GDPR & privacy
Your data: processing and retention
This is the plain-language version of how Lowkey handles data across its tools. It is written to be read, not to cover us.
The short version
- Form uploads are processed temporarily. Chat history and review documents are retained until your firm deletes them. Account, billing and usage records are retained to operate the service.
- Everything that touches your data runs on EU infrastructure. No client data is sent outside the EU.
- Your firm stays the controller of your clients' data. Lowkey acts as your processor.
Account and billing data
For the portal we keep your name, work email, firm, VAT number, and payment status, so we can run your account and invoice you. Payments and invoicing run through our payment provider. We never see or store full card numbers.
Usage records
We store one line per finished document: which tool, and the timestamp, so billing is correct and you can see your own history. That line holds no client content.
Where it runs
Lowkey is built so that data residency holds by construction, not by promise. Each layer that can touch your data sits in the EU:
| Hosting / front door | An EU hosting and CDN provider, served from EU edge locations. |
| Reading uploads (AI) | A large language model accessed through an EU-resident inference profile (Ireland). We do not call US inference endpoints. |
| Database | A managed database, Western Europe region. |
| Document processing | A dedicated server within the EU. |
| Payments | An EU payment provider, for billing and contact data only, under its EU processing terms. |
Who else processes data for us
We use a small, fixed set of processors, listed above by function and region: hosting and database, reading uploads (AI), document processing, and payments. Each is bound by a data processing agreement and, where a transfer would otherwise occur, by EU standard contractual clauses. We do not sell data and we do not share it for advertising. A current list of our processors, with the name of each party, is available on request at privacy@lowkeyautomation.com.
Cookies on this website
This website uses a limited number of cookies. The necessary ones are always active; the rest you switch on or off through the cookie banner, and you can change your choice at any time via "Cookie settings" at the foot of the page.
- Strictly necessary (no consent required): storage needed to make the site work and to remember your cookie choice. Always active.
- Statistics (only with your consent): we use Google's measurement tag to see how visitors find and use the site. It only sets cookies or shares data after you accept it in the banner; until then it runs in consent-denied mode and stores nothing on your device.
This concerns the marketing website. What the tools themselves do with client facts is described above.
Your rights
You also have the right to complain to the Dutch supervisory authority, the Dutch Data Protection Authority.
Who we are, and how to reach us
Lowkey is operated by Lowkey Automation, a sole proprietorship registered with the Dutch Chamber of Commerce (KvK) under number 42057580, based in Amsterdam, the Netherlands. If you are a firm working with us and need the formal data processing agreement, ask and we will send it. For any privacy question or to exercise a right above, email privacy@lowkeyautomation.com.