docs(legal): privacy section for the data assistant preview

[MarkusNeusinger]

Summary

This PR adds an "only if you use the data assistant (preview)" part to the privacy section of the legal page. It describes the admin-only "use with my data" chat as a preview, so the text stays correct the day the chat opens.

• Opens the part with a scope line (owner addition of 2026-10-16): everything in it applies only to people who use the assistant, and readers who only browse the catalogue aren't affected. The processor row and the table intro say the same.

• Adds the model provider and region, the session lifetime, the usage telemetry, the attribution lines, the feedback cases, a legal basis per purpose, and a hint not to paste personal data you aren't allowed to share.

• Adds an "ai assistant" row to the processor table and names the assistant's region in the table's intro.

• Splits the "no ai training" bullet: browsing the catalogue keeps the old claim, and the assistant is named as the one place where input reaches a model.

• Limits the data controller's "the ground for all of it is legitimate interest" to the site itself, because the assistant now names its own grounds.

• Extends "your rights" to assistant feedback cases, including early deletion through the existing admin@ line.

• Pins the new claims in app/src/pages/LegalPage.test.tsx, and replaces the "page stays unchanged for now" paragraph in docs/reference/agent-telemetry.md with a pointer to the new section.

Claims and their sources

Claim on the page	Source
A preview that only the operator and the site's admins can open	api/routers/agent.py routes under /debug/agent, gated by require_admin_identity (api/routers/debug.py)
Claude models by Anthropic, through Google Cloud Vertex AI in the EU	agents/anyplot/settings.py (provider="anthropic-vertex", location="eu"); agents/cloudbuild.yaml (AGENT_LOCATION=eu, _PROVIDER: anthropic-vertex); live service env checked with gcloud run services describe anyplot-agents
Processed under Google Cloud's data processing terms; not used to train models under Google Cloud's terms for Vertex AI	Owner decision of 2026-10-16 (Google's terms, not verifiable in code)
Sessions are in server memory only, cleared after an hour without activity or when the instance stops; no session database	agents/main.py (InMemorySessionService); agents/anyplot/settings.py session_idle_s = 3600, not overridden in agents/cloudbuild.yaml
The separate render service keeps its last 16 results (converted data, plot images) in memory until newer renders push them out or its instance stops (Copilot finding)	agents/renderer/main.py DONE_CACHE = 16, _forget (no time-based expiry)
Telemetry fields, and never text, data, column names or file names	docs/reference/agent-telemetry.md ("What is recorded"); agents/anyplot/telemetry.py (extra="forbid", closed sets)
Salted session hash whose salt lives only as long as the instance; no user id; pseudonymous	agents/anyplot/plugins/ledger.py SESSION_SALT, salted; docs/reference/agent-telemetry.md ("Session hash", "No user id")
Up to 180 days in a Cloud Logging bucket in europe-west4, read through BigQuery	docs/reference/agent-telemetry.md ("Where the lines go"); gcloud logging buckets list shows the europe-west4 bucket with 180 days and the agent-telemetry sink
Attribution and rate-limit lines carry a keyed hash (HMAC) of your identity and no content, in the server logs for 30 days	api/routers/agent.py derive_user_id (HMAC-SHA256 under AGENT_USER_ID_KEY); agents/anyplot/plugins/ledger.py attribution; 30 days is the existing server-log claim (_Default bucket, 30 days)
A feedback case is stored only when you send feedback on a result or on the chat	api/routers/agent.py submit_feedback; app/src/sections/agent-chat/ResultFeedback.tsx, ChatFeedback.tsx
The case holds the conversation, the data profile, the plot's code and images if one was made	agents/main.py bundle (transcript, profile, bindings, PNGs, code); api/agent_cases.py module docstring
The profile includes the first 5 rows as a sample	agents/anyplot/data/parse.py (sample=rows[:MAX_SAMPLE_ROWS]); agents/anyplot/schemas.py MAX_SAMPLE_ROWS = 5
The whole data file only while "# include data.csv" is ticked, which it is by default; unticking leaves out that file only (Copilot finding)	app/src/sections/agent-chat/ResultFeedback.tsx (useState(... ?? true)); api/routers/agent.py FeedbackBody.include_data (required, strict bool); api/agent_cases.py (the manifest keeps the bundle, profile included, whatever include_data is)
Files in a private bucket in europe-west4, deleted after 180 days	api/agent_cases.py docstring; gcloud storage buckets describe gs://anyplot-agent-cases (EUROPE-WEST4, delete rule at age 180)
The row holds the reaction, the short message, a keyed hash of your identity and run details, and has no timer	core/database/models.py AgentFeedback (reaction, message, user_hash, spec_id, library_id, model, ...); docs/reference/database.md ("the row stays")
Legal basis per purpose: Art. 6(1)(b), Art. 6(1)(f), explicit submission	Owner decision of 2026-10-16
Processor row "Google Cloud Vertex AI, Claude models by Anthropic (EU) — only when you use the data assistant"	Owner wording, same sources as the model claim
Browsing the catalogue isn't affected by any of the assistant's processing	Owner addition; the assistant is reachable only under /debug/agent

No existing claim was dropped. Two were narrowed on purpose, both because they would otherwise be false once the assistant is described:

• "the ground for all of it is legitimate interest" now covers the site itself, with the assistant's grounds named in its own part.
• "the ai ... never sees a visitor's request" now applies to browsing the catalogue, and the assistant is named as the exception.

Testing

• yarn lint, yarn fm:check, yarn type-check, yarn build: pass.
• yarn test: 1161 of 1162 pass. DataPanel.test.tsx "asks before it replaces text in the box" failed once under full-suite load and passes three runs in isolation. It's unrelated to this change.
• uv run python -m tools.changelog check --base origin/main: pass.
• Browser check of /legal on the production build (vite preview) with Playwright: desktop 1280 px in light theme and mobile 375 px in dark theme. There's no horizontal scroll, and the new table row wraps cleanly. The console errors come only from the missing local API and from font CORS on localhost.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GdMSqLR5ww4ji74EUSmk9M

[Copilot]

🟡 Changes recommended

The disclosures overstate session-data expiry and what the feedback CSV opt-out excludes.

2 open findings

• Renderer cache lacks the advertised one-hour expiry · New
• Excluding data still retains profile samples and case data · New

What changed in this PR

Adds privacy disclosures for the data assistant preview alongside the existing catalogue policy.

Changes:

• Documents model processing, retention, telemetry, feedback cases, and legal grounds.
• Updates processor information and deletion rights.
• Adds disclosure tests and aligns telemetry documentation.

File	Description
docs/​reference/​agent-telemetry.md	Links telemetry documentation to the legal disclosures.
changelog.d/​legal-ai-assistant.md	Records the privacy policy update.
app/​src/​pages/​LegalPage.tsx	Adds assistant disclosures and updates existing claims.
app/​src/​pages/​LegalPage.test.tsx	Checks the new privacy wording.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

🔵 Needs a closer look

Legal grounds, provider terms, and deployed retention commitments require final human confirmation.

0 open findings

2 resolved since last review

• Excluding data still retains profile samples and case data
• Renderer cache lacks the advertised one-hour expiry

🧠 Review effort: Balanced