Privacy Policy
Last updated: 26 September 2026 · Effective immediately
This Privacy Policy explains how EU AI Pass (“we”, “us”, or “our”) collects, uses, and protects information when you use our EU AI Act Compliance Checker at euaipass.com.
1. Data Controller
The data controller responsible for your personal data is the operator of EU AI Pass (euaipass.com). For privacy inquiries, please contact us at: privacy@euaipass.com
2. What We Do NOT Collect (Zero-Retention Architecture)
✓ Zero-Retention Guarantee
The AI system descriptions, prompts, and architecture details you submit for compliance analysis are processed exclusively in volatile server memory (RAM) and are never written to any database, log file, or persistent storage. We retain no copy of your raw input. This is a structural guarantee, not a policy choice — the system is architecturally incapable of persisting your AI system descriptions.
We do not collect: your AI model weights, training datasets, source code, proprietary architecture details, customer data, or any sensitive business information you include in your system description.
3. Information We Do Collect
3a. Payment & Receipt Information
When you purchase a full compliance report ($29 USD), we collect your email address for the following purposes:
- Delivery of your PDF compliance report as an email attachment
- Sending your Stripe payment receipt
- Account creation (if you choose to upgrade to a permanent account)
Credit card and payment details are collected and processed exclusively by Stripe, Inc. We never see or store your full card number. See Stripe's Privacy Policy.
3b. Compliance Report Metadata
When a paid report is generated, we store the following structured output metadata in our database (not your raw input):
- Risk tier classification result (e.g., High Risk, Limited Risk)
- Matched EU AI Act article or Annex reference
- A brief AI-generated description summary (functional behaviour, not your input)
- Your receipt email address
- Payment confirmation timestamp and Stripe payment intent ID
- PDF storage path (stored in Supabase Storage, access-controlled)
3c. Account Information (Optional)
If you choose to upgrade to a permanent account, we store your email address and a hashed password via Supabase Auth. We do not store plaintext passwords.
3d. Technical & Usage Data
We may collect standard web server logs including IP addresses, browser type, and referring URLs for security and fraud prevention purposes. This data is retained for a maximum of 30 days. We use Vercel Web Analytics (privacy-preserving, no cookies) to understand aggregate usage patterns.
4. Third-Party Data Processors
We use the following sub-processors to operate the service. Each is GDPR-compliant and bound by a Data Processing Agreement (DPA):
| Processor | Purpose | Data Shared |
|---|---|---|
| Stripe, Inc. | Payment processing | Email, payment card data |
| Supabase, Inc. | Database, Auth, File Storage | Email, hashed password, report metadata, PDF files |
| Resend, Inc. | Transactional email delivery | Email address, PDF report attachment |
| Google LLC (Gemini API) | AI compliance classification | Your AI system description (in-memory only, zero-retention) |
| Vercel, Inc. | Web hosting & edge delivery | IP address, request logs (30-day retention) |
5. Legal Basis for Processing (GDPR)
- Contract performance (Art. 6(1)(b) GDPR): Processing your email address to deliver your purchased PDF report and receipt.
- Legitimate interests (Art. 6(1)(f) GDPR): Security logging, fraud prevention, and aggregate analytics.
- Consent (Art. 6(1)(a) GDPR): Account creation, where explicitly agreed to at the point of sign-up.
6. Data Retention
- AI system descriptions: Zero retention — never stored.
- Compliance report metadata: Retained for 2 years from the date of purchase, or until you request deletion.
- PDF reports: Stored in Supabase secure storage for 2 years, accessible only to you.
- Account data: Retained until you delete your account.
- Server logs: Maximum 30 days, then automatically purged.
7. Your Rights Under GDPR
If you are located in the European Economic Area (EEA), United Kingdom, or Australia, you have the following rights:
- Right of access: Request a copy of your personal data.
- Right to rectification: Correct inaccurate data.
- Right to erasure: Request deletion of your data.
- Right to restriction: Restrict processing of your data.
- Right to data portability: Receive your data in a machine-readable format.
- Right to object: Object to processing based on legitimate interests.
To exercise any of these rights, email privacy@euaipass.com. We will respond within 30 days.
8. Cookies & Tracking
This site uses no advertising or tracking cookies. We use:
- Session cookies: Strictly necessary for authentication (Supabase Auth). These expire when your browser session ends.
- Vercel Analytics: Cookie-free, privacy-preserving aggregate analytics. No personal identifiers are collected.
9. International Data Transfers
Our sub-processors (Stripe, Supabase, Resend, Vercel) may process data in the United States. All transfers are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring your data receives equivalent protection to the GDPR.
10. Changes to This Policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the date of the most recent revision. Continued use of the service after changes are posted constitutes acceptance of the updated policy.
Contact Us
For any privacy-related questions or to exercise your data rights, contact us at privacy@euaipass.com.