Purpose: structured Q&A pack for a privacy lawyer / GDPR specialist. Estimated cost: $500-1000 one-time review (per § XV blocker #5). Status: awaiting external review. Internal due diligence complete.

TL;DR for the lawyer

ARNO is preparing to launch the URL-import feature: at registration, a new user provides a URL → ARNO extracts React components from the public page → the user edits them in the editor → optional push to git.

Three legal concerns:

1. Shadow data collection for AI model training (anonymized)
2. Copyright attestation on user-imported URLs
3. GDPR compliance for extracted data and retention

Pre-drafted materials:

• url_import_tos_clause_draft.md — proposed ToS/Privacy clauses (5 sections)
• url_import_spec.md § XI.3-XI.4 — technical implementation

We seek validation that the approach is GDPR/CCPA-compliant, plus identification of gaps.

Q1. GDPR legitimate interest basis for shadow data collection

Pattern: industry standard (Linear, Figma, Notion, GitHub Copilot, Cursor) — default-ON anonymized data collection, disclosed in ToS, opt-out in Settings.

ARNO implementation:

• URLs hashed via SHA-256 (irreversible)
• Component metadata stripped of PII (user IDs, email, auth tokens, PII in query params)
• Stored separately from user-identifiable account data
• Disclosure: ToS + Privacy Policy section at registration
• Opt-out: Settings → Privacy → "Anonymous data contribution" toggle
• Right to erasure: "Delete past contributions" button → cascading delete

Specific questions:

1. Is the GDPR Art. 6(1)(f) legitimate interest basis appropriate? Or do we need Art. 6(1)(a) explicit consent (= registration checkbox)?

2. Is our "anonymization" sufficient for GDPR Art. 4(5)? We hash URLs (one-way), but the hashed URLs are linked to shadow_dataset records. Records do not contain user_id or PII. But if an attacker had the original URL, they could rehash and match.

3. Balancing test documentation — what specific evidence demonstrates that the legitimate interest outweighs the data subject's rights?

4. EU AI Act (effective Aug 2026) — does the training data provenance disclosure requirement apply here? Our model improves component extraction; it is not a general-purpose AI.

Q2. Copyright attestation on user-imported URLs

Pattern: when importing a URL, the user attests one of: (a) Owned, (b) Licensed, (c) Public domain.

ARNO implementation:

• Mandatory checkbox on URL submit
• Required license_type selection
• Additional confirmation for Tranco top 15k commercial domains
• Attestation stored 7 years (legal audit)
• ARNO is not liable for third-party copyright claims

Specific questions:

1. Is user attestation sufficient legal protection? Or do we need a DMCA registered agent + safe harbor compliance?

2. For "fair use" extracted UI patterns (e.g. a small business imports apple.com by mistake):

   • Is design pattern extraction "transformative" under fair use?
   • Or does it constitute derivative work requiring permission?

3. Indemnification clause language — current draft:

   "You agree to indemnify ARNO against any third-party claims related to content you import." Sufficient? Or do we need stronger language?

4. Cross-jurisdictional issues: an EU user imports a US-hosted site. Whose law governs?

Q3. Domain reputation system (Tranco-based)

Pattern: Tranco top 15k domains flagged as "commercial" → require extra user confirmation.

ARNO implementation:

• Daily refresh Bloom filter (memory ~10KB)
• 1% false positive rate (Bloom filter inherent)
• Attribution: "Domain classification powered by Tranco (tranco-list.eu), licensed under CC-BY 4.0" in Privacy Policy footer

Specific questions:

1. Tranco CC-BY 4.0 attribution — is placement in the Privacy Policy footer sufficient? Or does it need more prominent placement (e.g. on every ARNO dashboard page)?

2. Defamation risk — ARNO flags mywebsite.com as "commercial" → a false positive embarrasses the user. Liability?

3. GDPR Art. 22 automated decision-making — does the warning constitute a "decision" affecting the user?

Q4. GDPR retention matrix

ARNO implementation (from spec § XI.4):

Specific questions:

1. Right-to-erasure (Art. 17) timeline — current promise is "30 days". Is this acceptable, or does it need to be stricter?

2. Hashed data as "personal data" under GDPR? Some interpretations: a hash with a user-known input = pseudonymization, not anonymization. Position needed.

3. "Legitimate business need" for 7-year attestation retention — sufficient? Or do we need a shorter timeframe?

4. Cascade deletion B2 + DB — saga pattern with retries. Is the 30-day deletion window achievable? Or do we need a stricter SLA?

Q5. Third-party processors disclosure

Services receiving user data:

Specific questions:

1. GDPR Art. 28 data processing agreements (DPAs) — needed for each one? We have standard DPAs available from each vendor. Is referencing them sufficient?

2. Schrems II / EU-US Data Privacy Framework — all these services are US-based. For EU users, do we need SCCs (Standard Contractual Clauses) or DPF certification?

3. Sub-processor disclosure — must we list each vendor publicly in the Privacy Policy?

4. Data localization claims: can we offer "EU data residency"? Currently no — all processing happens in the US. Impact for EU customers?

Q6. EU AI Act compliance (effective Aug 2026)

ARNO's AI usage:

• Production: Gemini Flash-Lite for vision/text analysis (third-party)
• Future (Q2+): self-hosted Qwen3-VL-32B + LoRA fine-tuned on user corrections

Specific questions:

1. Is ARNO's URL-import an "AI system" under the AI Act? We extract structured data — we do not make decisions about people.

2. Training data provenance — Qwen3-VL-235B-A22B teacher labels. Apache 2.0 license. We do not train on Anthropic/OpenAI outputs. Compliance with Art. 53 (training data disclosure)?

3. High-risk category check — Annex III categories. We do not impact:

   • Biometric ID
   • Critical infrastructure
   • Education / employment
   • Law enforcement
   • Migration
   • Justice

   Compliance: low-risk system, basic transparency only?

Q7. California (CCPA / CPRA)

Specific questions:

1. Notice at Collection — is the current ToS clause sufficient for "categories of personal information" disclosure?

2. "Sale" of personal information — we do not sell, but does anonymized data sharing with the Gemini API count?

3. "Sensitive Personal Information" under CPRA — do we collect any? (probably not — but verify)

4. GPC (Global Privacy Control) signal honoring — required to implement?

Q8. Children's data (COPPA, GDPR-K)

ARNO does not target minors. The user attests to being an adult during registration.

Question: do we need an explicit COPPA / GDPR-K disclaimer statement, or is the general ToS clause sufficient?

Q9. Liability limitations

Specific questions:

1. "As-is" disclaimer language — current ToS draft. Enforceable in all jurisdictions?

2. Limitation of liability cap — typical $X or 12-month fees? Recommendation for ARNO (small-business target market)?

3. Class action waiver / arbitration clauses — necessary for V1 launch?

Q10. Privacy Policy structure recommendation

The current draft has 5 clauses (Data Collection, URL Import, Tranco Attribution, Retention, Third-party processors).

Question: is the structure adequate, or are additional sections needed?

Standard GDPR Privacy Policy checklist (from regulators):

• Identity + contact details of controller
• DPO contact (if applicable)
• Purposes of processing + legal basis
• Recipients of personal data
• International transfers + safeguards
• Retention periods
• Data subject rights (access, rectification, erasure, etc)
• Right to withdraw consent
• Right to lodge complaint with supervisory authority
• Whether disclosure is a statutory or contractual requirement
• Automated decision-making + profiling
• Categories of personal data (if not collected from the data subject)

Which are currently covered, and which are missing?

Recommended deliverables from lawyer

1. Validated ToS clauses (1-5) — markup or rewrite
2. Validated Privacy Policy — full document for production
3. Risk assessment — biggest legal exposures + mitigation priority
4. Standard contract templates: DPA template for potential enterprise customers
5. 30-day post-launch follow-up — track regulatory changes (EU AI Act effective date specifically)

ARNO-side preparation for the legal call

The lawyer should review BEFORE the call:

• url_import_spec.md — full technical spec (especially § XI.3-XI.4)
• url_import_tos_clause_draft.md — draft clauses
• This document — Q&A pack

Vadim should be available for:

• Specific scenarios discussion (edge cases)
• Stack decisions justification (why Tranco, why default-ON, etc)
• Cost-benefit trade-offs (which compliance costs are acceptable for V1)

Cross-references

• url_import_spec.md § XV — blocker tracking
• url_import_tos_clause_draft.md — pre-drafted clauses
• ADR 0017 — shadow data approach rationale
• ADR 0016 — staging area (retention implications)