Privacy — Aptus.AI legal sources connector

Version 2.2 — 15 October 2026. Versione italiana.

Definitions

For the purposes of this notice:

Aptus.AI means Aptus.AI S.r.l., with registered office in Pisa (PI), Via dell’Argine no. 1, 56122, Italy, VAT no. 02288220508.
Platform means the Aptus.AI legal-research platform and the related services made available by Aptus.AI.
MCP Connector means the optional technical connection that allows a Third-Party Assistant to send a legal query and related information to Aptus.AI and to receive the resulting legal response.
Third-Party Assistant means a third-party artificial-intelligence assistant, and the provider operating that assistant, selected and connected by the User and configured to exchange information with the MCP Connector. This is a functional category and is not a closed list of named services.
User means the person using an Aptus.AI account who authorises or uses the MCP Connector. Where the account is used on behalf of an organisation, Client means that organisation.
Personal Data has the meaning given to that term by Article 4(1) of the GDPR.
Response means the legal answer and related legal-source results returned by Aptus.AI through the MCP Connector to the same Third-Party Assistant that sent the request.

1. This notice supplements the Platform Privacy Policy

The Aptus.AI legal sources connector is an optional way of using the Aptus.AI Platform through a Third-Party Assistant selected and connected by the User.

The processing carried out by Aptus.AI remains governed by the Aptus.AI Platform Privacy Policy accepted by the User when registering, including the controller identity, applicable purposes and legal bases, Aptus.AI recipients, Aptus.AI retention periods, security measures and data-subject rights.

This notice supplements that policy and provides the specific description for the optional MCP connection. For the MCP Connector only, and to the extent of any inconsistency between this notice and the general description of recipients in the Platform Privacy Policy, this notice governs the specific MCP processing described here: the Third-Party Assistant may receive the Response, including Personal Data reproduced from the request, context or cited source. This specific coordination does not amend the Platform Privacy Policy for other Platform services or integrations and does not determine the Third-Party Assistant’s subsequent processing, role, location, retention or transfers.

It applies only when the User authorises and uses the connector. It does not apply to conversations or other processing carried out by the third-party assistant outside the data exchanged through the connector.

2. How the MCP connection works

When the User authorises the connector, the third-party assistant sends Aptus.AI the information needed to answer the User’s legal query. Depending on how the assistant formulates the request, this may include:

the legal question;
relevant context supplied by the User or selected by the assistant;
the cited source or other source information;
the identity or technical information needed to authenticate and operate the authorised connection.

The assistant does not receive the User’s Aptus.AI credentials through the connector. The connector does not transmit the entire conversation with the assistant to Aptus.AI. Aptus.AI receives the fields sent through the connector, as formulated by the assistant, and cannot guarantee that those fields contain no personal data.

Aptus.AI uses the received information to provide the requested legal research service and returns the result to the same third-party assistant. The result may include legal answers, reports on relevant legislation and case law, short verbatim quotations and links to Aptus.AI. It does not include the full text of the sources.

3. Personal data in the request and in the response

The legal question, context or cited source sent through the connector may contain personal data, including information relating to individuals mentioned in the legal matter. The User must provide only information that is adequate, relevant and necessary for the requested legal research and must ensure that the use of the information through the selected assistant is authorised and lawful.

Aptus.AI processes the information received through the connector as part of providing the Platform service. Aptus.AI does not apply automatic redaction, masking or pseudonymisation to the response before returning it to the third-party assistant.

Accordingly, the response may reproduce personal data that was already present in the legal question, context or cited source. Aptus.AI does not add or generate new personal data about the persons referred to in the request as part of this MCP handling; the absence of newly generated personal data does not prevent the receipt, use or transmission of personal data already contained in the exchanged information.

The third-party assistant is therefore able to receive the response, including any personal data reproduced from the input. Aptus.AI does not control how the provider displays, stores, uses, trains on, accesses or otherwise processes the conversation or the response after the provider receives it.

4. Aptus.AI and the third-party provider: separate processing

Aptus.AI is responsible for the processing that Aptus.AI carries out to authenticate and operate the connector, receive the request, provide the legal research service, return the response and maintain the related security and service records, in accordance with the Platform Privacy Policy and this notice.

The third-party provider separately determines the processing it carries out in connection with its assistant, including the conversation with the User and the results received through the connector. That processing is governed by the provider’s own privacy policy, terms and contractual arrangements with the User or Client.

This notice does not classify the third-party provider automatically as an Aptus.AI processor, independent controller or joint controller. The applicable qualification depends on the actual processing, the purposes and means determined by the parties, and the contractual and operational arrangements in force.

For the optional MCP connection, the provider is a recipient of the response whenever the response communicates personal data to that provider, even where the response merely reproduces personal data already contained in the request and does not add new personal data.

5. Purposes and legal basis

Aptus.AI processes the information exchanged through the connector to:

provide the legal research and source-retrieval service requested by the User;
authenticate, enable, secure and administer the authorised connection;
return the legal response and source results to the assistant selected by the User; and
maintain the records and security information necessary for the operation, protection and accountability of the Platform.

The legal bases for Aptus.AI’s processing are the legal bases stated in the Platform Privacy Policy for the relevant Platform service, contractual administration and security purposes. Activating the optional connector is not represented as a separate consent to Aptus.AI’s processing unless a separate consent request is expressly presented.

6. Provider location, international transfers and provider terms

The third-party provider may process the conversation and the response in the European Economic Area or elsewhere. Aptus.AI does not select or control the provider’s internal processing location, data centres, retention periods, personnel access, use of data for service improvement or training, or onward transfers.

Aptus.AI therefore does not guarantee that the provider will process the conversation or the response within the European Economic Area, and this notice does not state that a particular provider, account type, plan or technical configuration uses EU-only processing. The User or Client must review the provider’s current privacy policy and contractual terms and determine whether the selected provider and configuration are appropriate for the information submitted through the connector.

The provider’s own processing and onward transfers remain governed by the provider’s terms and by the relationship between the provider and the User or Client. This does not change the fact that Aptus.AI remains responsible for the processing and transmission carried out by Aptus.AI through the connector. Where Aptus.AI makes personal data available to a recipient in a third country, the applicable requirements of Chapter V of the GDPR must be assessed for the actual configuration; this notice does not make a blanket claim that no transfer occurs or that a specific transfer mechanism applies to every provider.

For Aptus.AI’s own processing, the Platform Privacy Policy continues to apply, including its provisions on transfers and safeguards. The User may contact Aptus.AI for information about Aptus.AI’s own processing, but Aptus.AI cannot provide assurances about processing carried out solely by the selected provider.

7. Retention

Aptus.AI retains the information and records generated by the connector only for the periods, or according to the criteria, applicable under the Platform Privacy Policy to the relevant Platform service, security and administration purposes.

Aptus.AI does not determine or guarantee the provider’s retention period. The provider’s retention of the conversation and the response is governed by the provider’s own privacy policy, terms, account type and contractual arrangements with the User or Client.

8. Security and disconnection

Aptus.AI applies the security measures described in the Platform Privacy Policy to the processing under Aptus.AI’s control. The connector does not provide the third-party assistant with the User’s Aptus.AI credentials.

The User may revoke the connector authorisation at any time by disconnecting the connector in the relevant Platform or integration settings. Disconnection prevents future use of the connector but does not by itself erase information already processed or retained by Aptus.AI or by the provider; erasure and other rights remain subject to the applicable policies, terms and legal requirements governing each party’s processing.

9. Data-subject rights and contact

The rights, procedures and contact details applicable to Aptus.AI’s processing are set out in the Aptus.AI Platform Privacy Policy. For questions about Aptus.AI’s processing through the connector, write to info@aptus.ai.

Questions about the provider’s processing, including its location, retention, training, access, onward transfers or deletion of the conversation and response, must be addressed under the provider’s privacy policy and terms.

Legal references for this notice

This notice is drafted consistently with the relevant provisions of Regulation (EU) 2016/679 (GDPR), including: