Legal
Privacy Policy
Last updated: 21 September 2026
Who we are
EuroComply ("we", "us", "our") is an automated compliance tool for EU regulation. It classifies AI systems under the EU AI Act from a questionnaire, and scans publicly accessible web pages for the European Accessibility Act (EAA) and the General Product Safety Regulation (GPSR).
For GDPR purposes, the data controller is:
Contact: privacy@eurogpsr.com
Data we collect
We collect only what is necessary to provide the service.
| Account data | Name, email address, and profile photo from Google when you sign in with Google OAuth. | Contract (Art. 6(1)(b) GDPR) |
| Scan data | The URL you submit, the HTML we fetch from that URL, and the analysis results. We do not store the raw HTML long-term, only the derived findings. | Contract / Legitimate interest |
| AI Act assessment data | Your answers to the questionnaire, the optional company name and website you enter, and the computed result. Anonymous assessments are not linked to an account. | Contract / Legitimate interest |
| Email for your result | If you ask us to email an assessment result, your email address and whether you ticked the optional follow-up box. Used only to send that result and, only if you ticked it, one follow-up email. Every email has a one-click unsubscribe. | Your request (Art. 6(1)(b)); consent for the follow-up (Art. 6(1)(a)) |
| Compliance Pack purchase | The assessment you bought the pack for, the email you gave at checkout, and the Stripe payment references. No account is needed. | Contract (Art. 6(1)(b)) |
| Usage data | Pages visited, features used, and timestamps, from server logs and Vercel Web Analytics, which measures page views without cookies and without identifying individual visitors. When our AI Act widget is embedded on another website, we also record the hostname of that website; the answers given in the widget never leave the browser. | Legitimate interest (Art. 6(1)(f)) |
| Advertising | Our public guide and blog pages show ads served by Google AdSense. In the EEA, UK and Switzerland Google shows its own consent message first and only personalises ads if you allow it. We do not send Google your account, assessment or scan data. | Consent (Art. 6(1)(a)) where required |
| Payment data | Billing details are handled exclusively by Stripe. We never see or store raw card numbers. | Contract |
| Cookies | Strictly necessary session cookies to keep you signed in. See our Cookie Policy for details. | Legitimate interest |
How we use your data
- To create and manage your account
- To run scans and deliver results
- To process subscription payments via Stripe
- To send you transactional emails (results you asked for, purchase access, scan completion, account changes)
- To improve the service based on aggregated, anonymised usage patterns
- To comply with legal obligations
We do not sell your data and we do not share account, assessment, or scan data with advertisers. Advertising on public pages is handled by Google under the consent choices described above.
Data retention
| Account data | Until you delete your account, plus 30 days |
| Scan results | Free plan: 7 days. Starter: 90 days. Pro: 365 days. |
| AI Act assessments | Anonymous assessments: 90 days. Assessments with a purchased Compliance Pack are kept so your permanent access link keeps working. |
| Email for your result | Until you unsubscribe or ask us to delete it. Unsubscribing stops all further emails. |
| Payment records | As required by Spanish and EU tax law (generally 7 years) |
| Server logs | 30 days rolling window |
Sharing and processors
We share data only with the following trusted processors, each bound by a Data Processing Agreement:
| Supabase | Database, authentication | EU region (Frankfurt) |
| Vercel | Hosting, serverless functions | EU region available |
| Stripe | Payment processing | EU data centre |
| Resend | Sending transactional and opt-in emails | May be processed outside the EU/EEA, under Standard Contractual Clauses |
| Google (AdSense) | Advertising on public guide and blog pages | Global; governed by Google's consent message in the EEA |
We do not transfer personal data to countries outside the EU/EEA without appropriate safeguards (Standard Contractual Clauses where applicable).
Your rights under GDPR
As a data subject in the EU/EEA, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten")
- Restrict or object to processing
- Receive your data in a portable format
- Withdraw consent at any time where processing is consent-based
- Lodge a complaint with your national data protection authority
To exercise any of these rights, email privacy@eurogpsr.com. We will respond within 30 days.
Security
We implement appropriate technical and organisational measures to protect your data: encrypted connections (TLS 1.2+), hashed credentials, row-level security in the database, and access controls limited to personnel who need it.
No system is impenetrable. If you discover a security issue, please disclose it responsibly to security@eurogpsr.com.
Children
EuroComply is not directed at children under 16. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it promptly.
Changes to this policy
We may update this policy as the service evolves. Material changes will be announced via email and noted at the top of this page with a new "Last updated" date. Your continued use of the service after changes take effect constitutes acceptance.
Contact
Questions about this policy or our data practices:
privacy@eurogpsr.com