← Trust Center Draft — final legal review pending

Privacy Policy

How Eubulia handles personal data. Written to comply with the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act.

Effective date: Pre-launch alpha · Last updated: 2026-05-04 · Controller: Søren Porskrog, founder, Eubulia (Copenhagen, Denmark) · Contact: hello@eubulia.eu

1. Who we are

Eubulia is a structured-second-brain product for independent management consultants. The service is operated by Søren Porskrog, an individual founder based in Copenhagen, Denmark. For the purposes of this policy and applicable data-protection law, Søren Porskrog acts as the data controller for personal data we collect about customers (you, the consultant), and as a data processor on your behalf for personal data you store in Eubulia about your own clients and contacts.

Where you process personal data of your own clients in Eubulia, you are the data controller and we are your data processor. Our Data Processing Agreement (DPA) governs that relationship and forms part of these terms.

2. What data we collect

We collect the minimum data needed to operate the service.

Account data

• Email address (for authentication and service notifications)
• Name (optional, profile display)
• Organization name (optional, billing display)
• Authentication tokens (Supabase Auth — JWT)
• Single-sign-on identifiers if you sign in via Google or Microsoft

Workspace content (your input)

• Chat messages, journal entries, meeting transcripts you input or upload
• Structured entities you (or Eubulia on your behalf) extract from those inputs: people, projects, risks, decisions, milestones, frameworks
• Workspace metadata: project names, tags, classifications

Usage telemetry

• API request logs (route, timestamp, response status — for service-health monitoring)
• LLM usage events (model used, token counts, task type — for billing and cost transparency to you)
• Error logs (Sentry) — sanitized to exclude personal data where possible

What we explicitly do not collect

• Source documents. Your client documents stay in your own OneDrive, Google Drive, NextCloud, or local folders. We index metadata only; source files are read in-place via OAuth-scoped access and never copied to our servers. See Section 7.
• Special-category data (health, religion, ethnicity, sexual orientation, etc.) is not requested. If you choose to enter it, you do so as data controller and remain responsible for the lawful basis.
• Behavioral tracking across sites — we do not embed analytics scripts that follow you across the internet.

3. Legal basis for processing

Under GDPR Article 6, we rely on the following legal bases:

Purpose	Legal basis
Providing the service to you (account, workspace, chat)	Contract (Art. 6(1)(b))
Billing and payment processing	Contract + legal obligation (Art. 6(1)(b), (c))
Service-health monitoring, error logging, fraud prevention	Legitimate interest (Art. 6(1)(f))
Compliance with court orders, legal processes	Legal obligation (Art. 6(1)(c))
Sending product updates and operational notices	Legitimate interest (Art. 6(1)(f)), with opt-out
Marketing emails (none planned during alpha; opt-in only at GA)	Consent (Art. 6(1)(a))

4. How we use your data

We use your data to:

• Operate the service: authenticate you, deliver chat responses, store and retrieve your workspace content
• Improve the service: aggregate, anonymized usage patterns inform our roadmap. Individual data is not analyzed for product development
• Bill you: calculate subscription fees and any LLM usage overages
• Communicate with you: service notices, security alerts, billing receipts, founder-direct onboarding messages during alpha
• Comply with legal obligations: respond to lawful requests, investigate fraud or breach, retain billing records as required

We do not use your data to:

• Train AI models (see Section 10)
• Profile you for advertising
• Sell to third parties — ever

5. Who we share data with

We share data only with carefully chosen sub-processors who help us deliver the service. The complete and current list is published at /legal/sub-processors and includes:

• Infrastructure: Supabase (EU-hosted PostgreSQL), Qdrant (EU-hosted vector database), Render (EU-hosted application hosting)
• LLM providers (routed via our intelligent task router): Mistral (EU, default for compliance-bound work), Anthropic, OpenAI, Google Gemini (the latter three optional and disable-able in your Settings)
• Payment processing: Stripe (when subscription billing is launched at GA)
• Operational tooling: Sentry (error monitoring, sanitized), Langfuse (LLM observability)

All sub-processors are bound by data-processing agreements that flow down our obligations. Material changes to the sub-processor list are notified to you at least 30 days in advance via email.

We may also disclose data when required by law, court order, or to protect against fraud, abuse, or safety threats. Such requests are reviewed; we resist over-broad demands and notify you unless prohibited by law.

6. Where data is processed

By default, your structured workspace data is stored and processed in EU infrastructure (Frankfurt, Germany region):

• Database (Supabase PostgreSQL): EU
• Vector store (Qdrant): EU
• Application servers (Render): EU
• Default LLM (Mistral): EU

Optional LLM providers (Anthropic, OpenAI, Google Gemini) operate from the United States. Their use is opt-in via your Settings and governed by Standard Contractual Clauses (SCCs) under the EU-U.S. Data Privacy Framework. You can disable all non-EU providers in Settings → AI & search → GDPR mode → "EU-only".

For compliance-bound clients (defense, government, regulated healthcare), we offer sovereign deployment to your own Azure EU tenant on roadmap H2 2026. Contact hello@eubulia.eu for early access.

7. Documents stay in your own cloud

This is a deliberate architectural choice and a meaningful privacy benefit. When you connect OneDrive, Google Drive, NextCloud, or drop local files into Eubulia:

• Files are read in-place via OAuth-scoped tokens you grant. We do not maintain a copy of the file in our infrastructure.
• Only derived metadata (text excerpts, embeddings, classification labels) is stored in our systems for indexing and retrieval.
• If you revoke OAuth access or delete a file from your cloud, the file becomes inaccessible to Eubulia. The derived metadata is then orphaned and can be cascaded-deleted via your workspace's hard-delete tooling.

This means the most sensitive content — actual client documents — is never sitting in our database waiting to leak. We see only the bare minimum needed to be useful.

8. How long we keep data

Data type	Retention
Account (email, name, auth tokens)	Lifetime of your account + 30 days after deletion request
Workspace content (chats, notes, structured entities)	Lifetime of your account, with bitemporal version history
Billing records	5 years after end of customer relationship (Danish accounting law)
Service logs (API requests, errors)	90 days rolling
LLM usage events	5 years (for billing reconciliation)
Backups	30 days rolling, encrypted at rest
Account-deletion audit log	10 years (compliance evidence)

9. Bitemporal data model and your right to erasure

Eubulia uses a bitemporal database model: every change to risks, decisions, documents, and semantic chunks is preserved as a new immutable version. This is a feature for you (full audit trail by design — you can answer "what did we know on November 15th?") but raises a fair question about GDPR Article 17 (right to erasure).

Our position is straightforward:

• You can request hard-delete of any client's data via the per-client delete tool in your workspace. This cascades across all bitemporal versions, vector indexes, and backups within 30 days.
• Your own personal data (account, login records) can be deleted via account closure. Within 30 days we erase it from production systems; backups expire over the following 30 days.
• The audit log of that the deletion happened is retained for 10 years as compliance evidence — but contains no content of what was deleted, only the metadata (who, when, what categories).

10. Zero training on your data

We do not train models on customer data. Period. This includes:

• No training of our own models (we do not train any)
• No fine-tuning of third-party models on your content
• No use of your content as evaluation data without explicit opt-in

LLM providers we route to (Mistral, Anthropic, OpenAI, Google) are configured to not retain or train on your data. We have signed enterprise / API agreements with these providers that contractually prohibit training on inference data. This is verifiable in their respective DPAs (linked from our sub-processor list).

If we ever build a domain-specialist model (a possibility on our roadmap), it will be strictly opt-in, anonymized, and aggregated. You will see exactly what would be contributed before any of it leaves your tenant.

11. Your rights under GDPR

You have the following rights regarding your personal data:

• Access (Art. 15) — request a copy of all personal data we hold about you
• Rectification (Art. 16) — correct inaccurate or incomplete data
• Erasure (Art. 17) — request deletion (subject to retention periods above)
• Restriction (Art. 18) — pause processing while a dispute is resolved
• Portability (Art. 20) — receive your data in a machine-readable format. Eubulia exports all narrative content (chats, notes, transcripts) as Obsidian-flavor Markdown with one click; structured graph as JSON.
• Object (Art. 21) — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent
• Not be subject to solely automated decisions (Art. 22) — Eubulia's outputs assist but do not make decisions about you

To exercise any right: email hello@eubulia.eu with subject "GDPR request — [type]". We respond within 30 days (Art. 12(3)).

12. Cookies and tracking

Eubulia uses only the minimum cookies needed to operate:

• Authentication cookies (Supabase): session-management, expire on logout or 7 days inactivity. Strictly necessary; no consent required.
• localStorage: stores your UI preferences (theme, language, font size) on your device. Not transmitted to us beyond what you explicitly save in Settings.

We do not use:

• Third-party advertising trackers
• Cross-site behavioral analytics (no Google Analytics, Hotjar, FullStory, etc. — we use first-party server logs only)
• Marketing pixels or fingerprinting

13. Security measures

Specific technical and organizational measures are documented at /legal/security. In summary:

• TLS 1.3 in transit; AES-256 at rest
• Row-Level Security on 15 core tables; per-organization isolation across 35 tables
• JWT-based authentication with Supabase; SSO via Google and Microsoft
• Bitemporal audit trail by design
• Data-breach notification within 72 hours (Art. 33 GDPR)

14. Children

Eubulia is a B2B service intended for management consultants. We do not knowingly collect data from anyone under 16. If you become aware that a child has provided personal data to us, contact hello@eubulia.eu and we will delete it promptly.

15. Changes to this policy

Material changes are notified to active customers at least 30 days in advance via email and via banner in the application. Non-material changes (clarifications, typos) are made silently with the "Last updated" date refreshed at the top of this page.

16. Contact and complaints

Data controller: Søren Porskrog, Eubulia, Copenhagen, Denmark
Email: hello@eubulia.eu (GDPR matters: subject line "GDPR")

If you believe your data has been mishandled, please contact us first — we take privacy seriously and want to resolve concerns directly. You also have the right to lodge a complaint with your local supervisory authority. In Denmark, this is:

Datatilsynet
Carl Jacobsens Vej 35
2500 Valby, Denmark
datatilsynet.dk

Eubulia · eubulia.eu · Trust Center