Privacy Policy

Last updated: 13 June 2026

1. Who we are (Data Controller)

GDPR Auditor (“we”, “us”) operates the GDPR Auditor application. For questions about this policy or your data, contact us at privacy@gdpr-auditor.app.

2. What data we collect

  • Account data: email address and, if you use Google sign-in, your name. (Art. 6(1)(b))
  • Audit data: the URLs, text, or code you submit for analysis, and the resulting reports.
  • Technical data: essential cookies for authentication; analytics cookies only with your consent.

3. Legal basis for processing (Art. 6)

  • Contract (Art. 6(1)(b)): to provide audits and manage your account.
  • Consent (Art. 6(1)(a)): for optional analytics cookies and marketing emails.
  • Legitimate interest (Art. 6(1)(f)): to secure and improve the service.

4. How long we keep it (Art. 5(1)(e))

Audit reports are automatically deleted after 30 days unless you choose to keep them. Account data is kept until you delete your account, after which it is permanently erased. We do not store the raw content you submit beyond what is needed to display your report.

5. Who we share data with (sub-processors)

We use a small set of GDPR-compliant providers strictly to run the service:
  • Supabase — database & authentication (EU / Frankfurt region)
  • Groq — AI analysis of submitted content
  • Resend — sending report emails (only if you request one)
  • Vercel / Render — hosting
We never sell your personal data.

6. International transfers (Art. 44–46)

Your account and audit data are stored in the EU (Frankfurt). Where a sub-processor processes data outside the EEA, it is covered by Standard Contractual Clauses or an equivalent safeguard.

7. Your rights (Art. 15–22)

You have the right to access, rectify, erase, restrict, port, and object to the processing of your data, and to withdraw consent at any time. You can export all your data or delete your account instantly from your My Data page.

8. Right to complain (Art. 77)

If you believe we have mishandled your data, you may lodge a complaint with your local EU supervisory authority.

9. Security (Art. 32)

Data is encrypted in transit (TLS) and at rest (AES-256). Access to your data is logged for accountability. See our Trust & Compliance page for details.

This policy is provided for transparency and does not constitute legal advice.