This page explains how the Shop processes personal data. It sits next to the Terms of Service.

1. Who is responsible

There is no company. The controller is the natural person trading as Europa Artilect, NIF 242252362, Viseu, Portugal, reachable at [email protected].

2. What we process

• The invited account email, magic-link tokens and the session cookie on api.europaartilect.com.
• Text and files you submit for a job, and the reports we keep on the account.
• The credit ledger (purchases, holds, captures, refunds).
• Stripe customer and payment identifiers needed to charge and refund. Card numbers stay with Stripe.
• Feedback notes you send from the App (emailed to the maker, with your account email as reply-to).
• If you subscribe to the site newsletter, that list is separate (double opt-in via Resend).

3. Why

We process Shop data to perform the contract (sign-in, credits, jobs, invoices, refunds) and to keep the ledger honest. We may process technical logs to prevent abuse. The newsletter, if you join it, is consent you can withdraw.

4. Who else sees data

• Stripe — card payments, invoices, customer portal.
• Resend — sign-in links, feedback mail, newsletter.
• Fly.io — hosts the App and the analyst in the Paris region (cdg).
• Cloudflare — serves the public site.
• OpenRouter / the model provider — receives the job text (and extracted document text) so the report can be written. Do not submit secrets you are not willing to send to a model.

We do not sell personal data. Donations on /support are handled by PayPal or the chain you choose; they are not Shop data.

5. How long

Account, reports and ledger stay until you delete the account from the App, or ask us in writing. Invoices and payment records may be kept for the period Portuguese tax law requires. Session cookies expire; a magic link lasts 20 minutes and is single-use.

6. Your rights

You may ask to access, correct or delete Shop data, or to receive a copy of what we hold. In the App you can delete the account. Write to [email protected]. You may complain to the Portuguese data-protection authority (CNPD). Nothing here limits mandatory rights under the GDPR.

7. Transfers

Hosting of the App is in the EU. Stripe, Resend, Cloudflare and the model provider may process data outside the EEA under their own terms and safeguards. Job content in particular may leave the EEA when a report is generated.

8. Cookies

The Shop uses an HttpOnly session cookie on api.europaartilect.com only — it is not sent to the Forum, the Studio or the Angel. The public site stores the language choice in localStorage and uses Cloudflare’s beacon. We do not run advertising cookies.

9. Contact

[email protected].