eudr.dev privacy & data

Processor : Vortx AI Private Limited, operating eudr.dev , acting on the controller's instructions.

Operator name, address, EORI identifying data (personal when natural-person operator)

Email address identifying data the only credential: sign-in is a one-time link, there is no password

Plot geolocation (Polygon or Point) location data; may be personal when it identifies a smallholder

Credit balance and ledger (credits bought, spent, when)

Browser user-agent technical reproducing a bug you report

Your message whatever you choose to write to answer you

Lawful basis Art. 6(1)(c) GDPR. Legal obligation. The obligation is the EUDR due diligence duty

Credit balance and ledger (credits bought, spent, when) account metadata charging for statements, and answering a disputed charge

Due diligence statements held on eudr.dev (Annex II body, signed receipt) 5 years from the statement, then erased by the hourly sweep.

OAuth refresh tokens 30 days from issue, rotated on each use

Answered support enquiries 2 years

Uploads abandoned part-way 7 days

AWS EMEA SARL — compute, database, stored files, SES everything held by the service, including farm records and stored files; outbound email recipients eu-north-1 Stockholm, Sweden

onward transfer to Google LLC (US) under the EU-US Data Privacy Framework

emem.dev is a transfer outside the EEA. Data transferred: plot geometry, HS code, country, quantity.

The full catalogue with lawful-basis routes and the 30-day change- notice procedure is at /legal/subprocessors .

DELETE /app/api/account deletes the user row and revokes all sessions

GET /app/api/account/export returns everything we hold on you as a single JSON file

Edit your details in the dashboard or re-submit the corrected scenario.

Deleting a farm or a visit (owner or admin) deletes its records and any stored file nothing else refers to.

The Art. 15 export is the portability artifact: a single JSON file in a structured, commonly-used, machine-readable format (RFC 8259 JSON)

The lawful basis is Art. 6(1)(c) (legal obligation), so the absolute Art. 21(1) right to object does not apply.

With your national supervisory authority.