Coffee · EU market
Action Plan
Analyse

Privacy notice

This notice applies to the EUDR Data Readiness Analyzer, a self-service B2B tool for coffee supply-chain data-readiness analysis. It is not a service of the European Union, the European Commission, or any competent authority.

Controller

The operator of this website is the data controller for account and payment metadata. For B2B customers in Germany and the EU, processing is based on Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) (security, fraud prevention, product integrity).

What we process

  • Work email you provide at upload and, after payment, customer email from Lemon Squeezy.
  • Uploaded CSV/XLSX content containing business supplier and plot data. These files can be commercially sensitive. In production the file is parsed in memory for the request and is not written to durable disk; we retain a minimised analysis draft or report JSON (mapped columns only) needed to show your teaser/report.
  • Generated teaser and full report JSON, column mappings, and issue counts.
  • First-party analytics events (upload, checkout, unlock, deletion) with hashed IP, without advertising cookies.
  • Payment events processed by Lemon Squeezy (order id, paid status). We do not store card numbers.

What we do not do

  • We do not use uploaded spreadsheets to train machine-learning models.
  • Optional OpenAI mapping, if enabled by the operator, sends only header names and up to three sample values — never the full spreadsheet.
  • We do not send emails to your suppliers. Draft supplier-request text stays in your browser/session.
  • We do not sell or share supply-chain files with third parties for marketing.

Processors

Lemon Squeezy acts as payment processor / merchant of record for the €149 one-time fee. Hosting and database providers act as processors under Art. 28 GDPR when production hosting is configured. Configure a DPA before processing live customer files.

Retention

Uploaded files and full report JSON are retained for 30 days from analysis (or until you use “Delete my data”), then purged. Anonymised analytics events (counts, hashed IP) may be kept longer for product operations. Access codes are stored only as one-way hashes.

Your rights

You may access, rectify, erase, restrict or port personal data, and object to processing based on legitimate interests. Use Delete my data on a paid report, or email the operator. You may lodge a complaint with your supervisory authority (in Germany, typically a Landesdatenschutzbehörde; EU, your local DPA).