Privacy Policy

NeedleSearch  ·  Version 2.2  ·  Effective 2 November 2026

This policy explains what NeedleSearch does with your data. It is written to be read, not to be survived. If anything in it is unclear, write to privacy@needlesearch.ai and we will answer in plain language.

What changed in version 2.2

• The model selector is gone. In the standard hosted configuration every answer is written by DeepSeek in China; you can no longer move the answering model to the United States by selecting Gemini or Claude. Team workspaces for which we have agreed a different provider in writing use that provider (currently Anthropic, United States). Sections 4.2, 4.3, 5, 6 and 13.5 are updated accordingly.
• Section 15 no longer promises 30 days' notice before a change; section 5 keeps prior notice of new providers for customers with a data processing agreement.
• Web search and page reading now run on Anthropic's Claude Haiku 5.5 (still Anthropic, United States).
• Sections 1.3, 13 and 14: we describe one GDPR-based privacy programme for all users, honouring the local rights each law gives you, instead of promising the strictest standard of every regime.
• Section 4.4: the no-training commitment is restated — we do not use Customer Content to train or fine-tune any model, and we access it only to provide and support the service and to investigate problems.
• Section 7: deletion from the live systems happens promptly, normally within minutes; after a backup restore we take steps to re-apply logged account erasures.
• Section 9: we respond to rights requests within one month, extendable for complex or numerous requests where the law allows.
• Sections 2.4, 8 and 11: the security and analytics statements are worded to match how the service is built.

What changed in version 2.1

• Scanned pages and embedded pictures are now read (OCR and image description) by DeepSeek, not Mistral AI; auxiliary calls (chat titles, memory relevance, condensing long conversations, classification) also go to DeepSeek whichever answering model you select.
• Anthropic is disclosed as a provider: it runs the Advisor reviewer model and web search.
• The paragraph about the in-app feedback button sending reports to Telegram is removed; Telegram is used only for operational alerts.
• The retention table now matches what the service actually does, and backups are described as implemented.
• New: a hash of your email is kept on legitimate-interest grounds to prevent repeated free trials, and a deleted user's email stays in the audit log for 2 years.
• The encryption section no longer overstates protection: keys are held in process memory and per-customer keys are not offered.
• The sub-processor list and the transfer table now state openly where transfer safeguards are not yet in place.

1. Who we are

NeedleSearch is an AI research platform for document collections. You upload a body of documents, ask a question in natural language, and receive an answer in which every statement links back to a specific page of a specific document.

1.1 We are inside the EU

Our team carries out the business of NeedleSearch from France, and our servers are in Sweden. We are established in the European Union, and the GDPR applies to our processing directly under Article 3(1). Our lead supervisory authority is the French CNIL; you may nonetheless complain to the authority in your own country.

1.2 We act in two different capacities

This distinction runs through the whole policy.

For Customer Content we act only on your documented instructions. We do not decide what is in your archive, how long you keep it, or what it is used for.

If your documents contain personal data of third parties — witnesses, opposing parties, employees — you are the controller and we are your processor, and Article 28 of the GDPR requires a written agreement between us. Write to sales@needlesearch.ai to put one in place before you upload client material.

1.3 Where this policy applies

The policy applies to everyone who uses the service. Sections 12 to 14 set out additional rights for the EEA and the UK, the United States, and the United Arab Emirates. We run one GDPR-based privacy programme for all users and honour the local rights each law gives you.

2. What we process

2.1 Account data

We never see or store your full payment card number. Card details go from your browser directly to Stripe; we receive only identifiers and the last four digits.

2.2 Customer Content

Everything you put into the product and everything derived from it:

• files you upload — PDF, Office documents, spreadsheets, presentations, plain text, Markdown, CSV and TSV, HTML, RTF, EPUB, images, archives, Outlook .msg messages, and audio;
• folder structure, file names, sizes and metadata;
• text extracted from those files, including text produced by optical character recognition from scans;
• transcripts produced from audio;
• vector representations computed from that text;
• your queries, chat history and the answers generated;
• your ratings and comments on individual answers.

Legal documents routinely contain personal data about people who are not our users, and often contain special categories of data — health, criminal proceedings, political opinions, trade union membership. We process this as your processor, on your instructions and on your legal basis. Establishing that legal basis is your responsibility as controller.

2.3 Technical data

2.4 What we do not do

• We do not buy personal data from data brokers.
• We do not collect biometric data.
• We do not track you across other websites. We do not use advertising pixels or cross-site trackers on our websites.
• We do not use analytics inside the application. Nothing about your documents, folders, queries or workspace is sent to anyone for measurement.
• We do not knowingly collect data from children.

3. Why we process it

Where we rely on legitimate interests we have carried out a balancing assessment. You can request a summary at privacy@needlesearch.ai, and you can object under section 12.

4. How the AI processes your documents

This is the section that matters most, and we have put it near the front rather than in an appendix.

4.1 The pipeline

1. Upload. Your file is stored on our servers in Sweden and encrypted at rest.
2. Text extraction. Born-digital files are parsed on our own infrastructure. Scanned pages, and images embedded in documents, are rendered to images and sent to a vision language model for optical character recognition and image description (section 4.2).
3. Transcription. Audio files and voice input are converted to text.
4. Chunking and embedding. Extracted text is split into passages and each passage is converted into a numeric vector.
5. Retrieval. Your query is embedded, matched against those vectors, combined with a keyword index, and the results are re-ranked.
6. Generation. The retrieved passages — and, when the documents you selected are small enough, their full text — are placed into the context of a large language model together with your question and the conversation so far. The model researches, drafts the answer and cites the pages it relies on. On harder tasks it may consult a second, stronger model (the Advisor, section 4.3), which receives the conversation so far.
7. Answer. You receive the answer with page-level citations.

4.2 What leaves our infrastructure

Storage, indexing and backups stay on our own servers in Sweden. The following steps send Customer Content to third-party AI providers in the standard hosted configuration:

What this means in practice. If you upload a scanned case file, the page images go to a company in China for text recognition, the extracted text is transmitted to a company in the United States for indexing, and any passage used to answer a question is transmitted to the provider of the answering model. This is automatic and part of normal operation.

4.3 What you can choose — and what you cannot

You cannot choose the answering model. In the standard hosted configuration every answer is written by DeepSeek in China. There is no selector that moves it elsewhere. Optical character recognition of scanned pages, page viewing and the other auxiliary calls in section 4.2 also use DeepSeek. A team workspace for which we have agreed a dedicated provider in writing has its answers written by that provider (currently Anthropic, United States); the auxiliary calls still use DeepSeek.

The Advisor sends the conversation so far to Anthropic in the United States when the assistant decides to consult it. It is on by default. Switch it off under Settings → Advisor if you do not want this.

If your material is privileged, subject to a confidentiality undertaking that forbids offshore processing, or covered by a protective order, the standard hosted configuration is not appropriate for it. Section 4.5 sets out the alternatives.

4.4 Training

• We do not use Customer Content to train or fine-tune any model. We access it only to provide and support the service and to investigate problems.
• We do not sell Customer Content and do not disclose it to anyone for their own marketing purposes.
• We cannot give you an unqualified assurance about what our AI providers do with data sent to their interfaces. We do not yet hold signed zero-retention or no-training commitments from them. Where we obtain such a commitment from a provider we will say so here and name the agreement.

We regard the third point as a defect in the standard configuration rather than an acceptable steady state, which is why the alternatives below exist.

4.5 Deployments where nothing leaves your control

• Private perimeter. The language model, embeddings, re-ranking and optical character recognition run as local inference servers, and the Advisor and web search are switched off. No Customer Content reaches any third-party AI provider.
• On-premises. The whole platform runs inside your own network.
• Air-gapped. As above, with no outbound internet connectivity at all.

If you need one of these, write to sales@needlesearch.ai before uploading anything confidential. We will confirm in writing which configuration your tenant runs on.

4.6 Automated decisions, and what the answers are

NeedleSearch does not make decisions about you that produce legal or similarly significant effects. It is a research tool that assists a qualified professional; the professional decides. Article 22 of the GDPR is not engaged.

You are interacting with an artificial intelligence system. Answers are generated by a language model, may be incomplete or wrong, and must be verified against the source pages cited before you rely on them.

5. Who else is involved

We use the following organisations to operate the service. The same list, with the data each receives, is kept in our public sub-processor list.

The following run on our own infrastructure and receive nothing from us, because they are software we operate rather than services we send data to: the PostgreSQL database, the Qdrant vector index, the Redis cache, the Cosmian key management service, the upload service, the GlitchTip error tracker, and — in private-perimeter deployments — the language, embedding, re-ranking and optical character recognition models.

Operational alerts. Our monitoring sends alerts to the operator's private chat on Telegram: job names and error messages from failing background jobs, counts of failed sign-ins, disk space and backup status. They are designed not to carry Customer Content or account data, but an error message can occasionally quote a value it failed on.

Our DNS is hosted by Cloudflare; it does not proxy the service and receives none of your data.

Changes. We inform customers with a data processing agreement before adding or replacing a provider that handles Customer Content, so that they can object. If we cannot accommodate an objection, the customer may terminate on that basis without penalty.

6. Data leaving the EEA

6.1 Where your data lives

Our servers and backups are in the European Economic Area. Your account, your documents, the extracted text, the search index and the backups are all stored there, and your data does not leave the EEA to be kept. It does leave the EEA to be processed, as section 4.2 sets out.

We draw this distinction because vendor questionnaires routinely conflate "where is the data hosted" with "where is the data processed". The two answers are different and both are below.

6.2 Every transfer out of the EEA

Transfers to China. We draw this to your attention specifically rather than leaving it in a table. China has no adequacy decision from the European Commission, and European supervisory authorities have taken enforcement action concerning the provider we use.

If you are in the EEA and your Customer Content contains personal data, this transfer is difficult to defend. In the standard hosted configuration the answering model, text recognition of scans and auxiliary calls all run there (section 4.3). If your material must not reach China, or the United States, ask us for a private-perimeter deployment under section 4.5 before uploading it.

We would rather tell you this than have your data protection officer discover it.

United States. The European Commission's adequacy decision for the EU–US Data Privacy Framework is in force. It is under appeal before the Court of Justice. If it is invalidated we will move to standard contractual clauses and tell affected customers.

7. How long we keep things

The free trial record. The free plan's AI budget is a one-off trial per mailbox. To stop the same person claiming it repeatedly, we keep a keyed hash of a normalised form of your email address (for example, dots and +tags in a Gmail address removed) together with the date of the claim. We keep it after you delete your account, with no expiry, because the abuse it prevents is exactly a deleted account signing up again. It cannot be reversed into your address without our key, but it is still personal data — we can tell whether a given address has claimed the trial. Our legal basis is legitimate interests (section 3). You can object under section 12; if your objection succeeds we delete the record, and a new account on that address will again receive the trial.

Backups. Deleting data removes it from the live database, search indexes and file storage promptly, normally within minutes. Backups are not edited individually; they expire on their own schedule:

Backups are encrypted, but the key backups hold the keys needed to read them, so deleted data remains restorable from backups until the last copy made before the deletion has expired. We therefore do not promise a fixed number of days for erasure from backups. If we ever restore a backup, we take steps to re-apply logged account erasures before the restored data is used.

For organisation accounts, retention after the subscription ends is otherwise set in the organisation's contract and controlled by its administrator, not by the individual user.

8. Security

• Data residency. All servers, storage and backups are in the EEA.
• Encryption at rest. Uploaded files, the text extracted from them, passage text in the search index, message content and personal data fields (such as email, name and phone) are encrypted with AES-256-GCM using envelope encryption: each item's data key is wrapped by keys held in a key management service we operate ourselves. While the service runs, the application holds unwrapped keys in memory, and caches them briefly, in order to read your data for you — it is not a zero-knowledge system. The keyword index (word stems) and the vector representations derived from your text are not encrypted. You cannot currently supply or hold your own keys.
• Encryption in transit. TLS 1.2 or higher on our public endpoints, with HSTS.
• Tenant isolation. Enforced in the database itself through PostgreSQL row-level security, not only in application code. An internal review of this isolation has been completed; no external penetration test has yet been carried out.
• Access control. Role-based access. Administrative access requires a password and a second factor (a time-based code, a passkey or an emailed code). Server access is by SSH key only. Two-factor sign-in is not yet available for customer accounts.
• Application hardening. A Content Security Policy that restricts scripts in the application to our own origin, CSRF protection on browser sessions, strict file type validation, hardened XML parsing for uploaded documents, rate limiting, and daily spending caps.
• Passwords are hashed with bcrypt and never stored or transmitted in the clear.
• Monitoring. Metrics, alerting, a self-hosted error tracker configured not to collect request personal data, and audit logging of sensitive operations.

Availability commitments, where they exist, are in your contract rather than in this policy. We do not hold a SOC 2 report or ISO 27001 certificate.

If something goes wrong. Where a breach is likely to result in a risk to your rights and freedoms we notify the competent supervisory authority within 72 hours of becoming aware of it, and notify you without undue delay where the risk is high. Where we act as your processor we notify you without undue delay so that you can meet your own deadlines.

9. Your rights

Wherever you are, you can:

• obtain a copy of your data — Settings → Export my data downloads a zip archive containing your original files and a structured JSON file with your profile, chats and messages, document metadata, working documents, skills and memories;
• correct inaccurate data — email privacy@needlesearch.ai; interface preferences can be changed in Settings;
• delete your account and its contents — Settings → Delete my account, confirmed by a code sent to your email. If you are the only owner of a team, transfer or close the team first. Deletion cancels any paid subscription;
• withdraw consent where processing rests on consent;
• object to processing based on legitimate interests, including the trial record in section 7;
• complain to us at privacy@needlesearch.ai, and to your regulator.

We respond within one month; where the law allows, we may extend this for complex or numerous requests and will tell you why. There is no charge unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity, and we will not use that information for anything else.

If your personal data appears inside a customer's documents — for example, you are a witness named in a case file — we are the processor and not the controller. Send your request to us and we will pass it to the relevant customer and help them respond. We cannot decide it ourselves.

10. Children

The service is not intended for and may not be used by anyone under 18. We do not knowingly collect data from children, and we delete it promptly if we learn that we have. Contact privacy@needlesearch.ai if you believe a child has given us data.

11. Cookies

11.1 The application and the website are different

Analytics stays out of the application because page titles and addresses there contain your folder names, document names and chat subjects. Sending those to a measurement provider would defeat the purpose of the product.

11.2 Strictly necessary cookies

These are set everywhere and do not require consent, because without them the service does not work.

We also use browser local storage for interface preferences. That stays on your device.

11.3 Analytics — public pages only

What happens depends on where you are:

How we have set it up, and why each choice matters to you:

• Google Signals is switched off and the property is not linked to any Google Ads account. Those are the settings that would turn measurement into advertising, and they are why section 13.2 can say without qualification that we do not sell or share personal information.
• Advertising storage, advertising user data and ad personalisation are denied at all times, whatever you consent to.
• Sharing with other Google products and services is switched off, so Google acts as our processor rather than for its own purposes.
• Analytics events are kept for 2 months — the shortest period available.
• Of the page address, only the path is sent. Query strings and fragments are stripped before the measurement call, so a parameter added to a link in future cannot leak into analytics.
• We have accepted the Google Analytics data processing terms.

If you change your mind we both instruct Google to stop and delete the _ga cookies from your device. Withdrawing is as easy as agreeing — the Cookie preferences link in the footer — and does not affect the lawfulness of anything done before.

11.4 Marketing

We set no marketing cookies. The category appears in the preferences dialog so that the control exists if that ever changes. It is off and does nothing.

12. If you are in the EEA or the UK

You have the rights in Articles 15 to 22 of the GDPR:

You may complain to your national supervisory authority. EEA authorities are listed at edpb.europa.eu; in the UK, the ICO. Our lead authority is the French CNIL. We would prefer you raised it with us first, but you are not obliged to.

Records of our processing activities under Article 30 are available to competent authorities on request.

13. If you are in the United States

Twenty states have comprehensive privacy statutes in force. We run one GDPR-based privacy programme for all users and honour the local rights each law gives you.

13.1 Your rights

You can know, access, delete, correct and port your personal information, and we will not discriminate against you for asking. Use Settings, or email privacy@needlesearch.ai with the subject "US Privacy Request". We respond within 45 days, extendable once by a further 45 days with notice. We accept requests from authorised agents who provide written authority.

13.2 Sale and sharing

We do not sell personal information. We do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. This includes the personal information of minors.

On Google Analytics specifically, because this is where such statements usually fail: we use it on our public pages as a service provider, for our own measurement, under Google's data processing terms. Google Signals is off, the property is not linked to any advertising account, and sharing with other Google products is off. Those three settings are what separate a service provider from a sale. If we ever change them this section changes with them, and you will be told before it takes effect.

13.3 Sensitive personal information

Documents uploaded to NeedleSearch commonly contain sensitive personal information. We use it only to provide the service you asked for, and for no secondary purpose. You may ask us to limit its use at any time; because it is already limited to service delivery this changes nothing in practice, but we will confirm it in writing.

13.4 Categories

Retention for each category is in section 7.

13.5 A note for attorneys

ABA Formal Opinion 512 requires a lawyer to obtain a client's informed consent before entering the client's confidential information into a generative AI tool, and to understand where that information goes. Sections 4.2 and 4.3 of this policy exist so that you can discharge that duty accurately.

In the standard hosted configuration you would be telling your client that document text is transmitted to providers in the United States and China (section 4.3). Switching off the Advisor reduces what goes to the United States but removes neither country. A private-perimeter deployment under section 4.5 removes both. Your professional obligations are yours; we have simply given you the facts, and the controls, to meet them.

14. If you are in the United Arab Emirates

Which law applies depends on where you are established.

Most of our clients in the UAE are established in DIFC or ADGM. Both regimes closely follow the GDPR, so the rights in section 12 apply to you in substance: access, rectification, erasure, restriction, portability, objection, and the right to complain to the data protection authority of your zone.

Two points specific to the UAE. Transfers between mainland UAE and the financial free zones count as cross-border transfers, because those are separate jurisdictions. And the implementing regulations of the federal law have not yet been issued. We run one GDPR-based privacy programme for all users and honour the local rights each law gives you.

15. Changes

We may update this policy. For material changes we will post a notice in the application and may also email registered users. The version and effective date at the top of this policy show which text applies. Where a change requires fresh consent we will ask for it explicitly rather than infer it. Previous versions are archived and available on request.

16. Contact

We aim to acknowledge within five business days and to resolve formal rights requests within the statutory period for your jurisdiction.

Regulators. EEA: edpb.europa.eu. Our lead authority: CNIL. UK: ICO. California: CPPA.