Legal

Privacy Policy

Effective date: 29 May 2025 · Geyserich, Luxembourg

1. Who We Are

Stirpe is operated by Geyserich, a company founded by Yann Strainchamps and based in Luxembourg. For the purposes of the General Data Protection Regulation (EU) 2016/679 (GDPR), Geyserich is the data controller for personal data processed through the Stirpe service.

Contact: contact@geyserich.com

2. Data We Collect

We collect and process the following categories of personal data:

Account data

Your name and email address, provided via Google sign-in or email/password authentication.
A unique user identifier generated at account creation.

Document data

Images or files of historical documents you choose to upload for analysis.
AI-generated outputs: transcriptions, translations, genealogical findings, historical context, and timeline data derived from your uploads.

Knowledge graph data

Structured genealogical information extracted from your documents: persons (names, dates, places), family units, relationships between persons, and historical locations.

Usage data

Anonymous analytics (page views, feature usage) collected only with your consent via Vercel Analytics.
Session authentication tokens (necessary cookies).

3. Special Category Data

Genealogical data — particularly information about ancestry, ethnic or national origin, and family health history — may constitute special category data under Article 9 GDPR. By uploading historical documents and using the Stirpe analysis service, you provide explicit consent (Article 9(2)(a) GDPR) to the processing of such data for the purpose of genealogical research and family history analysis.

You may withdraw this consent at any time by deleting your analyses from your history and requesting account deletion (see Section 8). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4. Legal Basis for Processing

Performance of contract (Art. 6(1)(b)): processing your account data and documents to provide the Stirpe analysis service you have requested.
Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)): processing special category genealogical data; loading optional analytics cookies.
Legitimate interests (Art. 6(1)(f)): operating and improving the platform, preventing fraud and abuse, maintaining security.

5. How We Use Your Data

To authenticate you and maintain your session.
To process your uploaded documents through AI analysis and return results.
To store your analysis history so you can access it across sessions.
To build a personal genealogical knowledge graph from your documents.
To send authentication emails (magic links or verification) where applicable.
To improve the service, with your consent, via aggregate usage analytics.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We do not use your genealogical data to train AI models.

6. Third-Party Processors

We use the following sub-processors to operate the service. All are bound by data processing agreements and appropriate safeguards for international transfers where applicable.

Anthropic, PBC (United States) — AI document analysis. Documents you upload are transmitted to Anthropic's API for processing. Anthropic's usage policies prohibit using API inputs to train models. Data is processed transiently and not retained by Anthropic beyond the request. Transfer basis: Standard Contractual Clauses.
Supabase, Inc. (United States, EU region available) — cloud database hosting for your account data, analyses, and knowledge graph. We store data in the EU region where available. Transfer basis: Standard Contractual Clauses.
Vercel, Inc. (United States) — hosting, deployment, and optional analytics. Transfer basis: Standard Contractual Clauses.
Google LLC (United States) — OAuth authentication. Transfer basis: Standard Contractual Clauses.
Resend, Inc. (United States) — transactional email delivery. Transfer basis: Standard Contractual Clauses.

7. Data Retention

Account data: retained until you request account deletion.
Analyses and documents: retained until you delete them from your history, or until account deletion.
Knowledge graph entities (persons, families, relationships, locations): retained until you delete the underlying analyses or request erasure.
Analytics data: retained per Vercel's standard retention period (90 days), applicable only where you have consented.

8. Your Rights

Under the GDPR you have the following rights:

Access (Art. 15): request a copy of the personal data we hold about you.
Rectification (Art. 16): request correction of inaccurate data.
Erasure (Art. 17): request deletion of your data. You can delete analyses directly from your history; for full account deletion contact us.
Restriction (Art. 18): request that we restrict processing of your data in certain circumstances.
Portability (Art. 20): receive your data in a structured, machine-readable format. Use the Export function in your account, or contact us.
Object (Art. 21): object to processing based on legitimate interests.
Withdraw consent: withdraw consent for special category processing or analytics at any time without affecting prior lawful processing.

To exercise any right, contact us at contact@geyserich.com. We will respond within 30 days.

9. Cookies

Essential cookies: session authentication tokens set by NextAuth. Required for the service to function. No consent required.
Analytics cookies: Vercel Analytics, enabled only with your explicit consent. You can change your preference at any time via the cookie banner.

10. Data Security

We implement appropriate technical and organisational measures including database-level Row Level Security (each user's data is isolated at the database layer), encrypted connections (TLS), and access controls. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

11. Supervisory Authority

You have the right to lodge a complaint with the Luxembourg supervisory authority:

Commission nationale pour la protection des données (CNPD)
15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg
cnpd.public.lu

12. Changes to This Policy

We may update this policy as the service evolves. Material changes will be communicated by updating the effective date and, where appropriate, by email. Continued use of Stirpe after changes constitutes acceptance of the updated policy.

Questions? contact@geyserich.com · Terms of Service