Privacy Policy

NeedleSearch  ·  Version 2.0  ·  Effective 9 August 2026

This policy explains what NeedleSearch does with your data. It is written to be read, not to be survived. If anything in it is unclear, write to privacy@needlesearch.ai and we will answer in plain language.

1. Who we are

NeedleSearch is an AI research platform for document collections. You upload a body of documents, ask a question in natural language, and receive an answer in which every statement links back to a specific page of a specific document.

1.1 We are inside the EU

Our team carries out the business of NeedleSearch from France, and our servers are in Sweden. We are established in the European Union, and the GDPR applies to our processing directly under Article 3(1). Our lead supervisory authority is the French CNIL; you may nonetheless complain to the authority in your own country.

1.2 We act in two different capacities

This distinction runs through the whole policy.

For Customer Content we act only on your documented instructions. We do not decide what is in your archive, how long you keep it, or what it is used for.

If your documents contain personal data of third parties — witnesses, opposing parties, employees — you are the controller and we are your processor, and Article 28 of the GDPR requires a written agreement between us. Write to sales@needlesearch.ai to put one in place before you upload client material.

1.3 Where this policy applies

The policy applies to everyone who uses the service. Sections 12 to 14 set out additional rights for the EEA and the UK, the United States, and the United Arab Emirates. Where those regimes differ we apply the stricter standard to everyone rather than varying our practices by user location.

2. What we process

2.1 Account data

We never see or store your full payment card number. Card details go from your browser directly to Stripe; we receive only identifiers and the last four digits.

2.2 Customer Content

Everything you put into the product and everything derived from it:

• files you upload — PDF, Office documents, spreadsheets, presentations, plain text, Markdown, CSV and TSV, HTML, RTF, EPUB, images, archives, Outlook .msg messages, and audio;
• folder structure, file names, sizes and metadata;
• text extracted from those files, including text produced by optical character recognition from scans;
• transcripts produced from audio;
• vector representations computed from that text;
• your queries, chat history and the answers generated;
• your ratings and comments on individual answers.

Legal documents routinely contain personal data about people who are not our users, and often contain special categories of data — health, criminal proceedings, political opinions, trade union membership. We process this as your processor, on your instructions and on your legal basis. Establishing that legal basis is your responsibility as controller.

2.3 Technical data

2.4 What we do not do

• We do not buy personal data from data brokers.
• We do not collect biometric data.
• We do not track you across other websites. There are no advertising pixels and no cross-site trackers anywhere on our properties.
• There is no analytics of any kind inside the application. Nothing about your documents, folders, queries or workspace is sent to anyone for measurement.
• We do not knowingly collect data from children.

3. Why we process it

Where we rely on legitimate interests we have carried out a balancing assessment. You can request a summary at privacy@needlesearch.ai, and you can object under section 12.

4. How the AI processes your documents

This is the section that matters most, and we have put it near the front rather than in an appendix.

4.1 The pipeline

1. Upload. Your file is stored on our servers in Sweden and encrypted at rest.
2. Text extraction. Born-digital PDFs are parsed on our own infrastructure. Scanned pages are rendered to images and sent to Mistral AI in France for optical character recognition.
3. Transcription. Audio files are converted to text.
4. Chunking and embedding. Extracted text is split into passages and each passage is converted into a numeric vector.
5. Retrieval. Your query is embedded, matched against those vectors, combined with a keyword index, and the results are re-ranked.
6. Generation. The retrieved passages and their full text are placed into the context of a large language model together with your question. The model drafts the answer, and a second model instance checks each claim against the pages cited.
7. Answer. You receive the answer with page-level citations.

4.2 What leaves our infrastructure

In the standard hosted configuration, four of those steps send Customer Content to third-party AI providers, and storage stays on our own servers. Of the four, one — optical character recognition — stays inside the European Economic Area, and storage never leaves our servers in Sweden:

What this means in practice. If you upload a scanned case file, the page images go to a company in France, the extracted text is transmitted to a company in the United States for indexing, and — on the default model — any passage used to answer a question is transmitted to a company in China for generation. This is automatic and part of normal operation.

The first two rows are within the EEA and raise no third-country transfer question. The last three are the ones that matter — and the last one, the language model, is your choice.

4.3 You choose the model, and therefore the country

The model selector in the chat interface offers four options. It decides where the text of your retrieved passages is processed:

Read the third and fourth rows carefully. Selecting Gemini or Claude does not send your text to Google or to Anthropic. Both models are hosted by DeepInfra — the same provider that already holds your document text for indexing. Choosing one of them therefore adds no new recipient at all; it removes the Chinese one.

If you do not want your documents processed in China, select Gemini 3.1 Pro or Claude Sonnet 4.6 before you ask. The choice applies to queries you make after it; it does not retroactively change queries already answered.

If you need to remove the United States as well, that is what the private-perimeter and on-premises deployments below are for.

We tell you this because you cannot make an informed decision without it. If your material is privileged, subject to a confidentiality undertaking that forbids offshore processing, or covered by a protective order, the standard hosted configuration is not appropriate for it. Sections 4.3 and 4.5 set out the alternatives.

4.4 Training

• We do not use Customer Content to train, fine-tune or evaluate any model of our own. This is unconditional.
• We do not sell Customer Content and do not disclose it to anyone for their own marketing purposes.
• We cannot give you an unqualified assurance about what our AI providers do with data sent to their interfaces. Their published terms do not universally exclude retention or use for model training. Where we obtain such a commitment from a provider we will say so here and name the agreement.

We regard the third point as a defect in the standard configuration rather than an acceptable steady state, which is why the alternatives below exist.

4.5 Deployments where nothing leaves your control

• Private perimeter. All four model roles — language model, embeddings, re-ranking and optical character recognition — run as local inference servers. No Customer Content reaches any third-party AI provider.
• On-premises. The whole platform runs inside your own network.
• Air-gapped. As above, with no outbound internet connectivity at all.

If you need one of these, write to sales@needlesearch.ai before uploading anything confidential. We will confirm in writing which configuration your tenant runs on.

4.6 Automated decisions, and what the answers are

NeedleSearch does not make decisions about you that produce legal or similarly significant effects. It is a research tool that assists a qualified professional; the professional decides. Article 22 of the GDPR is not engaged.

You are interacting with an artificial intelligence system. Answers are generated by a language model, may be incomplete or wrong, and must be verified against the source pages cited before you rely on them.

5. Who else is involved

We use the following organisations to operate the service.

The following run on our own infrastructure and receive nothing from us, because they are software we operate rather than services we send data to: the PostgreSQL database, the Qdrant vector index, the Redis cache, the Cosmian key management service, the upload service, and — in private-perimeter deployments — the language, embedding, re-ranking and optical character recognition models.

Feedback button. The application shows a feedback control that captures a screenshot of your current screen and sends it — together with your comment and the name and email address of your account, so that we can reply — to our support channel on Telegram. A screenshot can contain the text of the document you are reading. It is only ever triggered by your explicit click; we never capture your screen at any other time. If you would rather it were not available, tell us and we will switch it off.

Changes. We give at least 30 days' notice before adding or replacing a provider that handles Customer Content. Customers with a data processing agreement may object, and if we cannot accommodate the objection you may terminate on that basis without penalty.

6. Data leaving the EEA

6.1 Where your data lives

Our servers are in Sweden, and our optical character recognition provider is in France. Your account, your documents, the extracted text, the search index and the backups are all stored inside the European Economic Area, and scanned pages are read within it too. Neither is a third-country transfer, and your data does not leave the EEA to be kept.

We draw this distinction because vendor questionnaires routinely conflate "where is the data hosted" with "where is the data processed". The two answers are different and both are below.

6.2 Every transfer out of the EEA

Our infrastructure provider in Sweden and our optical character recognition provider in France are not on this list, because neither is a transfer out of the EEA.

Transfers to China. We draw this to your attention specifically rather than leaving it in a table. China has no adequacy decision from the European Commission, and European supervisory authorities have taken enforcement action concerning the provider we use.

If you are in the EEA and your Customer Content contains personal data, the default model is difficult to defend. You do not have to accept it: switch the model selector to Gemini 3.1 Pro or Claude Sonnet 4.6 and no text goes to China at all (section 4.3). If you also need to keep it out of the United States, ask us for a private-perimeter deployment under section 4.5.

We would rather tell you this than have your data protection officer discover it.

United States. The European Commission's adequacy decision for the EU–US Data Privacy Framework is in force. It is under appeal before the Court of Justice. If it is invalidated we will move to standard contractual clauses and tell affected customers.

7. How long we keep things

Deletion propagates across the database, the vector store, the object storage and the search indexes. Backups rotate within 30 days, after which deleted data cannot be recovered.

For organisation accounts, retention after the subscription ends is set in the organisation's contract and controlled by its administrator, not by the individual user.

8. Security

• Data residency. All servers, storage and backups are in Sweden, inside the EEA.
• Encryption at rest. Personal data fields and message content are encrypted with AES-256-GCM. Keys are managed by a key management service we operate ourselves, using envelope encryption; the application never holds a long-lived master key.
• Encryption in transit. TLS 1.2 or above on every connection, with HSTS.
• Tenant isolation. Enforced in the database itself through PostgreSQL row-level security, not only in application code. A dedicated internal review of this isolation has been completed.
• Access control. Role-based access; administrative access requires a password and a time-based one-time code.
• Application hardening. A Content Security Policy that restricts scripts in the application to our own origin, CSRF protection on every state-changing request, strict file type validation, hardened XML parsing for uploaded documents, and rate limiting.
• Passwords are hashed with bcrypt and never stored or transmitted in the clear.
• Monitoring. Metrics, alerting and audit logging of sensitive operations.

Availability commitments, where they exist, are in your contract rather than in this policy.

If something goes wrong. Where a breach is likely to result in a risk to your rights and freedoms we notify the competent supervisory authority within 72 hours of becoming aware of it, and notify you without undue delay where the risk is high. Where we act as your processor we notify you without undue delay so that you can meet your own deadlines.

9. Your rights

Wherever you are, you can:

• obtain a copy of your data in a structured, machine-readable format — Settings → Export My Data;
• correct inaccurate data — Settings → Profile;
• delete your account and its contents — Settings → Delete Account;
• withdraw consent where processing rests on consent;
• complain to us at privacy@needlesearch.ai, and to your regulator.

We respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity, and we will not use that information for anything else.

If your personal data appears inside a customer's documents — for example, you are a witness named in a case file — we are the processor and not the controller. Send your request to us and we will pass it to the relevant customer and help them respond. We cannot decide it ourselves.

10. Children

The service is not intended for and may not be used by anyone under 18. We do not knowingly collect data from children, and we delete it promptly if we learn that we have. Contact privacy@needlesearch.ai if you believe a child has given us data.

11. Cookies

11.1 The application and the website are different

Analytics stays out of the application because page titles and addresses there contain your folder names, document names and chat subjects. Sending those to a measurement provider would defeat the purpose of the product.

11.2 Strictly necessary cookies

These are set everywhere and do not require consent, because without them the service does not work.

We also use browser local storage for interface preferences. That stays on your device.

11.3 Analytics — public pages only

What happens depends on where you are:

How we have set it up, and why each choice matters to you:

• Google Signals is switched off and the property is not linked to any Google Ads account. Those are the settings that would turn measurement into advertising, and they are why section 13.2 can say without qualification that we do not sell or share personal information.
• Advertising storage, advertising user data and ad personalisation are denied at all times, whatever you consent to.
• Sharing with other Google products and services is switched off, so Google acts as our processor rather than for its own purposes.
• Analytics events are kept for 2 months — the shortest period available.
• Of the page address, only the path is sent. Query strings and fragments are stripped before the measurement call, so a parameter added to a link in future cannot leak into analytics.
• We have accepted the Google Analytics data processing terms.

If you change your mind we both instruct Google to stop and delete the _ga cookies from your device. Withdrawing is as easy as agreeing — the Cookie preferences link in the footer — and does not affect the lawfulness of anything done before.

11.4 Marketing

We set no marketing cookies. The category appears in the preferences dialog so that the control exists if that ever changes. It is off and does nothing.

12. If you are in the EEA or the UK

You have the rights in Articles 15 to 22 of the GDPR:

You may complain to your national supervisory authority. EEA authorities are listed at edpb.europa.eu; in the UK, the ICO. Our lead authority is the French CNIL. We would prefer you raised it with us first, but you are not obliged to.

Records of our processing activities under Article 30 are available to competent authorities on request.

13. If you are in the United States

Twenty states have comprehensive privacy statutes in force. We apply the strictest common standard to residents of every state rather than varying our practice state by state.

13.1 Your rights

You can know, access, delete, correct and port your personal information, and we will not discriminate against you for asking. Use Settings, or email privacy@needlesearch.ai with the subject "US Privacy Request". We respond within 45 days, extendable once by a further 45 days with notice. We accept requests from authorised agents who provide written authority.

13.2 Sale and sharing

We do not sell personal information. We do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. This includes the personal information of minors.

On Google Analytics specifically, because this is where such statements usually fail: we use it on our public pages as a service provider, for our own measurement, under Google's data processing terms. Google Signals is off, the property is not linked to any advertising account, and sharing with other Google products is off. Those three settings are what separate a service provider from a sale. If we ever change them this section changes with them, and you will be told before it takes effect.

13.3 Sensitive personal information

Documents uploaded to NeedleSearch commonly contain sensitive personal information. We use it only to provide the service you asked for, and for no secondary purpose. You may ask us to limit its use at any time; because it is already limited to service delivery this changes nothing in practice, but we will confirm it in writing.

13.4 Categories

Retention for each category is in section 7.

13.5 A note for attorneys

ABA Formal Opinion 512 requires a lawyer to obtain a client's informed consent before entering the client's confidential information into a generative AI tool, and to understand where that information goes. Sections 4.2 and 4.3 of this policy exist so that you can discharge that duty accurately.

On the default model you would be telling your client that document text is transmitted to providers in the United States and China. Selecting Gemini or Claude reduces that to the United States alone. A private-perimeter deployment under section 4.5 removes both. Your professional obligations are yours; we have simply given you the facts, and the controls, to meet them.

14. If you are in the United Arab Emirates

Which law applies depends on where you are established.

Most of our clients in the UAE are established in DIFC or ADGM. Both regimes closely follow the GDPR, so the rights in section 12 apply to you in substance: access, rectification, erasure, restriction, portability, objection, and the right to complain to the data protection authority of your zone.

Two points specific to the UAE. Transfers between mainland UAE and the financial free zones count as cross-border transfers, because those are separate jurisdictions. And the implementing regulations of the federal law have not yet been issued — until they are, we apply the GDPR standard, which meets or exceeds the federal requirements in every respect we have identified.

15. Changes

We may update this policy. For material changes we will post a notice in the application and email registered users at least 30 days before the change takes effect. Where a change requires fresh consent we will ask for it explicitly rather than infer it. Previous versions are archived and available on request.

16. Contact

We aim to acknowledge within five business days and to resolve formal rights requests within the statutory period for your jurisdiction.

Regulators. EEA: edpb.europa.eu. Our lead authority: CNIL. UK: ICO. California: CPPA.