Privacy Policy

1. Data controller

The data controller is Maison Sasson Ltd (Company No. 13345607), registered office 82a James Carter Road, Mildenhall, Suffolk, England, IP28 7DE, reachable at legal@ai-eu-act.xyz.

2. Data we process

Account data (name, professional email, role, organisation), authentication data including TOTP two-factor secrets, billing data processed by PayPal, case and dossier content you enter, contact inquiries, and technical logs required for security and audit purposes.

Files stored in the encrypted vault are encrypted in your browser before upload; we store ciphertext only and cannot read their contents.

3. Purposes and legal bases

Contract performance (Art. 6(1)(b) GDPR): providing the compliance workspace, dossier generation and billing. Legal obligation (Art. 6(1)(c)): accounting and audit records. Legitimate interest (Art. 6(1)(f)): security, abuse prevention and service improvement. Consent (Art. 6(1)(a)): optional marketing communications, where used.

4. Recipients and transfers

Hosting and database infrastructure is located in the European Union (Frankfurt). Content delivery and certain third-party processors (payment processing by PayPal, AI language-model processing through enterprise APIs configured not to train on your data) may involve processing outside the EU; where this occurs, appropriate safeguards under Chapter V GDPR apply. Strict EU-only processing is not guaranteed unless expressly agreed in a separate enterprise arrangement.

5. Retention

Account and audit-ledger records are retained for the life of the account and thereafter as required by applicable limitation periods and accounting law. Vault files are erased on the expiry schedule you configure (maximum 90 days). Contact inquiries are retained for up to 24 months.

6. Your rights

You may request access, rectification, erasure, restriction, portability and object to processing by writing to legal@ai-eu-act.xyz. You may lodge a complaint with your supervisory authority. Note that records committed to the tamper-evident audit ledger cannot be altered or deleted without breaking cryptographic verifiability; where erasure applies, personal data is anonymised while hash integrity is preserved.