legitimate interest in protecting the service, and the people whose address might be entered without their knowledge (Article 6(1)(f)).

Optional profile fields

You can give your name, profession, bar and firm size. These fields are optional. They help us understand who uses the tool and, if you have agreed to communications, tailor them to your profession.

Legal basis: our legitimate interest (Article 6(1)(f)). You can object at any time.

Preferences page

After unlocking, your browser keeps a preference token. The Preferences page sends it in the body of the request, never in the address, to show and change your choices.

Legal basis: the obligation to make withdrawing consent as easy as giving it (Article 7(3), with Article 6(1)(c)).

Usage counters

The site sends aggregate counters, for example the number of documents processed per format. They contain no content, no identifier and no cookie, and are linked to no person. They are not personal data. The Chrome extension sends none.

The host's technical logs

As with any website, the host records technical logs when your browser requests a page: IP address, date and time, address requested, browser, response code. They are used for security and troubleshooting.

Legal basis: our legitimate interest in keeping the site running and secure (Article 6(1)(f)).

Chrome extension

The Localex extension for Google Chrome processes your documents as the website does: on your computer, without sending them.

• What it sends: only the unlock form, when you send it, and your licence, when the AI files are downloaded. These data are processed as described above, for the same purposes and on the same legal bases. It sends no usage counters.
• The licence: after your address is confirmed, the website's page hands the licence to the extension, inside your browser. When it cannot, it shows an activation code, which you paste into the extension.
• What it keeps, in your browser: the licence and the preferences token, your settings (theme, language, firm profiles), the downloaded AI files, and the number of documents processed, without their content or name, used to show the unlock offer once. Everything is deleted when you uninstall the extension.
• Permissions: storage, and unlimited storage so that Chrome does not delete the AI model. The extension has no access to any website or tab.

The data the extension receives are used only to provide its function: pseudonymising your documents. They are not sold, not passed to third parties other than the processors below, and not used for advertising or to assess creditworthiness. Avlex commits to their use following the Chrome Web Store User Data Policy, including its Limited Use requirements.

Recipients and processors

Your data is not sold or rented. It is processed by Avlex and by the following processors, bound by contract (Article 28):

The e-mails you agreed to are sent by Avlex. If Avlex uses a sending service for them, that service acts as a processor on the same terms.

Transfers outside the European Economic Area

The registry's database is hosted in the European Union. Supabase and Resend are companies established in the United States: access from outside the European Economic Area may occur, for example for technical support or to deliver the confirmation e-mail.

These transfers rely on the safeguards provided by the GDPR: the adequacy decision on the EU-US Data Privacy Framework, for companies that participate in it (Article 45), and/or the European Commission's standard contractual clauses (Article 46(2)(c)). You can obtain a copy by writing to legal@avlex.be.

Retention periods

• Confirmation link: valid for 7 days. A request that is never confirmed is deleted after 30 days.
• Consent: lapses after 36 months without interaction. Interactions are: a confirmation, a change to your preferences, an unlock and a download of an AI file (counted at most once a day). Merely submitting the unlock form is not one.
• No active consent left (withdrawn or lapsed): your data is deleted 5 years after the last consent event or interaction. Until then, it is kept as proof in case of a complaint or a claim (Article 6(1)(f)).
• Verified address with no consent at all (unlock only): deleted 12 months after the last interaction, and not before 12 months after your last licence ended.
• Erasure: a permanent deletion. A hash of your address stays on a suppression list, so that your opt-out continues to be honoured.
• Rate limiting: in working memory, for the length of the window.
• Host's logs: a short period set by the host for security and troubleshooting, then deleted.

Your rights

At any time, you can:

• access your data (Article 15) and have it corrected (Article 16);
• have it erased (Article 17) or have its processing restricted (Article 18);
• receive the data you provided in a structured format (portability, Article 20);
• object to processing based on our legitimate interest (Article 21);
• withdraw your consent, without affecting the lawfulness of processing before the withdrawal (Article 7(3)).

To withdraw a consent: use the Preferences page, from the browser in which you unlocked the tool; the unsubscribe link in every e-mail; or a message to legal@avlex.be.

For your other rights: write to legal@avlex.be. We reply within one month (Article 12(3)). We may ask you to confirm that the address concerned is yours.

Complaints: you can contact the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, dataprotectionauthority.be.

Automated decisions

No decision producing legal effects concerning you, or similarly significantly affecting you, is taken solely on the basis of automated processing (Article 22).

Changes

We may update this notice. The date of the last update is shown on this page. We announce significant changes on the site. Any new use based on consent will require a new consent.