Privacy Policy

1. Data Controller

EuroComply is independently operated from Porto, Portugal (EU), trading as Brevio Ventures (operator contact details available in our Imprint). Brevio Ventures is the data controller within the meaning of Article 4(7) GDPR.

Data protection contact: privacy@eurocomply.app

2. What data we collect and why

We process personal data only to the extent necessary. The categories, purposes, and legal bases are:

We do not process special categories of data (Art. 9 GDPR). We do not engage in automated decision-making that produces legal or similarly significant effects (Art. 22 GDPR). All AI outputs are advisory and subject to human review.

3. Sub-processors and data transfers

We seek to keep all personal data within the EEA or in countries with an EU adequacy decision. Where sub-processors are incorporated in third countries, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission under Art. 46(2)(c) GDPR, supplemented by transfer impact assessments in accordance with the requirements of C-311/18 (Schrems II).

Data Processing Agreements incorporating the current EU SCCs are in place with Supabase and Vercel. The UK adequacy decision is monitored; if revoked, we will implement alternative safeguards before any further transfers. We will notify users of material changes to sub-processors. A current sub-processor list is available on request at privacy@eurocomply.app.

4. AI processing — important disclosure (Mistral AI)

All AI inference runs through Mistral AI SAS (Paris, France). No data is sent to US-based AI providers. Specific points:

• Risk classifications use rule-based decision trees combined with Mistral large language models.
• Chat uses retrieval-augmented generation (RAG) against EU regulation text stored in our EU-hosted database.
• All AI outputs carry the disclaimer: "For informational purposes only. Consult qualified legal counsel."

4a. Google API & OAuth Data

EuroComply offers optional user authentication through Google Sign-In ("Sign in with Google") utilizing Google OAuth 2.0. This section explicitly details our collection, processing, and handling of Google user data in compliance with the Google API Services User Data Policy:

• Dados recebidos via Google Sign-In: Quando inicia sessão ou cria conta utilizando o Google OAuth, recebemos exclusivamente do seu perfil público da Google:
  • Nome completo (para identificar o utilizador no espaço de trabalho);
  • Endereço de e-mail verificado (para autenticação única e comunicações transacionais);
  • Foto de perfil pública (URL da imagem para exibição no avatar do perfil de utilizador).
  Não solicitamos nem acedemos a permissões sensíveis ou restritas (como Google Drive, Gmail, Calendário ou Contactos).
• Finalidade e uso exclusivo (Criação e Gestão de Conta): Estes dados são usados estritamente para criação, autenticação e gestão da sua conta B2B e perfil no EuroComply. Não utilizamos os dados obtidos via Google para qualquer outra finalidade não relacionada com a prestação do serviço contratado.
• Sem partilha, venda ou transferências publicitárias: Não vendemos, alugamos, transferimos ou divulgamos dados de utilizadores da Google a terceiros, corretores de dados (data brokers) ou redes de publicidade.
• Proibição de treino de modelos de Inteligência Artificial: Os dados de utilizador da Google (nome, email, avatar) nunca são utilizados para treinar, afinar (fine-tuning) ou melhorar modelos de inteligência artificial ou de machine learning (incluindo modelos LLM).
• Armazenamento, segurança e eliminação: Os dados são cifrados em repouso e em trânsito e residem exclusivamente na nossa infraestrutura alojada na União Europeia (Frankfurt, Alemanha). O utilizador pode a qualquer momento eliminar a sua conta e todos os dados associados diretamente nas Definições da Conta (→ Definições → Dados) ou contactando privacy@eurocomply.app.
• Conformidade com a Política de Uso Limitado da Google: A utilização e transferência para qualquer outra aplicação de informações recebidas das APIs da Google pela EuroComply respeitam a Política de Dados do Utilizador dos Serviços de API da Google, incluindo os requisitos de Utilização Limitada (Limited Use).

4b. AI Acceptable Use & Strict Prohibition of NCII

EuroComply is an EU regulatory compliance readiness and governance platform for SMEs (covering regulations such as the EU AI Act, GDPR, NIS2, and DORA). Our AI capabilities are strictly dedicated to analyzing text-based business metadata, identifying regulatory obligations, drafting technical compliance documentation, and providing regulatory guidance.

5. Data retention

On account deletion, personal data is erased within 30 days except where retention is required by law. Database backups containing personal data are purged within 90 days.

6. Your rights

Under the GDPR you have the right to:

• Access (Art. 15) — obtain confirmation of processing and a copy of your data.
• Rectification (Art. 16) — correct inaccurate data.
• Erasure (Art. 17) — request deletion. Available in Settings → Data.
• Restriction (Art. 18) — limit processing in certain circumstances.
• Data portability (Art. 20) — receive your data in a machine-readable format (JSON). Available in Settings → Data.
• Objection (Art. 21) — object to processing based on legitimate interest (including analytics). We will cease unless we demonstrate compelling legitimate grounds.
• Withdraw consent (Art. 7(3)) — for consent-based processing (newsletter) only, withdrawable at any time, without affecting prior lawful processing.

Submit requests to privacy@eurocomply.app. We respond within 30 days (Art. 12(3) GDPR), extendable by two months for complex cases with notice. Under Art. 77 GDPR you have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement — regardless of which EU country you are in. The lead supervisory authority for Brevio Ventures is the Portuguese CNPD (Comissão Nacional de Proteção de Dados, www.cnpd.pt). A list of all EU national data protection authorities is available at edpb.europa.eu.

7. Cookies and tracking

We use only strictly necessary session cookies for authentication (Supabase Auth). These are technically essential and exempt from consent requirements under Art. 5(3) ePrivacy Directive (2002/58/EC).

Our primary analytics is first-party and EU-hosted: anonymised usage events recorded in our own Frankfurt database. It uses no cookies, records no direct identifiers such as your name or email, and is not shared with advertising networks. This processing is based on legitimate interest (Art. 6(1)(f) GDPR); you may object by contacting us. Where you grant analytics consent, we also load Google Analytics 4 for aggregated audience metrics with IP anonymisation.

We also use Microsoft Clarity (session replay and heatmaps) to understand how visitors interact with the Service. Clarity does not set cookies by default and respects the browser Do Not Track signal. The data collected (page interactions, scroll depth, click patterns) does not include passwords, payment details, or sensitive compliance inputs. Microsoft Corporation acts as a sub-processor; data may be transferred to the United States under Standard Contractual Clauses (Art. 46(2)(c) GDPR) supplemented by a transfer impact assessment. This processing is based on legitimate interest (Art. 6(1)(f) GDPR). You may object at any time by contacting privacy@eurocomply.app or by enabling Do Not Track in your browser. See our subprocessor list for details.

Partner-link click tracking. When you click an affiliate/partner link, we log the click through our own redirect service (go.eurocomply.app) to measure which recommendations are useful. This log records only a random, non-identifying reference, the page type the click came from, and a timestamp. It contains no name, email, IP address, or other personal identifier, and is never combined with your account. This processing is based on legitimate interest (Art. 6(1)(f) GDPR).

8. Security

We implement technical and organisational measures under Art. 32 GDPR including: TLS 1.3 in transit, AES-256 at rest, least-privilege access controls, regular security reviews, and documented incident response procedures. In the event of a personal data breach we will notify the CNPD within 72 hours (Art. 33 GDPR) and affected data subjects without undue delay where the breach is likely to result in high risk to their rights and freedoms (Art. 34 GDPR).

9. Data Processing Agreement (DPA)

EuroComply is a B2B service. Where you submit personal data of your employees, customers, or other individuals (e.g. in ROPA entries, DPIA records, incident logs), you are the data controller and Brevio Ventures is the data processor. In that capacity, we process such data only on your documented instructions, in accordance with Art. 28 GDPR.

A DPA incorporating the standard EU SCCs (controller-to-processor) is available on request at privacy@eurocomply.app at no cost for all paid-tier customers.

10. Minimum age

The Service is B2B only and not directed at individuals under 18. We do not knowingly collect data from minors. If we discover we have done so, we will delete it immediately.

11. Changes to this policy

For changes affecting processing based on contract performance (Art. 6(1)(b)): we will notify registered users by email at least 14 days before the change takes effect. Continued use after the effective date constitutes acknowledgement of the updated policy.

For changes affecting processing based on consent (Art. 6(1)(a)): we will seek fresh, affirmative consent before applying the new terms to consent-based processing. Continued use alone is not valid consent under GDPR.

Prior versions are available on request. The "last updated" date at the top of this page reflects the most recent revision.