Last updated: 15 October 2026

Privacy Policy

1. Who we are

Aeqora provides EU AI Act compliance management software. The operator legal entity and postal address require confirmation before this notice is finalised. Privacy contact: privacy@aeqora.eu.

2. What data we collect

  • Account data: company name, email address, password (hashed — never stored in plaintext).
  • Compliance data you enter: AI system names, classifications, evidence files, and documents you create within Aeqora.
  • Optional usage data: page and feature events via PostHog EU Cloud after you accept analytics. These events can include identifiers and are not described as anonymous.
  • Optional website analytics: aggregated visit, traffic-source and page-view data via Google Analytics 4 after you accept analytics. Google Analytics uses cookies and a pseudonymous identifier; it does not receive your account details.
  • Payment data: billing details handled by Stripe. Aeqora does not store card numbers.
  • Communication data: emails you send us, support requests.

3. Legal basis for processing

  • Contract performance (Art. 6(1)(b) GDPR): providing the Aeqora service you signed up for.
  • Legitimate interests (Art. 6(1)(f) GDPR): proportionate security monitoring and abuse prevention, subject to your rights.
  • Legal obligation (Art. 6(1)(c) GDPR): billing records, tax compliance.
  • Consent (Art. 6(1)(a) GDPR): optional product analytics and marketing where separately opted in. Analytics consent can be withdrawn using Cookie preferences.

4. How we store and protect data

We use Supabase for database, authentication and file storage, and Vercel for hosting. Access controls include tenant-scoped queries and database row-level security. AI drafting and other supplier services can process information outside the EEA. EU hosting does not establish that every processing operation remains in the EU.

For customer-uploaded personal data, the customer determines its purposes and lawful basis and Aeqora acts as processor where agreed. Account administration and optional product analytics are separate processing activities. Before sharing sensitive data, request the applicable processing agreement, supplier locations, retention terms and international-transfer safeguards.

5. Sub-processors

The application integrates with the following suppliers; actual use depends on deployment configuration. Ask us for the current processing agreements and transfer safeguards. A supplier listing is not proof of a signed agreement or EU-only processing.

  • Supabase Inc. — database, authentication and storage (region depends on deployment)
  • Vercel Inc. — hosting and functions (processing locations depend on configuration)
  • Anthropic PBC — AI document drafting
  • OpenRouter and its configured model providers — optional AI document drafting
  • Stripe Inc. — payment processing
  • Resend Inc. — transactional email
  • PostHog Inc. — product analytics (EU Cloud, Frankfurt)
  • Google Ireland Limited — website analytics (Google Analytics 4), only after consent; data may be transferred to Google LLC in the US under the EU-US Data Privacy Framework and Standard Contractual Clauses
  • Sentry — error monitoring, if configured

6. Your rights under GDPR

You may request access, rectification, erasure, restriction or portability where the relevant GDPR conditions apply. You may object to legitimate-interest processing or withdraw consent without affecting earlier lawful processing. Contact privacy@aeqora.eu. The normal GDPR response period is one month; permitted extensions must be explained within that period. You may lodge a complaint with the Irish Data Protection Commission.

7. Cookies

Authentication cookies support sign-in. A preference cookie remembers your analytics choice for up to six months. Optional PostHog analytics loads only after acceptance and uses memory storage with automatic interaction capture and session recording disabled. Optional Google Analytics 4 also loads only after acceptance, using Google Consent Mode v2 with all signals denied by default; it may set _ga cookies (up to 14 months) to distinguish visits, and advertising and personalisation features are not enabled. Rejecting analytics does not prevent use of the service. Use Cookie preferences to accept, reject or withdraw.

8. Data retention

Retention depends on the processing purpose, customer agreement, supplier configuration and applicable record-keeping obligations. Cancellation alone does not delete an organisation's compliance records. Contact us to arrange an export or erasure request and obtain the current retention schedule, including backup and supplier deletion periods. Required audit and billing records may need to be retained; we will explain any restriction on erasure.

9. Contact

Operator legal entity and address: awaiting confirmation.
Privacy queries: privacy@aeqora.eu
Request the applicable processing terms via our Trust Center.

← Trust Center