Private inference. Transparent data handling.

Sequester AG, Baarerstrasse 10, 6300 Zug, Switzerland (CHE-358.088.054), provides Vattel. Contact [email protected] for privacy questions or rights requests.

Sequester is controller for its website, account administration, subscriptions, security, service operation and support. A customer organisation generally determines the purposes of processing its client or matter content, and Sequester processes that content on its instructions as a processor where applicable. A separate data-processing agreement may provide further terms. This policy does not replace the customer’s notices to clients or employees.

Workspace content: prompts, client facts, uploaded documents, conversation context, generated answers, suggested and accepted edits, saved files, instructions and workflow configuration.

Accounts and teams: name, verified email, organisation, team address, manager/member role, invitations, authentication records, accepted terms and plan selections. Sign-in and session token verifiers are stored rather than raw authentication tokens.

Subscriptions and payments: billing identity and address, selected plan, trial and subscription dates, cancellation status, tax information where required, and payment-provider customer, checkout, subscription and invoice identifiers. Card details are collected by Stripe in its hosted checkout, not by a Vattel card form. We receive payment status and limited payment-method information, not the full card number or security code.

Time and billing features: client, team member, work description, timestamps, durations, rates and calculated amounts when these features are used. Operational records: IP address, user agent, request paths and times, status, errors, feedback, source/tool activity and performance diagnostics. Detailed troubleshooting records can contain request or document information.

We process data to authenticate users, operate teams and client workspaces, answer requests, edit documents, execute configured workflows, provide subscriptions and payments, maintain source indexes, protect the service, investigate failures, handle support and claims, and meet legal obligations.

Swiss processing is subject to the Federal Act on Data Protection. Where the GDPR applies, relevant bases include contractual performance, legal obligations, legitimate interests in secure and reliable service operation, and consent where required. Customer content is processed within the customer’s instructions and applicable processing terms; it is not a general licence to reuse client information for unrelated purposes.

The application sends the request and relevant bounded context through a Sequester-controlled gateway to the selected private model running in Switzerland. DeepSeek is the currently available model. It does not use a US cloud model API for inference, switch automatically to another provider, or enable external model-provider conversation, file or vector stores. Private client content is not used to train public foundation models.

Requests may use local legal-source indexes, workspace tools and public-web retrieval. Research mode allows more time for source examination; it does not certify accuracy or source freshness. Public website requests can disclose normal technical data and the public search terms needed for retrieval. Users should avoid instructing tools to disclose confidential client information to external sites.

Authorised Sequester personnel may access retained records where necessary for support, security or a specific quality or failure investigation, subject to role-based access and confidentiality obligations. The customer remains responsible for human review of outputs and any professional decisions. Vattel does not itself make legally binding decisions about individuals.

Sequester-controlled infrastructure, Switzerland: the production application origin, workspace storage and private inference. Team membership and resource permissions control access; the web address alone does not.

Cloudflare: DNS, TLS termination, proxying, network delivery and protection for public requests. This means network traffic passes through Cloudflare infrastructure and is not processed exclusively inside Sequester’s Swiss origin.

Resend: destination email, message content and delivery metadata for sign-in and other service emails. Stripe: hosted card checkout, billing and subscription processing, including payment, billing-address and fraud-prevention data. Stripe also processes some data for its own payment and regulatory purposes under its privacy information.

Other limited recipients: selected public websites when research tools retrieve their content, and professional advisers or authorities where necessary or legally required. Customer-authorised integrations may add recipients described in their setup or applicable agreement.

These external services can process data outside Switzerland. Resend states that stored email data are held in the United States; its processing terms include contractual transfer safeguards. Cloudflare processes traffic across its international network, including the United States, under its processing terms; its recipient information describes further locations. Stripe involves entities in Ireland and the United States and other recipients identified in its provider list. Its transfer terms describe the Data Privacy Framework and contractual safeguards where applicable. These are provider-specific arrangements, not a promise of exclusively Swiss processing. Swiss inference does not create blanket immunity from the US CLOUD Act or other foreign laws. Contact us for the processing terms and transfer information relevant to your deployment.

Client records, files, conversations, document versions, team instructions and time entries are retained for workspace operation until authorised deletion, applicable retention settings or the end-of-service process applies. Archiving a conversation is not necessarily deletion. Customers should export needed records before access ends.

Email sign-in codes expire after ten minutes. Sign-in links retained for older desktop clients normally expire after fifteen minutes, and browser sessions after fourteen days. Detailed request-job records normally expire after seven days; content-free activity and timing diagnostics are retained for up to ninety days. Deletion timing can vary with configured retention and processing. Contractual, billing, security and dispute records may be kept longer where needed for legal duties or legitimate claims. Backups, where maintained, follow their own protected retention and restoration process.

Ending a subscription does not itself delete workspace content. Deletion follows authorised requests, agreed retention arrangements and applicable legal duties. Retention and deletion of content processed for a customer are also subject to the customer’s lawful instructions and any data-processing agreement.

Managers control invitations and membership. Team members can access shared client workspaces and records according to their permissions; private workspaces have separate access rules. The organisation should tell its users how team access, time tracking and billing records are used.

Public conversation sharing, email drafting or sending, document downloads and integrations can make selected information available outside the workspace when an authorised user chooses those actions. Review recipients, content and sharing settings. Anyone with an active public share link may access its published snapshot.

We use authenticated access, team and resource permissions, encryption in transit, restricted service boundaries and operational controls designed to protect data. These measures do not eliminate all risk or constitute a guarantee of uninterrupted availability, complete prevention of unauthorised access or compliance with every customer-specific requirement.

Customers must assess professional secrecy, client authorisations, confidentiality restrictions and applicable regulation before uploading sensitive material. They must configure appropriate access, maintain secure devices and notify us promptly of suspected incidents. Mandatory security and breach-notification duties remain unaffected.

Vattel uses a necessary HTTP-only authentication cookie and browser storage for workspace preferences and continuity. During sign-in, the current tab stores your email address and pending verification request so you can continue after a page reload. The sign-in code itself is not saved in browser storage. Pending sign-in details are cleared when you sign in or choose another email address. It does not use advertising cookies or behavioural advertising analytics. Our interface assets and fonts are served with the application. External websites and hosted checkout apply their own privacy and cookie information.

Subject to applicable law, you may request access, correction, deletion, portability, restriction or objection, and withdraw consent where processing relies on it. We may verify identity and retain information where a legal obligation or lawful overriding reason requires it. For client data controlled by your organisation, contact that organisation first; we assist it as required.

You may contact the Swiss Federal Data Protection and Information Commissioner or another competent supervisory authority. Contractual liability limits and arbitration do not remove statutory data-protection rights or the powers of authorities.

We may update this policy to reflect the service, providers or law. The effective date identifies the version. We will communicate material changes where required. A customer-specific agreement prevails only where it expressly governs the relevant processing and remains consistent with mandatory law.