Privacy policy

Last updated 2026-⁠10-22

Controller

EuroAFF.com S.à r.l., RCS Luxembourg B280385, 21 rue du Puits Romain, L-⁠8070 Bertrange, Luxembourg. Contact for privacy questions: support@euroaff.com.

How statements are read

When you add files, the app turns each page into an image and extracts its text in your browser, then sends them in parts to our server (api.euroaff.eu), which passes them for recognition to the AI model of our provider Anthropic, PBC. The model returns the positions, balances, totals and short notes about anything it could not read. Before you pay, only the summary pages of each file are sent (usually one to three); the other pages are sent after payment, when the full report is read.

So that reading can go on after you close the page, the pages of a paid report are kept on our server in the EU (Vercel Blob, Frankfurt), encrypted, only while they are being read and deleted right after; the result of reading is kept encrypted until your browser collects it; all of it is deleted within 24 hours at most and nothing is written to logs. Anthropic processes them as our processor under its commercial terms, which do not allow training models on this data. The password of a protected statement is used only in your browser and is never sent.

What is stored on your device

The browser's storage keeps the report and the data read, the statement files (to show the source page and to finish reading unread pages), a report number, payment confirmation, your cookie choice and the campaign tags of your first visit, a random browser ID for Mixpanel if you allowed analytics, and your conversations with the assistant. “New report” in the app deletes the report, the conversations and the files.

What leaves your device

Statement pages, as described under “How statements are read”. For the summary and the assistant, the report data — positions, totals, bank names and file names — and the topic and text of the conversation are sent to our server and to the same AI provider; they are not stored either. The count of assistant messages is kept in your browser with the report, signed by our server; purchased message packs are checked with Stripe. For current prices and news, the server asks open sources (TradingView, Cboe, Google News and news feeds) for quotes and news by security codes — ISINs and tickers — without amounts, names or other data about you. To convert currencies, the server requests exchange rates (currencies and a date only) from open sources. Our hosting provider may log technical data such as IP address and request time for security and operations.

When you pay, the report number, language and campaign tags are sent to Stripe as payment metadata. Stripe collects your card details and email address as an independent controller; we see the payment status, amount and the email you give to Stripe.

Link by email

If you leave your email address on the upload screen to send yourself the link, the email with the link is sent by your own mail app, from your address to your address. We keep the address, language and the ad campaign label, encrypted on our server in the EU (Vercel Blob), to write to you once about your report; no newsletters or advertising. We delete the address after 30 days, or earlier if you ask at support@euroaff.com.

Analytics and advertising cookies

Mixpanel (data stored in the EU) shows how people move through the site and the app: which pages they open and which steps they take — opening the sample, adding files, the preview, starting checkout and paying, questions to the assistant, downloads. It receives the name of the step and counts (how many files, pages and securities), the language, the device and browser type, the country from the IP address and the campaign tags. Amounts, security and bank names, ISINs, file names and the contents of statements are not sent; session recording and automatic collection of buttons and fields are switched off.

The Meta Pixel measures our ads: page views and funnel steps such as opening the demo, uploading files (without their contents), the free preview, opening the payment window, starting checkout and paying. Automatic collection of page content is switched off. If you have allowed cookies, our server also sends the payment itself — amount, currency, campaign tags and the analytics and pixel cookie identifiers, and for Meta your IP address and browser — so that a payment is counted even when an ad blocker stops it in the browser.

The Google Ads tag measures our ads on Google: the free preview, starting checkout and paying — only the fact of the step, the amount and the payment number. Ad personalisation (remarketing) and enhanced conversions are switched off, and page views are not sent.

In the EEA, the UK and Switzerland analytics and the pixel load only after you allow them. Elsewhere they are on by default, and a short notice lets you opt out. The region is taken from your device's time zone. You can change your choice at any time with “Cookie settings” at the bottom of the page or “Cookies” in the app.

Error reports

If something fails in the app or on our server, a report goes to Sentry (data stored in the EU): the type of error, the place in our code, the start of the error message with numbers, ISINs and email addresses hidden, the browser, the approximate country and city from the IP address (the address itself is not stored) and the step where it happened. The contents of statements and of the report, file names, conversations and page addresses with their parameters are not included. Sentry sets no cookies.

Legal bases

Performance of a contract and steps taken at your request before it (reading statements, the summary and the assistant, payment and report access, emailing the link), consent (analytics and advertising cookies in the EEA, the UK and Switzerland) and legitimate interests (analytics and advertising measurement elsewhere, error reports, security and fraud prevention).

Processors and transfers

Vercel (hosting and temporary storage of statement pages in the EU), Anthropic (reading statements, the summary and the assistant), Stripe (payments), Mixpanel (analytics, EU data storage), Sentry (error reports, EU data storage), Meta and Google (advertising measurement). Some of them process data outside the EEA under standard contractual clauses.

Retention

Statement pages and the results of reading them: while reading goes on and until your browser collects the result, 24 hours at most. An email address left for the link: 30 days at most. Payment records are kept as long as accounting law requires. Technical logs are kept briefly by the hosting provider. Analytics data and error reports are kept by Mixpanel and Sentry for the periods of their services; we delete analytics data on request. Data on your device stays until you delete it.

Your rights

You may request access, correction or deletion of your personal data, object to processing, withdraw consent at any time and complain to a data protection authority.