Privacy Policy
This Privacy Policy (hereinafter the “Policy”) sets out the rules, purposes and legal bases under which Genesis 1 LLC (identification code: 404817668, hereinafter “Genesys”, “we” or the “data controller”) collects, processes, stores and protects the personal data of the users (hereinafter the “User” or “you”) of the Platform (genesys.ge and its subdomains), the AI legal modules, the search systems and the related digital services.
1. Data controller
- Legal entity: Genesis 1 LLC
- Identification code: 404817668
- Data protection and privacy officer: privacy@genesys.ge
- User support: support@genesys.ge
2. Categories of personal data processed
We collect and process only the data that is objectively necessary for the proper functioning of the Service.
2.1. Account and authentication data
- email address;
- password (stored only as a cryptographically encrypted hash);
- unique user ID and active session tokens;
- for Google OAuth sign-in: the unique identifier of the Google account (UID), email, name and profile picture (where provided by Google’s authentication system).
2.2. User-submitted content and workspace
- legal questions, search queries and prompts;
- documents uploaded for analysis (PDF, DOCX, TXT), contracts, court acts, images and records;
- generated AI responses, chat history and workspaces created by the User.
2.3. Financial and billing metadata
- Genesys does not store or process full bank card data (the 16-digit number, expiry date, CVV/CVC code).
- During payment, only transaction metadata is stored: the selected plan, the amount, the currency, the unique transaction ID, the provider’s operation status, the secure token of the stored card (RecToken), the last 4 digits of the card and its brand (e.g. Visa / Mastercard).
2.4. Technical and security telemetry
- IP address, geolocation metadata at country/city level;
- device type, operating system, browser version and language settings;
- system logs (access and error logs), referrer URL, session duration and the frequency of technical requests (for rate-limiting monitoring).
3. Purposes of processing and legal bases
Personal data is processed on the following bases provided for by the Law of Georgia on Personal Data Protection:
| Purpose of processing | Data category | Legal basis |
|---|---|---|
| Account registration, authentication and session management | Email, password hash, Google ID, session token | Conclusion and performance of the contract (Terms of Service) |
| AI legal analysis and generation of responses | Prompts, uploaded files, chat context, AI response | Performance of the contract (processing the User’s request) |
| Administration of subscriptions, payments and billing | Plan, amount, transaction ID, card token and last 4 digits | Performance of the contract and statutory accounting/tax obligations |
| System security, fraud and cyber-attack prevention | IP address, device data, system logs | Legitimate interest of the Company and legal obligation |
| Service communication and notifications | Email, security and payment notifications | Performance of the contract and the statutory notification obligation |
| Defence of legal claims and management of disputes | Historical account, billing and support records | Legal obligation and the legitimate interest of the Company (defence of rights) |
4. AI specifics and sensitive information
4.1. Technical provider: the Genesys AI functionality is built on leading technology solutions, including Google’s Gemini API. To process a request sent by the User, the system transmits to the provider only the context necessary to generate that specific response (the prompt, the uploaded file, the current chat history).
4.2. No model training: Genesys does not permit third-party AI providers to use the User’s legal prompts, documents or generated responses to train or improve public AI models, except where the User gives separate, express and informed consent to this.
4.3. Not an automated decision: responses generated by Genesys are not legally binding, solely automated decisions. The final assessment and the decision remain entirely with the User or with the relevant professional lawyer.
4.4. Special categories of (sensitive) data
- Given the nature of legal matters, uploaded materials may contain special categories of personal data (health status, criminal record, political opinions, family disputes, and so on).
- The User is obliged to upload such information only where they have an appropriate legal basis and where it is strictly necessary for the specific analysis.
- Genesys urges the User to de-personalise (anonymise) any superfluous data identifying third parties before uploading.
5. Data recipients and sub-processors
Genesys does not sell or otherwise dispose of personal data. Data is transferred only to those trusted partners that ensure the technical and financial operation of the Platform:
- firebase Inc.: secure database infrastructure, authentication management and encrypted file storage;
- Google LLC: Google user authentication and the Gemini API AI processing engine;
- Vercel Inc.: web application hosting, edge infrastructure and system performance monitoring;
- Bank of Georgia (BOG): licensed payment institution — payment processing in a PCI-DSS secure environment, card tokenisation and dispute administration;
- State and law-enforcement authorities: data is transferred only in the cases expressly provided for by Georgian legislation, on a duly substantiated legal basis and pursuant to a court ruling.
6. International data transfers
Some of the Genesys technology partners (Google, firebase, Vercel) operate on global, multi-region cloud infrastructure. International data transfers are carried out in full compliance with the requirements of Chapter 6 of the Law of Georgia on Personal Data Protection — on the basis of data processing agreements (DPAs) concluded with the providers, standard contractual clauses (SCCs) and international security certifications (SOC 2, ISO 27001).
7. Data retention schedule
Genesys retains data only for as long as is objectively necessary to achieve the purposes of processing:
| Data category | Retention period and rule |
|---|---|
| Account and profile data | For the entire period the account is active; a maximum of 30 calendar days after the account is closed. |
| Chats, documents and AI history: Starter plan | Automatically deleted 3/6/12 months after generation (or when manually deleted by the User). |
| Chats, documents and AI history: Pro plan | Retained for 3/6/12 months, after which they are subject to automatic deletion. |
| Chats, documents and AI history: Expert plan | Retained for the entire period the account is active, until manually deleted by the User. |
| System and security logs | For as long as is reasonably necessary for cybersecurity, error diagnostics and audit (normally 30 to 90 days). |
| Backups | A rotating backup cycle — a maximum of 90 calendar days, after which older copies are automatically overwritten. |
8. Rights of the data subject (the User)
In accordance with the Law of Georgia on Personal Data Protection, you have the right to:
- receive information about the processing of your data and request a copy of it;
- request rectification or updating where the data is erroneous, inaccurate or incomplete;
- request that processing cease, or that the data be erased (the “right to be forgotten”) or blocked, where there is no longer any legal basis for processing it;
- withdraw your consent where processing was based on that consent (withdrawal does not affect the lawfulness of processing carried out before withdrawal);
- request data portability — to receive your data in a structured, commonly used format;
- challenge the processing — by contacting us directly at privacy@genesys.ge, or by applying to the supervisory authority, the Personal Data Protection Service (7 N. Vachnadze St, Tbilisi; pdps.ge), or to a court.
The standard time for handling a request is no later than 10 business days.
9. Security measures and incident management
9.1. Technical protection: Genesys applies industry standards — full encryption of data in transit (TLS/SSL HTTPS), encrypted databases (encryption at rest), role-based access control (RBAC) and two-factor protection.
9.2. Security incident notification (the 72-hour rule)
If a personal data security breach (incident) is detected, Genesys immediately contains the incident and, in accordance with Georgian legislation:
- notifies the Personal Data Protection Service no later than 72 hours after the incident is identified, where the incident poses a risk to the rights of natural persons;
- where there is a high risk, immediately notifies the affected users directly, in the manner established by law.
10. Data of minors
The Platform is not intended for persons under 18 years of age. Genesys does not knowingly collect or process the personal data of minors. Should such a fact come to light, the data is subject to immediate deletion.
11. Cookies
11.1. Genesys uses strictly necessary (essential) cookies to maintain user authentication, to protect against CSRF attacks and for the proper operation of the system.
11.2. Analytical or functional cookies (where such are used) are activated only in the manner established by law. The User may restrict the use of cookies at any time from their browser settings.
12. Changes and updates to the Policy
Genesys reserves the right to update this Policy from time to time. Changes take effect as soon as they are published on the website. Users will be informed of material changes by email or through an in-platform information message.
13. Contact details
You may contact us in relation to privacy, personal data or the exercise of your rights:
- Email: privacy@genesys.ge / support@genesys.ge