Last reviewed 2026-10-27
Privacy Policy
This policy explains how Mathys Seynaeve, operating ECGT Ready from Mamer, Luxembourg (the operator, we, us), processes personal data when you visit ecgtready.eu, request a demo, or use the platform. It is written to satisfy Articles 13 and 14 of the General Data Protection Regulation (GDPR) and the Luxembourg implementing law of 1 August 2018.
1. Controller and contact
- Controller: Mathys Seynaeve, Mamer, Luxembourg (until SARL is registered, then the SARL becomes controller).
- Privacy and data protection contact (no formal DPO appointed under GDPR Art. 37): contact@ecgtready.eu
- Supervisory authority: Commission nationale pour la protection des données (CNPD), 15 Boulevard du Jazz, L-4370 Belvaux, cnpd.lu
We have not appointed a formal DPO because we do not meet the thresholds in GDPR Article 37(1). For anything about your personal data, write to contact@ecgtready.eu.
2. What we collect, why, and on what legal basis
2.1 Visitors and demo requests
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| IP address and user agent recorded with a form you send or a check you start | Site security, abuse prevention | Legitimate interest (Art. 6(1)(f)) | 30 days, then deleted from our records |
| Sign in and sign up protection by Cloudflare Turnstile (the IP address, the TLS fingerprint and the user agent of your browser) | Tell a person from an automated program on the sign in and sign up pages | Legitimate interest (Art. 6(1)(f)), the security of the service | Not stored by us. Cloudflare processes it for the check and to improve its bot detection, under its own policy |
| Demo form (name, email, store URL, message) | Reply to your request | Pre-contract steps + legitimate interest | 24 months from last contact |
| Contact and Speak with us forms (email, message, company, phone, shop URL, your answers to the three questions about your storefront) | Reply to you and prepare the call you asked for | Pre-contract steps + legitimate interest | 24 months from last contact |
| Newsletter email (if you opt in), with a hash of your IP address and the user agent of the sign up | Send product updates; the hash and the user agent limit abuse of the public form | Consent (Art. 6(1)(a)); legitimate interest for the hash and the user agent | Until you unsubscribe; the hash and the user agent 30 days |
2.2 Customers and signed-in users
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account: name, email, hashed password, MFA factors | Provide the service, account security | Contract (Art. 6(1)(b)) | For the life of the account. Deleted when you close it, with your audits and their records; a note of the deletion (your email address and the date) is kept 24 months |
| Sign in sessions (the IP address and the user agent of the device that signed in) | Keep you signed in, account security | Contract (Art. 6(1)(b)) | Until you sign out, at the latest when the account is closed |
| Workspace metadata, the addresses you submit, the results of your audits (findings, claims, conflicts between pages, missing elements, with their status, notes and history), and a metering record per model call (page URL, model, tokens, cost, whether the answer could be used, no page text) | Run the platform, deliver reports, meter what each audit costs us | Contract | Account life; export on request |
| Audit record of a paid audit: the text read on each page (up to 24,000 characters a page), a picture of the top of each page opened in a browser (up to 30 pages an audit), the names of the cookies seen on those pages and the other hosts they contact, and since 13 October 2026 the record of the run (the pages read and not read, the checks that ran, the lists of labels built from the words of the pages). While the pages are read the row keeps the instructions of the first read, cleared when the reading ends. These are public pages of the site you asked us to audit. Where such a page shows personal data that the site itself publishes, we process it on your behalf under the Data Processing Agreement. | Let the final review read the pages again, show what a finding was read on, list the cookies and third parties of the site, build the label guide of the report | Contract (Art. 6(1)(b)) | Kept with the audit, for the life of the account |
| Service emails: the welcome email of your account, the email that tells you the report of an audit of a whole site is ready (the site audited, the number of pages read, a link to the audit and a link to book a walkthrough call), the report as a PDF when you ask us to email it, a workspace invitation, and the alert of a plan on pages that changed or on a new high risk claim. An audit of pages you picked and a check of a fix send no email. The date the report ready email went out is kept on the audit. | Deliver the service | Contract (Art. 6(1)(b)) | Sent through our email provider (see subprocessors); the date on the audit for the life of the account. The booking link leads to cal.com, which processes a booking under its own privacy policy; nothing is sent to cal.com unless you book |
| Billing: company name, billing address, VAT, invoices | Invoicing, accounting | Contract + legal obligation | 10 years (LU accounting law) |
| Audit logs (admin actions, sign ins and other security events, with the IP address and the user agent) | Security, breach investigation | Legitimate interest | 12 months; the record of a request you make on your account (an export, a deletion) 24 months |
| Support correspondence | Help you | Contract + legitimate interest | 24 months from last contact |
| Audit supporting documents: files you uploaded and their labels and descriptions | Ground an audit in your real product evidence for PPWR, ESPR and Right to Repair coverage | Contract (Art. 6(1)(b)) | Account life; write to contact@ecgtready.eu to remove any document at any time |
| Policy library: the lines you import (forbidden claims, approved wording, certifications), the imported file text, the name of the person who imported it | Check your pages against your own rulebook when you choose that scope; attribute the import in the audit log | Contract (Art. 6(1)(b)) | Until you remove the library or your account; findings keep the line they cited |
| Price observations: the prices shown on the public product pages the platform reads for you (selling price, reference price, lowest price of the last 30 days line, currency, reduction text, date). No personal data. | Check announced reductions against the shop's own price history (prior price rule, Directive 98/6/EC Art. 6a) | Contract (Art. 6(1)(b)) | 90 days per product page, then deleted |
| Read memo: the answer of each page or finding read made for you (the findings, which may quote the public page, or the verdict on a finding), the page URL, the model and a fingerprint of the request. Not the page text and not the instructions. | Answer the same read again without sending the page to the model a second time (an unchanged page under the same rules and model) | Contract (Art. 6(1)(b)) | 90 days per read, then deleted |
2.3 Data we do not collect
- We do not collect special category data (health, religion, etc.).
- We do not collect children's data. The service is not directed at people under 16. Do not create an account for a minor.
- We do not buy personal data from data brokers.
3. The platform and AI processing
When you submit a URL or text to be scanned, the page text is sent to our model provider (Anthropic, see subprocessors) for inference. Anthropic does not train its models on data sent through the API. We do not feed your data into a separate model for training either. See our AI Act notice and methodology for detail.
Since 27 October 2026 the platform also includes Reggie, a chat you ask questions on EU and national law and give material to check before it goes live. The text of your question, the page you link, the text of the file you upload and the picture you send are sent to our model provider for inference, together with the context of your store (built from your website address and edited by you), the labels your account holds with their scope and end date, and your internal policies, so the answer follows them. The files, pictures, labels and policy documents themselves are stored with our storage provider in the EU, and every conversation and every check stays on your account with its date and the articles cited until you delete it or close the account.
If your account holds a product profile or supporting documents, the profile and the labels and descriptions of those documents are also sent to Anthropic as grounding context for your audits. The uploaded files themselves are not sent to Anthropic; they are stored with our storage provider as your evidence on file and are used only to support your account.
If your workspace holds a policy library (Terms section 3.3), its lines are sent to Anthropic as part of the instructions of the audits and Guard checks you run with that scope, so the model can flag page text that breaks one of your own rules. The library is your customer data; it is not used to train any model, and it stays in your workspace until you remove it.
Since 30 September 2026 the platform also reads, on every page it audits, the price blocks (struck prices, reference labels, reduction badges, the lowest price of the last 30 days line), the labels of links and buttons and the fields and buttons of forms, and sends these facts with the page text to Anthropic, so the model can check the prior price rule and the online withdrawal function rule (Terms section 3.4). These facts describe the page, not a person; the price observations they produce are kept 90 days as stated in the table above.
Since 2 October 2026 the page text is the text a visitor reads on the page, with the page title, the description the page gives to search engines, the text alternative of images and the state of tick boxes (AI Act notice, section 1b). On a full audit the platform also opens up to 30 pages in a browser, keeps a picture of the top of each page and records the names of the cookies present and the other hosts the page contacts (audit record, table above). The browser runs with our hosting provider Render in Frankfurt. The pictures are kept with our storage provider and are not sent to the model.
Since 1 October 2026, when a page, the facts read from it, the rules and the model of a read are exactly those of a read made for your account in the last 90 days, the platform does not send the page to Anthropic again and reuses the answer of that earlier read, which it keeps for this purpose only (read memo, table above). A changed page is always read again, and the final review of a paid audit always reads every page.
Since 13 October 2026 the platform also sends to Anthropic, with the page text, the facts it reads for the rules a storefront calls for. On a storefront the pages confirm as French, the French prices, the index pictograms, the mentions légales items, the guarantee box and the termination function it read (Terms section 3). On a shop that sells food, supplements or cosmetics, the sentences that make a claim with the entry of the EU Register of nutrition and health claims they match and the figures of the nutrition table (the register is public data of the European Commission). On every paid audit, the guarantee, residence, payment, pay later and connected product sentences of the pages. These facts describe the pages, not a person. The label guide of the report is built without a model from the words of the pages and a register of labels we keep as data; nothing of it is sent to Anthropic.
If your plan includes seller compliance monitoring (Terms section 3.1), the service stores, on your instruction and on your behalf, data about third party sellers taken from publicly available web pages: public profile links, display names, publicly posted contact details, and the flagged content. For that data you are the data controller and we are your processor under the Data Processing Agreement; data subject requests relating to it are forwarded to you. Contact details found indirectly are marked as unsure in the product to support the accuracy principle.
4. Cookies and similar technologies
Strictly necessary cookies are set when you sign in or save consent choices. All other categories require your consent. You can review or change your choice at any time from the cookie banner. The sign in and sign up pages load the bot check of Cloudflare (Turnstile), which is strictly necessary to protect those forms. See our cookie policy.
5. Recipients
We rely on a small number of subprocessors to run the platform. The full list, with location and transfer safeguards, is published at /legal/subprocessors. We do not sell personal data and we do not share it with advertisers.
6. International transfers
Our database, our server functions and the browser of the audits run in Frankfurt. Some subprocessors operate from the United States (Anthropic, Resend, Cloudflare for the sign in check, and the edge network of Vercel). Where personal data leaves the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) and supplementary measures (encryption in transit, access controls, contractual data minimisation). Where a vendor is certified under the EU-US Data Privacy Framework we may rely on that as the primary safeguard.
7. Your rights
- Access: ask for a copy of your personal data.
- Rectification: correct inaccurate data.
- Erasure: ask us to delete your data, subject to legal retention.
- Restriction: ask us to pause certain processing.
- Portability: receive your data in a structured machine-readable format.
- Objection: object to processing based on legitimate interest.
- Withdraw consent: where processing is based on consent, you can withdraw at any time.
- Complaint: lodge a complaint with the CNPD (Luxembourg) or your local supervisory authority.
To exercise any right, write to contact@ecgtready.eu or use the data subject request flow. We answer within one month of receiving your request. Where a request is complex or we receive many, the GDPR allows up to two further months, and we tell you so within the first month.
8. Automated decision-making
The platform produces an indicative risk score. This is not a decision with legal or similarly significant effect on you within the meaning of GDPR Article 22. A human (you) reviews and acts on the score. We never block your store or contact authorities on your behalf.
9. Security
See our security statement. In short: TLS in transit, encryption at rest, RLS + GRANT in the database, MFA available, audit logs, regular backups.
10. Breach notification
Where GDPR Article 33 requires it, we notify the CNPD of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it. We notify affected customers without undue delay where Article 34 applies.
11. Changes
We update this policy when our processing changes. The "Last reviewed" date at the top tracks the latest revision. Material changes are emailed to active customers.