Privacy Policy
Last updated: September 4, 2026
1. Who we are
EU-now.com ("we", "us", "our") is an online platform for EPSO exam preparation, operated by SanJeMi S.L. For data protection inquiries, contact our Data Protection Officer at dpo@eu-now.com.
2. What data we collect
We collect the following categories of personal data:
2.1 Account data
- Email address — for authentication (magic link login), communication, and account recovery
- Display name — optional, for personalization
- Language preference — to serve content in your language
- Timezone — to schedule study reminders
2.2 Preparation data
- Question attempts — your answers, correctness, and time spent per question
- Essay submissions — full text of essays you write for EUFTE practice
- Tutor conversations — messages exchanged with our AI tutor EUgenio
- Study preferences — competition type, exam language, target date, study intensity
- Progress scores — readiness scores, domain scores, streaks
2.3 Payment data
- Subscription status and tier — stored by us
- Payment details — handled entirely by Stripe; we never see your card number
2.4 Technical data
- IP address — for rate limiting only; not stored persistently
- Cookies — see our Cookie Policy
2.5 Newsletter subscribers
- Email address — to send weekly EPSO preparation digests
- Language preference — to send content in your language
- Email engagement — whether an email was delivered, opened or clicked, so we can tell which messages are useful and stop sending the ones that are not. Opens are measured with a small tracking image; many mail apps block or pre-load it, so the figure is indicative rather than exact. You can stop all of it by unsubscribing from the link in any email.
2.6 Emails you send us
- Your message — when you reply to one of our emails, or write to one of our inbox addresses, we store your address, the subject and the text of what you sent, so that we can read it, answer it and follow up on it.
- What we do with it — a member of our team reads every message and writes every reply. We classify incoming mail by topic (bug report, suggestion, billing, referral) using fixed keyword rules that run on our own servers. No automated decision is taken about you, and the content of your email is not sent to any AI service.
- How long — 90 days from receipt, then deleted automatically. Messages about a payment, invoice or refund are kept for 180 days instead, because a card dispute can be opened months after the charge and your message may be the record of what was agreed. Ask us sooner and we will delete it sooner.
3. Legal basis for processing
| Processing activity | Legal basis (GDPR Art. 6) |
|---|---|
| Account creation and authentication | Contract performance (Art. 6(1)(b)) |
| Serving questions and tracking progress | Contract performance (Art. 6(1)(b)) |
| AI essay evaluation and tutor | Consent (Art. 6(1)(a)) — you explicitly opt in |
| Payment processing via Stripe | Contract performance (Art. 6(1)(b)) |
| Newsletter emails | Consent (Art. 6(1)(a)) — given when you submit your address |
| Email delivery and engagement statistics | Legitimate interest (Art. 6(1)(f)) — measuring whether our own emails are worth sending |
| Reading and answering emails you send us | Legitimate interest (Art. 6(1)(f)) — replying to someone who wrote to us; contract performance (Art. 6(1)(b)) where it concerns your subscription |
| Rate limiting (IP address) | Legitimate interest (Art. 6(1)(f)) — preventing abuse |
| Security logging | Legitimate interest (Art. 6(1)(f)) |
4. AI data processing
Important: When you use the Essay Evaluation or AI Tutor features, your text is sent to Anthropic (Claude API) for processing. Specifically:
- Essay text you submit is sent to Anthropic to generate evaluation scores and feedback
- Tutor messages are sent to Anthropic to generate responses
- Anthropic processes this data under their Privacy Policy and does NOT use your data for training
- You can opt out by not using the Essay or Tutor features
We require explicit consent before processing your data with AI services. You can withdraw consent at any time by stopping use of these features and requesting deletion of your data.
5. Data processors (third parties)
| Processor | Purpose | Location | Safeguards |
|---|---|---|---|
| Supabase | Database, authentication | EU (Frankfurt) | GDPR-compliant, DPA |
| Anthropic | AI essay evaluation, tutor | USA | SCCs, zero-retention API |
| Stripe | Payment processing | USA/EU | SCCs, PCI DSS Level 1 |
| Resend | Sending transactional and newsletter emails; receiving the replies you send to our inbox addresses | USA (inbound mail processed in the EU — Ireland) | SCCs, DPA |
| Vercel | Website hosting, CDN | Global (EU edge) | SCCs, DPA |
6. Your rights
Under GDPR, you have the following rights:
- Access — Download all your data from Settings → Export Data
- Rectification — Edit your profile in Settings
- Deletion — Delete your account in Settings → Delete Account
- Portability — Export your data in JSON format from Settings
- Object — Opt out of newsletter via unsubscribe link; opt out of AI processing by not using those features
- Withdraw consent — At any time, for any consent-based processing
To exercise any right, email dpo@eu-now.com or use the self-service options in Settings.
7. Data retention
- Account data — retained while your account is active; deleted within 30 days of account deletion
- Question attempts — retained while your account is active
- Essay submissions — retained while your account is active
- Tutor conversations — retained while your account is active; you can delete individual conversations
- Newsletter subscribers — retained until you unsubscribe
- Emails you send us — retained for 90 days from receipt, then deleted automatically; 180 days when the message concerns a payment, invoice or refund
- Payment records — retained for 7 years (legal obligation)
8. International data transfers
Your data is primarily stored in the EU (Supabase Frankfurt). When data is transferred to processors in the USA (Anthropic, Stripe, Resend), we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission to ensure adequate data protection.
9. Children
EU-now.com is designed for adults preparing for EU institutional careers (typically 18+). We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact dpo@eu-now.com.
10. Data breach notification
In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours (GDPR Art. 33) and affected individuals without undue delay if the breach poses a high risk to their rights and freedoms (GDPR Art. 34).
11. Changes to this policy
We may update this policy from time to time. We will notify registered users by email of any material changes. The date at the top of this page indicates the last revision.
12. Contact
Data Protection Officer: dpo@eu-now.com
General inquiries: hello@eu-now.com
Supervisory authority: You have the right to lodge a complaint with your local data protection authority.