Impact assessment: reading by the AI

1. What the processing is

Labelmate is a desktop app on the label's own computers. It connects read-only to the mailboxes the label chooses and files contracts, invoices and distributor reports. Reading by the AI is optional and off until a person at the label turns it on for one mailbox. When on, the app sends the text of two kinds of item from that mailbox to Claude, Anthropic's AI model:

• the text of a document kept from it (a contract, an invoice, a report), to say what it is and propose values (a rate, an advance, an amount);
• the text of an email kept from it (its subject and its text), to see whether someone is waiting on the label.

Purpose: to save the label's staff time. The AI only suggests. Nothing it proposes is saved until a person at the label accepts it, and every value it proposes must be found word for word in the document's text or it is dropped. The AI never sends anything, never decides, never calculates a royalty.

2. Categories of data and of people

Masked before sending, never seen by the AI: IBANs (ISO 13616 check), payment card numbers (issuer prefixes and the Luhn check), and social security numbers of France, the United States, Canada and the United Kingdom. Each masked character becomes X, keeping the text's length. Not masked: names, addresses, phone numbers, email addresses, amounts. No special-category data (Article 9) is sought; a contract or email could contain some if someone wrote it there (health in a message explaining a delay, for example): the label weighs that.

Never sent to the AI: newsletters, automatic notifications and music submissions (set aside by a first sort on the computer), the files themselves (only their extracted text), the mailbox's password or token, anything from a mailbox whose AI is off.

3. The flow

• The email or file arrives in the label's mailbox and is read, read-only, by the app on the label's computer. It is stored there in an encrypted database (SQLCipher; key in the system keychain).
• If the AI is on for that mailbox, the app extracts the text, masks it, checks the monthly budget, and calls api.anthropic.com directly over HTTPS, with Labelmate's API key. The text does not pass through Labelmate's servers. The key reaches the computer from our relay only for a valid license token.
• Anthropic answers; the app checks the answer and keeps it on the computer, so the same text is not sent twice.
• Colleagues' computers receive what was filed through our relay as sealed copies (encrypted with keys that never leave the label's devices): the relay cannot read them.

Who receives the text: Anthropic, PBC, in the United States, as our sub-processor (data processing agreement, Annex 1).

4. Retention

• On the label's computers: as long as the label keeps its workspace; the label deletes it.
• At Anthropic: API inputs and outputs are deleted within 30 days of receipt or generation, unless a longer period is agreed, the data is flagged under Anthropic's usage policy (then up to two years), or the law requires it (privacy.claude.com, article 7996866, read September 24, 2026). Anthropic's commercial terms rule out training its models on this data.
• At Labelmate: nothing. We do not receive the text.

5. Transfer outside the EEA

To Anthropic in the United States, under the Standard Contractual Clauses (modules two and three) with the UK and Swiss addenda, in Anthropic's data processing addendum (anthropic.com/legal/data-processing-addendum, effective February 24, 2025, read September 24, 2026). Anthropic's addendum does not rely on the EU-US Data Privacy Framework.

6. Consent and control, mailbox by mailbox

• The switch is per mailbox, set when the mailbox is connected or later in Settings. Turning it on records who agreed and to which version of the consent text; a new version asks again. Without that record for the mailbox an item came from, the item is not sent to the AI, even when another mailbox on the same computer has the AI on.
• Turning it off stops a reader already running; items waiting are not sent.
• A monthly cap is checked before every call; Settings shows what was spent.
• The legal basis for the label's own processing (usually its legitimate interest in running its business, or the contract with the artist) is the label's to set and document; the consent above is the label's instruction to us, not the artists' consent.

7. Security measures

As in the data processing agreement's Annex 2: encryption on the label's computers (SQLCipher, keys in the system keychain); HTTPS to Anthropic; masking; the key handed only to licensed computers, revocable, with a cap on computers per license; content-free logs (ids, counts, durations, never a subject, a name, an amount or a body); the relay holds only sealed data; a signed and notarized Mac app; signed updates checked before install.

8. Risks the label may weigh, and what reduces them

9. How to switch it off

Settings, the mailbox, turn AI reading off. Nothing that arrived only through that mailbox is sent to Anthropic after that. Everything else in Labelmate keeps working without the AI (filing by rules, statements, the royalty calculation).

A question for your assessment? Write to contact@getlabelmate.com.