Privacy Policy

Last updated: 9 November 2026

1. Controller

The controller for personal data processed by EUDAbridge is Dimitrios Oikonomou, a sole proprietor trading as EUDAbridge, VAT (ΑΦΜ) 066583652, Lechovou 35, 56626 Thessaloniki, Greece (the “Operator”). You can reach us at info@eudabridge.eu or through the in-app Support inbox.

2. What we process

  • Account data: name of your company, SRN, user email addresses, hashed passwords, language preference, login timestamps.
  • Uploaded content: the device master data contained in the workbooks you upload and the XML files generated from them. This is product data and does not normally contain personal data.
  • Support messages: the content of tickets you send us.
  • Payment data: when you pay by card, we send Stripe your billing email address, company name and SRN; Stripe collects your card details, billing address and VAT number on its own payment page, so card details never reach our servers. We store the amount, currency, plan, billing period and invoice reference of each payment, and your Stripe customer and subscription identifiers. Payment records are kept as described in Section 5.
  • Technical logs: timestamps, IP addresses and request metadata kept for security and troubleshooting.

The only cookie we use is the session cookie that keeps you signed in — we use no advertising cookies. Our public marketing pages (not the signed-in application) use a self-hosted, cookie-free analytics tool (Umami) that records aggregate page-visit counts and anonymous interaction events such as sign-up button clicks; it does not use cookies, does not track individuals across other sites, and does not store IP addresses.

Our public pages (not the signed-in application) also load the Google Ads tag, provided by Google Ireland Limited and Google LLC, to measure whether a Google ad led to a sign-up. We keep its cookie and advertising-storage consent switched off, so it sets no cookies on your device. The tag still loads from Google’s servers and sends a request containing your IP address, browser details, the page address and the sign-up event. Google states that these cookieless requests carry no identifiers. Google may process this data outside the European Union.

3. Why we process it

To provide the Service under our contract with you (Art. 6(1)(b) GDPR), to keep the Service secure (Art. 6(1)(f)), and to send transactional emails such as email verification, password reset and support replies. We do not sell data and we do not send marketing emails without consent.

4. Where it lives (sub-processors)

  • Render — application hosting and database, region Frankfurt, Germany (EU).
  • Hetzner Online GmbH — encrypted database backups, Germany (EU).
  • Brevo (Sendinblue SAS, France) — transactional email delivery.
  • Sentry — error monitoring, EU data region; email addresses are removed from error reports before they are sent.
  • Anthropic — automated column mapping, United States (see below).
  • Stripe — payments; payment data goes to Stripe when a customer pays.
  • Google — Ads measurement on our public pages (see Section 2).
  • Umami — self-hosted analytics on Render, as described in Section 2.

Customer data is hosted in Frankfurt (EU). The limited exceptions are: the automated column-mapping service (Anthropic, United States), which receives only column headings and up to three sample values, only from workbooks that customers upload themselves, under Standard Contractual Clauses; Google, as described in Section 2; Stripe, for payments; and access from the United States by our hosting provider for support, under the EU-U.S. Data Privacy Framework.

5. Retention

Account and uploaded data are kept for as long as the account is active. Account deletion is self-service from Account > Delete account; the data is then kept for thirty (30) days so it can be restored, and then permanently deleted. Backups expire within thirty (30) days. Payment records are kept under Greek tax law. The email log is deleted after 24 months. Other logs are kept for a limited period for security purposes.

6. Your rights

You may request access, rectification, erasure, restriction or portability of your personal data, and object to processing based on legitimate interest. Contact us via the Support inbox. You may also lodge a complaint with the Hellenic Data Protection Authority (dpa.gr) or your local supervisory authority.

See also the Terms of Service and the Data Processing Addendum.