Privacy policy
Draft — this page is still being reviewed by a lawyer and is not legally binding.
This page provisionally describes what data EPU Copilot processes. The final text will be drafted by a lawyer and will replace this draft.
Data controller
Controller details will follow once the company's identity information is finalised (see Legal notice).
Waitlist
When you join the waitlist, we process your email address, a double opt-in confirmation link, your personal referral code and, if provided, the referral code of the person who invited you. The legal basis is your consent (Art. 6(1)(a) GDPR). If you withdraw consent, we delete your entry entirely.
The application
After sign-up, we process the account, business and financial data you enter yourself (e.g. invoices, expenses, receipts) to calculate your tax overview. Receipts are sent to Mistral (EU) for text recognition. Accounting-relevant documents are retained for seven years under § 132 BAO.
Processors
We use the following service providers: Convex (database), Clerk (authentication), Resend (email delivery), Mistral (receipt OCR, EU), Vercel (hosting) and, with your consent, PostHog (analytics, EU servers, Frankfurt). We have data processing agreements with all of them.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent. Financial data is subject to the statutory retention obligation under § 132 BAO, which can limit immediate deletion. You may also lodge a complaint with the Austrian data protection authority.