Privacy policy
In short: we collect what is needed to run the analysis and issue an invoice. The data is held in the European Union. We do not profile and we sell nothing to anybody.
Controller
The controller is the operator of the service named on the operator page. For data-protection questions, write to prywatnosc@substantly.eu.
What data, and what for
- Account
- Company or shop name, email address, password as a cryptographic hash. Basis: performance of the contract (Art. 6(1)(b) GDPR).
- Shop and proof of ownership
- Domain, verification method, verification token and the date it was proved. Basis: performance of the contract, and our legitimate interest in nobody analysing somebody else's shop (Art. 6(1)(b) and (f) GDPR).
- Product catalogue
- Titles, descriptions and identifiers of the products you upload or send through the API. This is your commercial content; as a rule it holds no personal data, and if you put some in, we process it only to carry out the analysis. Basis: performance of the contract.
- Analysis results
- Findings, the ruleset version, the confidence level and the reports produced. Basis: performance of the contract.
- Payments
- Payment identifier, amount, country and invoicing details. We neither see nor store card details. Basis: performance of the contract and the legal obligation to keep accounting records (Art. 6(1)(b) and (c) GDPR).
- Technical logs
- IP address, the time and path of the request, the response code - for security and diagnostics. Basis: legitimate interest (Art. 6(1)(f) GDPR).
What we do not do
- We run no web or advertising analytics in the browser
- We embed no scripts, fonts or images from third-party servers
- We do not profile and we take no solely automated decisions with legal effect
- We neither sell data nor share it for marketing
Where the data is
The application, the database and the report storage run in data centres inside the European Union. The object storage configuration refuses a region outside the EU - that is not an organisational undertaking but a condition the code checks at start-up.
Record of processing activities
The full record: why we process data, which data, on what basis, and for how long we keep it.
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Running the account and signing in | Email address, password hash, role, language, the date the address was confirmed | Performance of the contract (Art. 6(1)(b) GDPR) | For as long as the account exists; after a request to close it, a further 14 days |
| Proving that the shop is yours | The domain, the verification token, and the method and date of each check | Performance of the contract (Art. 6(1)(b) GDPR) | For as long as the account exists |
| Checking product copy for environmental claims | Product titles, descriptions and attributes, and the captured versions of that copy | Performance of the contract (Art. 6(1)(b) GDPR) | The current copy for as long as the account exists; captured versions for 24 months |
| Showing risk, collecting evidence and keeping diligence provable over time | The matched wording, the risk level, the confidence, the claims and the documents filed against them | Performance of the contract (Art. 6(1)(b) GDPR) | Claims and evidence for as long as the account exists; individual findings with the captured version they describe (24 months) |
| Taking payment and issuing accounting records | The amount, the currency, the billing details, the VAT id and the Stripe identifiers | Performance of the contract and a legal obligation (Art. 6(1)(b) and (c) GDPR) | For the period tax law prescribes, including after the account is closed |
| Diagnosing problems and keeping the service secure | A request id, the path, the status code and the time, plus the error message and stack trace when something fails. No shop content and no keys | Legitimate interest in running and securing the service (Art. 6(1)(f) GDPR) | A short time, for diagnostics |
Who processes data for us
We use providers that process data on our instructions: hosting infrastructure in the EU, the payment provider Stripe (billing data), and the provider of the language model that weighs the context of the flagged passages (Anthropic, in the United States, under standard contractual clauses). We have a processing agreement with each of them. The current list of processors and where they process is available on request at prywatnosc@substantly.eu.
| Provider | What for | Which data | Where it processes |
|---|---|---|---|
| Anthropic, PBC | Provider of the language model that judges whether a passage is an environmental claim. The model runs on Anthropic's own API in the United States, and customer content reaches it only by that route | Fragments of product copy sent for classification, transferred to the United States. No personal data and no order data | United States · Standard Contractual Clauses (Anthropic DPA) |
| Stripe Payments Europe, Limited | Taking payments | Billing details, the payer email address and the amount. We never see or store a card number | Dublin, Ireland |
| OVH SAS | Servers, the database and file storage | Everything the service stores | Roubaix, France (OVH eu-west-rbx) |
| OVH SAS (Zimbra) | Sending transactional email | The recipient email address and the content of the message | France (EU) |
| Functional Software, Inc. d/b/a Sentry | Application monitoring: error and diagnostic logging and performance monitoring, so that a fault in the running application can be detected, analysed and fixed | Error messages and stack traces from our own code, the request path without its parameters, and the environment and release version. No product copy, no email addresses, no IP address and no cookies | Frankfurt, Germany (Sentry EU data region) · EU–U.S. Data Privacy Framework; Standard Contractual Clauses where it does not apply (Sentry DPA) |
Encrypted database backups are kept on our own file server, on our premises in Poland - not with a sub-processor. The key to decrypt them is on none of our servers.
Transfer outside the EU: the fragments of product copy sent for classification are transferred to the United States, to Anthropic, PBC, whose language model reads them. The transfer rests on the European Commission's Standard Contractual Clauses, which form part of our data processing agreement with Anthropic. No personal data and no order data are part of it. The record of processing for this transfer is available on request.
Transfer outside the EU: the diagnostic data rests in Sentry's EU region, in Frankfurt am Main. The entity we contract with is Functional Software, Inc. d/b/a Sentry in the United States, so access from the US - during a support request, for example - is a transfer to a third country. It rests on the EU-U.S. Data Privacy Framework and, to the extent that framework does not apply, on the Standard Contractual Clauses under Article 46 GDPR, which form part of our data processing agreement with Sentry. No product copy and no email addresses are part of it.
For how long
Account, shop, catalogue and report data is kept for as long as the account exists. Captured versions of product copy are deleted after 24 months. Once an account is closed only the accounting records remain, for the period the law prescribes. Technical logs are kept for a short time, for diagnostics and security.
How we protect it
Captured product copy and evidence descriptions are encrypted in the database with a key the database itself does not hold. The dashboard requires a sign-in, API keys are stored only as hashes, and secrets never reach our logs. Backups are restored and their contents checked automatically, because a backup nobody has ever restored is not a backup.
Your rights
You have the right of access, rectification, erasure, restriction of processing, portability, and objection to processing based on legitimate interest. You may also complain to a data-protection supervisory authority - the one in the member state where you live or work. You can delete the product catalogue yourself, in your account, at any time.
You can download a copy of your data yourself, in the dashboard under “Data and privacy”. You can close your account there too: we erase it after 14 days, so until then you can change your mind.
Changes
We give notice of material changes by email before they take effect.