Privacy Policy

1. Who we are

Disclo (disclo.eu) is an EU AI Act Article 50 compliance tool operated as a sole-trader business based in the Netherlands. The data controller for personal data described in this policy is Disclo. Contact: hello@disclo.eu.

2. What data we collect

• Email address — collected when you complete the free Article 50 Scope Check (Scope Check) wizard, purchase the Compliance Kit, or subscribe to Pro.
• Website domain and page paths — collected from the hosted badge script (badge.js) when a disclosure event fires on a Pro subscriber's website. Specifically: the domain name of the site, the page path where the badge rendered, and a timestamp.
• Payment data — processed by Stripe. Disclo does not see or store card numbers. Stripe's privacy policy applies to payment processing.
• Account data — for Pro subscribers, your account email, subscription status, and the domains you have licensed.
• Server logs — standard server logs (IP address, browser type) retained for up to 30 days for security and abuse-prevention purposes.

The badge script does not collect personal data from your website visitors. It does not set tracking cookies, does not collect visitor IP addresses or fingerprints, and does not collect names, emails, or any other personal identifiers. It only reports that a disclosure was rendered on a given domain and page path at a given time, so you (the site operator) have evidence of compliance.

3. Why we collect it

• Email: to deliver your Scope Check report, your Kit, billing receipts, and service-critical communications.
• Domain and page paths: to build your monthly evidence log and enable PDF export — the core feature you pay for as a Pro subscriber.
• Payment data: to process your purchase and comply with EU VAT and accounting obligations.
• Server logs: to keep the service secure and prevent abuse.

4. Legal basis (GDPR Article 6)

• Contract performance (Art. 6(1)(b)) — for everything needed to deliver the product you bought or signed up for.
• Legal obligation (Art. 6(1)(c)) — for invoicing and tax records.
• Legitimate interest (Art. 6(1)(f)) — for security logging and service improvement. You can object at any time.

5. How long we keep it

• Scope Check leads (free wizard): deleted within 12 months if no purchase is made, or earlier on request.
• Kit purchases: account email retained while you have access to the Kit, plus 7 years for accounting records (Dutch tax law).
• Pro evidence logs: retained for the duration of your subscription plus 90 days after cancellation, then deleted.
• Server logs: up to 30 days.

6. We do not sell your data

Disclo does not sell, rent, or trade your personal data to third parties. We do not run advertising networks, behavioural profiling, or third-party analytics that share data with ad platforms. Your evidence log is yours; we use it only to deliver the service you paid for.

7. Third-party processors

We share data only with processors strictly needed to run the service:

• Stripe — payment processing (stripe.com/privacy).
• Supabase — EU-hosted database and authentication (supabase.com/privacy).
• Resend — transactional email delivery (resend.com/legal/privacy-policy).
• Hosting (Lovable / Cloudflare): infrastructure for serving the website and badge.

Your data is stored in the European Union.

8. Your GDPR rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data ("right to be forgotten"), subject to legal retention obligations.
• Port your data in a machine-readable format.
• Object to processing based on legitimate interest.
• Restrict processing in certain circumstances.
• Lodge a complaint with your national data-protection authority — in the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

To exercise any of these rights, email hello@disclo.eu. We respond within 30 days.

9. Cookies

Disclo uses only functional cookies necessary to operate the dashboard (e.g. your login session). We do not use advertising or cross-site tracking cookies, and the public marketing pages load no third-party analytics by default.

10. Governing law

This policy is governed by the laws of the Netherlands and the General Data Protection Regulation (Regulation (EU) 2016/679).

11. Governing language and changes

The English-language version of this policy is the governing version. Translations are provided for convenience. We will update this policy when our data practices change; the date at the top of the page reflects the most recent update.

12. Contact

hello@disclo.eu