Last updated 21 August 2026.
EFTA Court Search is a free research tool operated by Professor Daniel Naurin, Department of Political Science, University of Oslo (daniel.naurin@stv.uio.no), who is the data controller for the personal data described below.
What we store
- Account data: Your email address and, if you provide one, your name.
- Usage data: The queries you submit, the answers the system generates (including which judgment paragraphs were retrieved and cited), any ratings or feedback you leave, and technical metadata (timestamps, response times, token counts). Usage data is keyed to a one-way cryptographic hash of an internal identifier — your email and name live in a separate authentication store and are not joined to query logs in routine analysis.
- Abuse-prevention data: A one-way hash of your IP address, used for rate limiting. Raw IP addresses are not written to the query logs.
- Server logs: Standard web-server logs, kept on the server with bounded rotation (old entries are overwritten).
Why we store it
- To operate the service: process your query, generate an answer, keep you signed in.
- To prevent abuse: rate limits and a daily cost cap.
- For academic research: we study legal information retrieval. Anonymised query logs help us measure and improve how well the system finds and summarises EFTA Court case law.
Who processes it
Query text is sent to Anthropic (the maker of the Claude language models) to generate answers, under Anthropic's commercial API terms (not used to train models). Sign-in emails are delivered via Resend. The service is hosted on Hetzner infrastructure in the EU/EEA. We do not sell or share your data with anyone else, and there is no advertising or third-party analytics.
How long we keep it
- Account data: Until you ask us to delete it.
- Usage data: Retained for the duration of the research project.
- Rate-limiting and sign-in attempt records: Deleted after 30 days.
- Server logs: Bounded rotation, typically a few weeks.
Cookies
One essential session cookie keeps you signed in. There are no tracking, analytics or advertising cookies.
Your rights
You can ask for a copy of the data linked to your account, or for its deletion, by emailing daniel.naurin@stv.uio.no from the address you signed up with. Deletion removes your account and hard-deletes your query history (an audit record of the deletion itself is kept). You can also complain to the Norwegian Data Protection Authority (Datatilsynet).
A practical note
Queries are processed by a language model and logged for the purposes above, so every question you type is stored. Do not enter confidential information: use the system to research the case law, and keep client names, case facts and anything covered by professional secrecy out of your questions.