Privacy policy
The short version: we collect what we need to run your workspace, keep it in the EU, never sell it, and delete it when you ask. The long version is below — no jokes in this part, promise.
1. Who is responsible (controller)
[Legal entity name], [registered address], registered with [business register and number] (“Europs”, “we”). Contact: privacy@euoria.eu. [Data protection officer contact, if appointed].
2. What we process and why
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Waitlist: email, name, company, country, stage | Contacting you about early access | Consent, Art. 6(1)(a) | Until you withdraw consent or 24 months after last contact |
| Euoria first-batch inquiry: name, email, company, country, which problem, a short note, how you use AI (optional), and a flaw you noticed in an AI system (optional) | Telling you if a first batch under the proposed 28th regime ever opens | Consent, Art. 6(1)(a) | Until you withdraw consent or 24 months after last contact |
| Account: email, name, password hash | Providing your account | Contract, Art. 6(1)(b) | Life of account + 30 days |
| Company workspace data and uploaded documents | Providing the workspace | Contract, Art. 6(1)(b) | Life of account + 30 days, unless law requires longer |
| Onboarding answers: business profile, co-founders (names, roles, optional equity), funding, banking and accounting status, hiring plans, tool preferences | Personalising your workspace and next steps | Contract, Art. 6(1)(b); sharing with Euri as chat context and product emails only with consent, Art. 6(1)(a) | Life of account + 30 days |
| Messages to Euri | Generating answers using your workspace context | Contract, Art. 6(1)(b) | Life of account, or until you delete them |
| Self-reported company metrics (revenue, money raised, customers, team size) and detected milestones | Showing your progress levels | Contract, Art. 6(1)(b) | Life of account + 30 days, or until you delete them |
| Plush shipping address: name, postal address, country (encrypted) | Sending the free Euri plush you claimed | Contract, Art. 6(1)(b) | Deleted 30 days after delivery, on cancellation, or earlier on request; the country is kept for statistics |
| Technical logs (IP address, timestamps, errors) | Security and reliability | Legitimate interest, Art. 6(1)(f) | Up to 30 days |
Documents you upload may contain personal data of third parties (e.g. co-founders, shareholders, directors). You are responsible for having a lawful basis to upload them; we process them on your behalf.
3. AI processing
When you chat with Euri, or when your Lean Team drafts a mission step, your message and relevant workspace context (company records, deadlines, document names, the text of text and CSV uploads, and memory passages) are sent to Mistral AI SAS (France) to generate a response, processed in the EU. We do not permit your data to be used to train models. Euri's output can be wrong; it is not legal, tax or financial advice. No decisions with legal effect are made solely by automated means.
4. Processors (all European, EU data residency)
- Scaleway SAS (France) — hosting, managed PostgreSQL database and object storage, region fr-par (Paris).
- Mistral AI SAS (France) — AI language model API, EU-hosted.
- Sendinblue SAS / Brevo (France) — transactional email.
- Plausible Insights OÜ (Estonia; visitor data in Germany): cookieless, aggregate website analytics, only if enabled. [remove if not used]
We have data processing agreements with each processor under Art. 28 GDPR. We do not transfer your data outside the EU/EEA.
5. Cookies
We only use strictly necessary cookies for login and security. See our cookie notice.
6. Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection, and to withdraw consent at any time without affecting prior processing. Email privacy@euoria.eu. You may also lodge a complaint with a supervisory authority, in particular in your member state of residence or [competent authority of our establishment, e.g. CNIL / BfDI / AP].
7. Security
TLS encryption in transit, encryption at rest by our infrastructure provider, hashed passwords (bcrypt), private storage buckets and least-privilege access. Public registration forms (the waitlist, account sign-up, and the first-batch note) are checked on our own servers before anything is saved. The check is a spare field that people leave empty, a short timer issued with the page, and a limit on how often one connection can send the form. We do not use an outside captcha company.
8. Changes
We'll post updates here and notify account holders of material changes by email.