LegalPrivacy Policy

How we handle personal data on the ILCI research platform, explained in plain language in accordance with the EU General Data Protection Regulation (GDPR) and Dutch law.

Last updated: 14 October 2026

1. Who is responsible for your data

The data controller for this platform is the International Law Compliance Institute (ILCI), represented by Prof. Dr. Nikos Lavranos, established in the Netherlands (internationallawcomplianceinstitute.org).

For any privacy question or to exercise your data protection rights, contact us via the ILCI Contact page.

2. Summary at a glance

No tracking or advertising cookies: We do not use analytics cookies, advertising pixels, or third-party scripts. Fonts and the PDF reader run from our own server.
EU hosting: The platform database and report files are hosted in the European Union (Hetzner Online GmbH).
Private AI search: When you ask an AI question, your name, email address, user ID, and IP address are never sent to the AI model provider, and our provider contract prohibits training on your questions. A search thread is scheduled for deletion 365 days after its latest answer.
Self-service deletion: You can delete your account at any time from your account page.

3. What data we process, why, and for how long

We only collect personal data needed to provide subscriptions, secure licensed reports, run AI search for subscribers, and maintain the investment-arbitration research database. Providing your name, email address, and payment details is required to enter into a subscription; without them we cannot create an account or grant access.

Account & team membership

Data: Name, email address, password hash (scrypt), account role, organisation name, and team membership.
Purpose: Creating and securing your account, signing you in, and managing individual or team access.
Legal basis: Contract (Art. 6(1)(b) GDPR)
Retention: Kept while your account is active. Erased or anonymized immediately when you delete your account on /account.

Team invitations

Data: Invitee email address, organisation ID, inviter user ID, and invitation status (provided by the organisation owner).
Purpose: Sending a one-time invitation email so a colleague can join your organisation's subscription.
Legal basis: Contract & legitimate interest (Art. 6(1)(b) & (f) GDPR)
Retention: Invitation links expire after 3 days, and cancellation disables them. Expired or cancelled invitation records remain until the inviter or invitee deletes their account.

Subscriptions, payments & seat changes

Data: Organisation name, buyer email, plan, seat count, billing interval, amounts, and Mollie customer, subscription, and payment IDs. Payment card numbers and IBANs are processed directly by Mollie B.V. and never touch ILCI servers.
Purpose: Processing recurring subscription payments, prorated seat additions, refunds, and statutory tax accounting.
Legal basis: Contract (Art. 6(1)(b) GDPR) & legal obligation under Dutch tax law (Art. 6(1)(c) GDPR; Art. 52 AWR)
Retention: Financial ledger records are retained for 7 years as required by Dutch fiscal law. If a sole owner deletes their account, personal identifiers are replaced with anonymized placeholders.

Report reading, printing & watermarking

Data: Licence watermark on viewed/printed pages (your email, organisation name, and print date), plus an access log entry with timestamp, action (open or print), browser User-Agent, and a salted SHA-256 hash of your IP address (raw IP addresses are never stored).
Purpose: Delivering licensed reports, stamping personal print copies, and protecting copyright against unauthorised redistribution.
Legal basis: Contract & legitimate interest in copyright protection (Art. 6(1)(b) & (f) GDPR)
Retention: Kept while your account is active and deleted when your account is erased.

AI search & problem reports

Data: Questions you submit to AI search, the cited answer, thread ID (up to 4 follow-ups), token usage/cost, and optional problem reports (reason and note up to 500 characters). Your name, email, user ID, and IP address are never sent to the AI provider. Refused attempts by non-subscribers record only a daily count without question text.
Purpose: Generating cited answers from the ILCI database, reloading your conversation thread, enforcing daily quotas, and reviewing flagged answers.
Legal basis: Contract (Art. 6(1)(b) GDPR) & legitimate interest in quality control and quota enforcement (Art. 6(1)(f) GDPR)
Retention: A whole search thread is deleted by the scheduled purge after its latest answer is 365 days old, or immediately when you delete your account. Shared non-personal first-turn answer cache entries are purged after 30 days.

Security & rate limiting

Data: Short-lived counters keyed by a salted SHA-256 IP hash, email address, or user ID.
Purpose: Preventing brute-force sign-ins, sign-up/password-reset spam, and quota abuse.
Legal basis: Legitimate interest in platform security (Art. 6(1)(f) GDPR)
Retention: Fixed windows from 10 minutes to 24 hours; email and user keys are deleted on account erasure.

Public arbitration database (Art. 14 GDPR)

Data: Names, nationalities, procedural roles (arbitrator, annulment committee member, counsel, party), and law firm affiliations compiled from published investment-treaty arbitration awards and institutional registries (ICSID, UNCITRAL, PCA, SCC).
Purpose: Providing an accurate legal research database on investment-treaty arbitration and award compliance.
Legal basis: Legitimate interest in legal research, academic publishing, and transparency of international dispute settlement (Art. 6(1)(f) GDPR)
Retention: Part of the historical arbitration research corpus, subject to correction (Art. 16 GDPR) and objection (Art. 21 GDPR) requests.

4. Service providers (processors) and international transfers

We do not sell or rent personal data. We share data only with the service providers that run the platform:

Hosting & storage — Hetzner Online GmbH (Germany / Finland, EU): Hosts the application server, PostgreSQL database, and encrypted PDF storage within the European Union.
Payments — Mollie B.V. (Amsterdam, Netherlands, EU): Processes checkout and recurring subscription payments. We send your organisation name and email address to create a Mollie customer record and receive payment status updates via webhook. Mollie acts as an independent controller for payment execution and statutory anti-fraud / AML obligations.
Transactional email — Resend: Delivers plain-text account verification, password-reset, sign-in, team invitation, and billing notification emails. Open and click tracking pixels are disabled. Where email routing involves processing outside the EEA, transfers are safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) under our Data Processing Addendum.
AI model provider (EU region): Processes the text of subscriber questions and public database excerpts to generate cited answers, under a paid commercial API tier and Data Processing Addendum with EU regional processing and no model training on customer data. No user name, email address, user ID, or IP address is sent to the AI provider.

5. Cookies and browser storage

The platform uses strictly necessary functional storage only (exempt from consent banners under Art. 5(3) of the ePrivacy Directive and Art. 11.7a(3) of the Dutch Telecommunicatiewet):

better-auth.session_token (or __Secure-better-auth.session_token over HTTPS): HttpOnly, Secure, SameSite=Lax. Keeps you signed in for up to 30 days (refreshed daily while active) and is removed when you sign out.
better-auth.session_data: A short-lived (5-minute) signed cookie cache that avoids repeated database lookups while you navigate between pages.
sessionStorage ("ilci:ask:<threadId>"): Holds an in-progress AI search answer in your current browser tab so you can open a cited case and press Back without losing the answer. Cleared on sign-out or after 6 hours.

6. Your rights under the GDPR

Under Articles 15 to 22 of the GDPR, you have the right to:

Access and portability (Arts. 15 & 20): Request a copy of the personal data we hold about you in a structured, commonly used format.
Rectification (Art. 16): Ask us to correct inaccurate personal data — including if you are an arbitrator, counsel, or party named in our public arbitration database and wish to flag an inaccuracy.
Erasure / “Right to be forgotten” (Art. 17): Delete your account directly on your account page or by contacting us. Deleting your account immediately wipes your name, email address, password hash, active sessions, pending invitations, AI search history, and reading logs, cancels any active sole-owner subscription, and retains only anonymized payment records required for 7 years under Dutch tax law (Art. 17(3)(b) GDPR).
Restriction and objection (Arts. 18 & 21): Object to processing based on legitimate interest or request restriction while a concern is reviewed.

We do not use your personal data for automated decision-making or profiling (Art. 22 GDPR). We respond to all privacy requests within one month (Art. 12(3) GDPR).

If you believe our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the supervisory authority in the EU member state where you live or work.