AI Usage Policy

"Zika Group" Ltd operates Legas.ai, registered in Bulgaria under UIC 200383579, VAT BG200383579, Plovdiv, Bulgaria. This Policy explains how artificial intelligence is used on the platform, what it does and does not do, and what users can expect from AI-generated outputs. It is published under Article 50 of Regulation (EU) 2024/1689 (the EU AI Act).

Legas.ai uses the Claude API, developed by Anthropic PBC, USA. Claude models are used for the following tasks:

• Generating documents. Claude Sonnet 5 (claude-sonnet-5) drafts each document from the user’s questionnaire answers.
• Organising free-text answers. Claude Opus 5.5 (claude-opus-5-5) splits two kinds of free-text answer — retention periods and the names of other tools or vendors — into separate entries, so that every document of a run reads the same record. It receives only those answers. It may not add or change anything: each entry it returns is checked against the user’s own words and discarded if it does not match.
• Reviewing answers before generation. Claude Haiku 4.5 (claude-haiku-4-5) reads the questionnaire answers and lists points the user may wish to check. It does not change any answer or document.
• Reviewing a website’s privacy and cookie policy. On the public website scan, Claude Haiku 4.5 reads the text of the scanned site’s published policies and identifies which disclosure elements they contain. The counting and scoring are done by the platform, not by the model.
• Monitoring regulatory guidance. Once a week, Claude Sonnet 5 checks for new publications of the European Data Protection Board. No user data is involved.
• Checking finished documents. Claude Opus 5.5 reads the documents of a completed package and records possible inconsistencies between them. It does not change any document. Its findings are seen only by the operator of Legas.ai and are used to improve the service.

Anthropic PBC processes this data as a data processor under a Data Processing Agreement.

The AI is used for generating GDPR compliance documents (Privacy Policy, Cookie Policy, Employee Privacy Notice, Data Processing Agreement, Records of Processing Activities, Data Breach Response Plan, DSAR Procedure, DPIA Template) and generating GDPR & Cybersecurity Recommendations Reports. It is also used to organise and review the user’s answers before generation, to review the published policies of a website submitted for a scan, to monitor regulatory guidance, and to check finished documents for inconsistencies.

The AI does not:

• make legal decisions or provide legal advice
• access external data during generation
• store user data for training
• apply automated decision-making with significant effects on users under Article 22 of Regulation (EU) 2016/679

Legas.ai is a limited risk AI system under Regulation (EU) 2024/1689. It does not fall within the prohibited practices in Article 5 or the high-risk categories in Annex III. Under Article 50, the Company discloses that all documents are AI-generated.

Article 6 reserves the high-risk classification for AI systems that make or substantially influence decisions about natural persons in specific areas: employment screening, creditworthiness assessment, biometric identification, law enforcement, justice administration, and access to essential private services.

Legas.ai generates compliance documentation. The user reads the output, edits it if needed, and decides whether to publish. Nothing is sent anywhere without a human making a deliberate choice to do so.

Article 50 covers AI systems that produce content for natural persons. The requirement is disclosure. This Policy, the intake form, the document preview, and the footer of every generated document carry that disclosure.

The AI-generated nature of every document is disclosed:

• on the intake form before submission
• on the document preview page before download
• in the footer of every generated document (“Generated by Legas.ai — for review by qualified legal counsel before publication”)
• in the Terms and Conditions

AI-generated documents should be reviewed by a qualified lawyer before use. Retention periods and references to national law are stated in general terms and should be confirmed for your jurisdiction with a qualified professional before publication.

Every document is generated from the user’s own answers. Incomplete or inaccurate answers produce incomplete or inaccurate documents. The AI cannot verify facts.

System prompts were written by a certified GDPR specialist with 8+ years of experience and 15+ years of legal practice, and are updated when guidance changes. The platform does not warrant that any document is legally complete or fit for a specific purpose.

Each document type has a dedicated system prompt covering the GDPR articles it must address. The Privacy Policy prompt covers Articles 13 and 14. The DPA covers Article 28. The ROPA covers Article 30. Each prompt is written and maintained by a specialist and a team of legal practitioners.

Prompts are reviewed when the EDPB publishes new guidelines, when a supervisory authority decision clarifies the interpretation of an article, or when a user identifies a gap in a generated document. The platform checks edpb.europa.eu weekly. When guidance changes, the relevant prompt is updated and subscribers receive an email describing what changed and which documents they may want to regenerate.

The platform records the date each document was generated. Users can regenerate any document at any time.

Do not use the platform to:

• generate documents based on false information
• generate documents for businesses you do not represent
• attempt to extract the underlying prompts
• treat AI output as final legal advice without independent review

Data is sent to the Anthropic Claude API via HTTPS at these points: free-text retention and vendor answers when a run starts; the questionnaire answers for the review before generation; the questionnaire answers for each document generated; on the public website scan, the text of the scanned site’s policies; and, after a package is complete, its documents and the record of the user’s answers for the consistency check. This is a transfer of personal data to a processor in the USA, covered by Standard Contractual Clauses under Article 46 of Regulation (EU) 2016/679. Anthropic does not use API data to train its models. Anthropic retains the data sent through the API for up to 30 days, after which it is deleted, unless a longer period is required by law or to investigate misuse of the service.

Full details are in the Privacy Policy at legas.ai/privacy-policy.

Questions or complaints about the AI system:

"Zika Group" Ltd
UIC 200383579, VAT BG200383579
Plovdiv, Bulgaria
Email: contact@legas.ai
Website: legas.ai

This Policy is updated when the AI system changes, when applicable law changes, or when supervisory authority guidance requires it.

Is AI-generated legal content legally valid?

AI-generated content is not inherently invalid. A document built from accurate information about your business, covering the required legal elements, and reviewed before publication can satisfy the same legal standard as one drafted by a lawyer. The problem is not the source of the output — it is inaccuracy. If the inputs are wrong, the document will be wrong. You are responsible for the accuracy of what you submit and for reviewing the output before use.

Can I rely on an AI privacy policy without independent review?

This policy and the document footer both recommend having a lawyer review the output before publication. That recommendation is not a disclaimer formality. A lawyer reviewing a well-structured document takes less time than drafting from scratch, because the structure is correct and the legal basis analysis is already done. The recommendation is to review it, not to publish it and hope it holds up.

How is Legas.ai different from a GDPR template generator?

Template generators put your name on a pre-written document. Every business using that template gets the same policy, regardless of what they actually process, which processors they use, or which legal basis applies to each activity. Legas.ai generates from your answers. A SaaS company using PostHog for analytics under legitimate interests gets a different policy than an e-commerce store using Google Analytics under consent. The output describes your data processing, not a hypothetical business’s.

What should I do after downloading my document?

Read it. Confirm that the processing activities, legal bases, and processor names match your actual setup. If something is wrong, update your answers and regenerate — regeneration is included in your subscription. Have a lawyer review it if you have any doubts. Then publish it somewhere permanently accessible on your website, and update it when your processing activities change or new guidance requires it.