Supple Mental News Knowledge

Legal Information

Privacy Policy and Cookies

This policy describes the rules for processing personal data and the use of cookies on the Supple Mental website, available at supplemental.pl, and the C.L.A.I.M.S. tool available at app.foodlaw.ai (web interface, public API and MCP connector).

1. Data Controller

The controller of personal data is Supplemental, tax identification number (NIP) 524-148-40-31, operating at: ul. Floriańska 6/1, 03-707 Warszawa, Poland ("Controller"). For data protection, AI-system or rights requests, contact [email protected], +48 608 699 845, or the Contact section.

2. Scope of Processed Data

Depending on how you use the website, the Controller may process the following categories of data:

  • data voluntarily provided in email or telephone correspondence (e.g. name, company, email address, phone number, enquiry content);
  • content of AI queries, conversation history and text extracted from voluntarily attached PDF/DOCX files;
  • technical data related to use of the website (e.g. IP address, date and time of visit, cookie identifiers, browser and operating system information);
  • C.L.A.I.M.S. local-storage history containing up to 20 recent analyses and feedback data;
  • data voluntarily provided to external xAI/Grok if the User independently proceeds to that service.

3. Purposes and Legal Bases for Processing

Personal data may be processed for the following purposes and on the following legal bases:

  • responding to an email or chatbot lead enquiry - Art. 6(1)(b) GDPR where processing is requested before a contract, and Art. 6(1)(f) GDPR for correspondence management and claims;
  • providing and securing electronic services, including AI tools, and handling abuse, errors and incidents - Art. 6(1)(f) GDPR;
  • processing queries by infrastructure and AI-model providers only as necessary for the function selected by the User - Art. 6(1)(b) or (f) GDPR, depending on context;
  • direct marketing by electronic communications - only with any consent required by applicable law;
  • establishing, pursuing or defending claims - Art. 6(1)(f) GDPR.

4. Data Retention Period

Personal data will be processed for the period necessary to achieve the relevant purpose, and subsequently for the period required by law or corresponding to the limitation period for claims. In particular, LL LEM conversation content is not archived by the Controller, C.L.A.I.M.S. history is stored locally in the browser until deleted, technical Cloudflare logs may be retained for up to 72 hours, and chatbot lead data is stored in Cloudflare KV for up to one year using TTL. Feedback may be present in infrastructure logs for the period necessary for security and service quality. Consent-based data is processed until consent is withdrawn unless another legal basis applies.

5. Data Recipients

Personal data may be transferred to entities cooperating with the Controller in the operation of the website, in particular:

  • hosting and IT service providers;
  • Anthropic, PBC (San Francisco, USA) - provider of the Claude language model on which LL LEM is based, to the extent necessary to generate a response to the User's query;
  • Cloudflare, Inc. (San Francisco, USA) - infrastructure provider (hosting, CDN, Workers), to the extent necessary for network traffic handling and security;
  • entities providing accounting, legal and advisory services;
  • public authorities - to the extent and on the terms specified by law.

For the tools available at app.foodlaw.ai, the active C.L.A.I.M.S. analysis sends the User's query, optional substances/doses and database context to Anthropic to generate a response with Claude. Cloudflare provides infrastructure, Workers, KV, CDN and security. If the User voluntarily proceeds to grok.com, xAI processes data under its own terms; the Controller does not control that external service.

6. Rights of the Data Subject

The data subject has rights under the GDPR, in particular:

  • right of access to data and to receive a copy thereof;
  • right to rectification (correction) of data;
  • right to erasure ("right to be forgotten") in cases provided by law;
  • right to restriction of processing;
  • right to data portability;
  • right to object to processing based on Art. 6(1)(f) GDPR;
  • right to withdraw consent at any time - to the extent that data is processed on the basis of consent;
  • right to lodge a complaint with the supervisory authority (in Poland: President of the Personal Data Protection Office - UODO).

7. Cookies and Similar Technologies

The website may use cookies and similar technologies (e.g. local storage) for the following purposes:

  • ensuring proper functioning of the site and maintaining user sessions;
  • ensuring security (e.g. detecting abuse);
  • creating anonymous usage statistics;
  • operating external tools, in particular the AI chatbot.

The tools available at app.foodlaw.ai (C.L.A.I.M.S., API, MCP connector) use only the technical local storage necessary for the tool to function, and no analytics or third-party tracking cookies.

The optional weather widget in the site header defaults to Warsaw. You may type a city or use the device location after browser permission. The request goes to Open-Meteo (including city geocoding). The last chosen place may be stored in the browser’s localStorage so the next visit does not reset to Warsaw. More information: Open-Meteo.

You can independently determine the conditions for storing or accessing cookies in your browser settings, including disabling them entirely. However, restricting the use of cookies may affect some functions available on the website.

8. Data Collection within the AI Chatbot (LL LEM)

LL LEM (Large Language Legal Expert Model) available on supplemental.pl is based on the Claude language model, provided by Anthropic, PBC, based in San Francisco, USA. The intermediary infrastructure (backend) operates on the Cloudflare Workers platform.

8.1. Scope of Data Processed within the Chatbot

The following data is processed when using LL LEM:

  • content of queries entered by the User;
  • up to 10 recent messages of the conversation, which may be sent to Anthropic with the new query;
  • text extracted from voluntarily attached PDF/DOCX files (up to 5 MB), sent to Anthropic with the query;
  • email address voluntarily provided through chatbot lead capture;
  • IP address and technical HTTP metadata processed by Cloudflare for technical and security purposes.

8.2. Data Transfer to Anthropic

The query, conversation history and, where attached, extracted PDF/DOCX text are transmitted to the Anthropic API solely to generate a response. The Controller does not send the email address as a separate field, but cannot prevent the User from entering identifying data in a message or file. Anthropic processes data under its privacy policy and API data usage policy. Any statement about non-training of API data depends on the provider's current terms and account configuration.

8.3. International Data Transfers

Due to the location of Anthropic's servers (USA) and Cloudflare (global CDN), data may be transferred outside the European Economic Area. The transfer is carried out on the basis of Standard Contractual Clauses (SCCs) applied by Cloudflare and compliance mechanisms declared by Anthropic.

8.4. Retention Period

Conversation history is held in the browser while using the widget and is not archived by the Controller. Extracted attachment text is processed in the worker for the current response. Cloudflare Workers technical logs, including error logs and request metadata, may be retained for up to 72 hours. Chatbot lead data (email, shortened conversation summary, timestamp and IP hash) is stored in Cloudflare KV for up to one year using TTL.

8.5. Recommendations for Users

The chatbot is informational in nature and does not replace individual legal advice. It is recommended not to transmit special categories of data (e.g. health data), sensitive data, trade secrets or other confidential information via the chatbot. If you need to discuss the details of a specific case, please contact the Controller through the Contact details or email.

8.6. Contact Form in the Chatbot (Lead Capture)

The User may voluntarily provide an email address in the contact form built into the chatbot widget in order to receive an individual analysis of their case.

Purpose of processing: contacting the User in connection with their enquiry - Art. 6(1)(b) and (f) GDPR (actions at the request of the data subject and the Controller's legitimate interest in handling enquiries).

Data stored:

  • the email address provided by the User;
  • a summary of the conversation conducted in the chatbot;
  • the timestamp of form submission;
  • a pseudonymised IP address (SHA-256 hash).

Storage location: the data is stored in Cloudflare KV (key-value store) within Cloudflare's infrastructure.

Retention period: one year from submission. After this period, the data is automatically deleted using TTL.

Data transfers: the lead capture payload (email, summary, timestamp and IP hash) is stored in Cloudflare KV and is not sent to Anthropic as part of the lead request. If the User includes personal data in the summary, it may be stored there. Providing an email for an enquiry is not, by itself, consent to marketing.

The User may request deletion at any time by contacting the Controller via the Contact details or email.

8a. Data within Konstruktor Praw (voice assistant)

Konstruktor Praw (paths such as /rozmowa/ and localized equivalents) is a separate AI product from LL LEM. After you grant microphone permission in the browser, speech may be transcribed locally via the Web Speech API; typed text may be used instead. The message, up to recent conversation turns, and a language code are sent to the Cloudflare Worker endpoint /rozmowa/chat and onward to Anthropic (Claude) to generate a reply. Spoken answers use the browser’s speechSynthesis; audio is not uploaded as a raw recording by the Service Provider. IP and technical HTTP metadata may be processed by Cloudflare for security. Do not dictate or type special-category, health, trade-secret or other confidential data. Mic access can be revoked in browser settings.

9. Data processed by C.L.A.I.M.S., the API and the MCP connector (app.foodlaw.ai)

The C.L.A.I.M.S. interface processes the query, optional substance list and doses, and local database context. The active analysis function sends this content to Anthropic to generate a Claude response. The interface stores up to 20 recent analyses (queries, substances and results) in the User's browser local storage. Feedback is sent to the feedback endpoint and may appear in Cloudflare logs. The User should not enter personal, health, confidential or trade-secret data.

The tools are informational and auxiliary, do not profile natural persons and are not used to make automated decisions producing legal or similarly significant effects for them. AI results require human verification. Errors or transparency incidents may be reported to [email protected].

10. AI transparency

LL LEM, Konstruktor Praw and C.L.A.I.M.S. are AI systems. The interface identifies AI interaction no later than the first interaction, in line with Article 50 of Regulation (EU) 2024/1689. The systems are informational and auxiliary, require human verification and are not intended for automated decisions about natural persons. The full regulation is available on EUR-Lex.

11. Voluntary Nature of Providing Data

Providing data is voluntary; however, in some cases failure to provide data may prevent the Controller from responding to an enquiry or concluding a contract. AI tools do not require identifying data, but the selected AI function sends the query to the model provider.

12. Changes to the Privacy Policy

This privacy policy may be updated periodically, in particular in the event of changes to legislation or changes to the way the website operates. The current version is always available in this section. Document version: 11 September 2026.