1. Who is responsible for your data
The data controller for this platform is ILCI B.V., trading as the International Law Compliance Institute (internationallawcomplianceinstitute.org), a Dutch private limited company (besloten vennootschap) represented by Prof. Dr. Nikos Lavranos. Our registered office is Saenredamstraat 81, 2021 ZP Haarlem, the Netherlands. Chamber of Commerce (KvK) number 96043172, VAT number NL867445658B01.
For any privacy question or to exercise your data protection rights, contact us via the ILCI Contact page or by email at contact@internationallawcomplianceinstitute.org.
3. What data we process, why, and for how long
We only collect personal data needed to provide subscriptions, secure licensed reports, run AI search for subscribers, and maintain the investment-arbitration research database. Providing your name, email address, and payment details is required to enter into a subscription; without them we cannot create an account or grant access.
Account & team membership
- Data
- Name, email address, password hash (scrypt), account role, organisation name, team membership, and active session records (browser User-Agent and a salted SHA-256 hash of your IP address; raw IP addresses are never stored).
- Purpose
- Creating and securing your account, signing you in, and managing individual or team access.
- Legal basis
- Contract (Art. 6(1)(b) GDPR)
- Retention
- Kept while your account is active. Erased or anonymized immediately when you delete your account on /account.
Team invitations
- Data
- Invitee email address, organisation ID, inviter user ID, and invitation status (provided by the organisation owner).
- Purpose
- Sending a one-time invitation email so a colleague can join your organisation's subscription.
- Legal basis
- Contract & legitimate interest (Art. 6(1)(b) & (f) GDPR)
- Retention
- Invitation links expire after 3 days, and cancellation disables them. Invitation records and join tokens are deleted when the inviter or invitee deletes their account.
Subscriptions, payments & seat changes
- Data
- Organisation name, buyer email, plan, seat count, billing interval, amounts, and Mollie customer, subscription, and payment IDs. Payment card numbers and IBANs are processed directly by Mollie B.V. and never touch ILCI servers.
- Purpose
- Processing recurring subscription payments, prorated seat additions, refunds, and statutory tax accounting.
- Legal basis
- Contract (Art. 6(1)(b) GDPR) & legal obligation under Dutch tax law (Art. 6(1)(c) GDPR; Art. 52 AWR)
- Retention
- Financial ledger records are retained for 7 years as required by Dutch fiscal law. If a sole owner deletes their account, personal identifiers are replaced with anonymized placeholders.
Report reading, printing & watermarking
- Data
- Licence watermark on viewed/printed pages (your email, organisation name, and print date), plus an access log entry with timestamp, action (open or print), browser User-Agent, and a salted SHA-256 hash of your IP address (raw IP addresses are never stored).
- Purpose
- Delivering licensed reports, stamping personal print copies, and protecting copyright against unauthorised redistribution.
- Legal basis
- Contract & legitimate interest in copyright protection (Art. 6(1)(b) & (f) GDPR)
- Retention
- Kept while your account is active and deleted when your account is erased.
AI search & problem reports
- Data
- Questions you submit to AI search, the cited answer, thread ID (up to 4 follow-ups), token usage/cost, and optional problem reports (reason and note up to 500 characters). To answer, the AI provider receives your question, the earlier turns of the conversation, and case data from our database, which includes the names, nationalities and roles of arbitrators and counsel. Your account name, email address, user ID and IP address are not sent, but anything you type into a question is. Refused attempts by non-subscribers record only a daily count without question text.
- Purpose
- Generating cited answers from the ILCI database, reloading your conversation thread, enforcing daily quotas, and reviewing flagged answers.
- Legal basis
- Contract (Art. 6(1)(b) GDPR) & legitimate interest in quality control and quota enforcement (Art. 6(1)(f) GDPR)
- Retention
- A whole search thread is deleted by the scheduled purge after its latest answer is 365 days old, or immediately when you delete your account. Shared non-personal first-turn answer cache entries are purged after 30 days.
Security & rate limiting
- Data
- Short-lived counters keyed by a salted SHA-256 IP hash, email address, or user ID.
- Purpose
- Preventing brute-force sign-ins, sign-up/password-reset spam, and quota abuse.
- Legal basis
- Legitimate interest in platform security (Art. 6(1)(f) GDPR)
- Retention
- Fixed windows from 10 minutes to 24 hours; email and user keys are deleted on account erasure.
Public arbitration database (Art. 14 GDPR)
- Data
- Names, nationalities, roles (arbitrator, annulment committee member, counsel), and law firm affiliations compiled from published investment-treaty arbitration awards and institutional registries (ICSID, UNCITRAL, PCA, SCC). Parties appear in case names and case descriptions.
- Purpose
- Providing an accurate legal research database on investment-treaty arbitration and award compliance.
- Legal basis
- Legitimate interest in legal research, academic publishing, and transparency of international dispute settlement (Art. 6(1)(f) GDPR)
- Retention
- Part of the historical arbitration research corpus, subject to correction (Art. 16 GDPR) and objection (Art. 21 GDPR) requests.
4. Service providers (processors) and international transfers
We do not sell or rent personal data. We share data only with the service providers that run the platform:
- Hosting & storage: Hetzner Online GmbH (Germany, EU): Hosts the application server, the PostgreSQL database, and the report file storage, which is private and not reachable from the internet. Backups will be kept on a Hetzner Storage Box in Germany.
- Payments: Mollie B.V. (Amsterdam, Netherlands, EU): Processes checkout and recurring subscription payments. We send your organisation name and email address to create a Mollie customer record and receive payment status updates via webhook. The Mollie account is ILCI's own, and Mollie acts as an independent controller under its agreement with ILCI for payment execution and statutory anti-fraud / AML obligations.
- Transactional email: Resend (Plus Five Five, Inc.) (United States): Delivers plain-text account verification, password-reset, sign-in, team invitation, and billing notification emails. Open and click tracking pixels are disabled. Emails are sent from Resend's EU region, but Resend stores account data, email metadata and logs in the United States. This transfer is covered by Resend's Data Processing Addendum under the EU-US Data Privacy Framework (Art. 45 GDPR), with the 2021 EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) as a fallback.
- AI search: OpenRouter, Inc. (United States): Receives the question, the earlier turns of the conversation, and case data from our database (including the names, nationalities and roles of arbitrators and counsel) to generate cited answers, and routes them to a model host in the United States. Your account name, email address, user ID and IP address are not sent, but anything you type into a question is. This is a transfer outside the EEA, covered by OpenRouter's data processing agreement with the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
5. Cookies and browser storage
The platform uses strictly necessary functional storage only (exempt from consent banners under Art. 5(3) of the ePrivacy Directive and Art. 11.7a(3) of the Dutch Telecommunicatiewet):
better-auth.session_token (or __Secure-better-auth.session_token over HTTPS): HttpOnly, Secure, SameSite=Lax. Keeps you signed in for 7 days (extended daily while you are active) and is removed when you sign out.better-auth.session_data: A short-lived (5-minute) signed cookie cache that avoids repeated database lookups while you navigate between pages.sessionStorage ("ilci:ask:<threadId>"): Holds an in-progress AI search answer in your current browser tab so you can open a cited case and press Back without losing the answer. Cleared on sign-out or after 6 hours.
6. Your rights under the GDPR
Under Articles 15 to 22 of the GDPR, you have the right to:
- Access and portability (Arts. 15 & 20): Download a complete, machine-readable JSON copy of the personal data we hold about you directly via Download my data on your account page, or request a copy by contacting us.
- Rectification (Art. 16): Update your profile name directly on your account page, or ask us to correct inaccurate personal data, including if you are an arbitrator, counsel, or party named in our public arbitration database and wish to flag an inaccuracy.
- Erasure / “Right to be forgotten” (Art. 17): Delete your account directly on your account page or by contacting us. Deleting your account immediately wipes your name, email address, password hash, active sessions, pending invitations, AI search history, and reading logs, cancels any active sole-owner subscription, and retains only anonymized payment records required for 7 years under Dutch tax law (Art. 17(3)(b) GDPR).
- Restriction and objection (Arts. 18 & 21): Object to processing based on legitimate interest or request restriction while a concern is reviewed.
We do not use your personal data for automated decision-making or profiling (Art. 22 GDPR). We respond to all privacy requests within one month (Art. 12(3) GDPR).
If you believe our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the supervisory authority in the EU member state where you live or work.
