Privacy
Privacy notice
Written to be read. If a sentence here is vague, that is a bug — tell us and we will fix it.
In short: this website sets no cookies, loads no tracking script, embeds no third-party scripts and loads every file — fonts included — from this domain. We count visits on our own server and keep only daily totals. Apart from the server log described below, which is deleted after 7 days, the only personal data it processes is whatever you choose to send us by email. The application at app.eurekagpt.eu is a separate matter and is covered below; it sets exactly one cookie, to keep you signed in, and the cookies page lists it in full.
Who is responsible
The controller of personal data processed through this website and the EurekaGPT application is LOGICANCE S.L. (NIF B93934537), Calle Jesús 81, Esc. A, 2º, Pta. 6, 46007 Valencia, Spain. Privacy and data-rights enquiries: info@logicance.com. Product enquiries: info@eurekagpt.eu.
This website
- No cookies. None are set, so there is no consent banner to click away. Nothing is written to local or session storage either.
- No trackers and no measurement script. No tag manager, no advertising pixel, no session recorder and no third-party analytics.
- Visit counts, on our own server. Once a day our server adds up its request log into totals: pages opened, the site a visit came from, browser language and device type. We keep only the totals. To count each visitor once, the nightly run groups one day’s requests by IP address and browser. That grouping lives only while the run lasts and is never stored. Nothing is stored in or read from your browser.
- No external requests. Fonts, styles, scripts and images are served from eurekagpt.eu. Your browser contacts no other host to render these pages.
- Server logs. Our web server in Germany keeps standard request logs (IP address, time, path, user agent) for 7 days, for security, capacity and the daily totals above. Then it deletes them. This covers the application at app.eurekagpt.eu as well. Legal basis: our legitimate interest in running a secure service and knowing how it is used (Art. 6(1)(f) GDPR).
- Email. If you write to us, we process what you send (name, organisation, role, message) to answer you and manage early access. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
The application
If you hold an account at app.eurekagpt.eu, we process the following as controller:
- Account data — your email address, a hashed password, and the workspace the account belongs to. Legal basis: performance of the contract (Art. 6(1)(b)).
- Conversations and uploaded documents — stored in our EU database so that you can return to them, unless you use Ephemeral mode, in which case neither is written. Legal basis: performance of the contract. They are not used to train any model, are not sold, are not shared, and are not profiled against.
- Operational records — per-account usage and cost, security events, and your recorded consent where you chose to enable external web search. Legal basis: legitimate interest in running, securing and billing the service.
Where you are an account holder under an organisation’s subscription, that organisation may be the controller for the content you put into the service and we act as its processor under a data-processing agreement. The agreement decides which of us answers your request; write to either and we will route it.
Cookies and browser storage
This website sets no cookies at all and writes nothing to local or session
storage, which is why there is no consent banner on it. The application sets one cookie,
eurekagpt_session, which holds an opaque, revocable session
identifier and does nothing but keep you signed in; it is strictly necessary for a service you asked
for, so it needs no consent under the ePrivacy rules. The application also remembers your choice of
light or dark appearance in your own browser’s local storage, where it stays.
Neither is used to profile you, neither is shared, and no third party sets anything on either domain. The full detail — name, purpose, lifetime, and what would have to change for a banner to become necessary — is on the cookies page.
Recipients and sub-processors
We do not sell personal data and we do not share it for anyone’s marketing. The processors involved in running the service are: Hetzner (hosting and the database, in Germany); CORTECS — Cortecs GmbH, Vienna — as the AI gateway and, through it, the provider it selects to serve each model (an EU-established entity of the model’s vendor, or a European host running open weights); Staan — European Search Perspective — (live web search when used); and a European email provider (verification and sign-in messages). The email provider is given by role rather than by name because we name a sub-processor only where we hold its agreement. Each is named individually, with its location and safeguards, in the data-processing agreement, which we will send on request.
The models you can choose between are made by Mistral AI (France), Anthropic, Google and OpenAI (United States) and DeepSeek and Zhipu AI (China). Who made a model and who serves it are different questions: whichever you pick, the call is served by a company established in the EU and processed in the EEA. The catalogue states both, family by family.
Transfers outside the EU/EEA. No third-country transfer takes place on the default path: your request is served by a provider established in the EU and processed in the EEA. The single deliberate exception is the optional external web search: if you switch it on and confirm the notice for a conversation, the search query for that turn is sent to Google (United States) under its own terms. It is off by default, unavailable in Ephemeral chats, and every answer produced that way is visibly marked as having left the EU.
How long we keep things
- Web-server request logs: 7 days. The daily visit totals are kept. They contain no personal data.
- Email correspondence: as long as needed to deal with your enquiry and any follow-up, then for the periods applicable law requires.
- Conversations and documents: until you delete them or delete your account. Ephemeral chats are never stored.
- The AI provider serving a turn retains nothing: zero retention is requested on every call and cannot be switched off.
Automated decision-making
The service generates text with an AI model at your request. It makes no automated decision that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. Generated content is labelled as AI-generated in line with Article 50 of the EU AI Act, and can be wrong — check anything you intend to rely on.
Your rights
You may exercise your rights of access, rectification, erasure, restriction, objection and portability by writing to info@logicance.com. We answer within one month and will ask for enough information to be sure we are talking to the right person. You can also delete any conversation yourself at any time, and deleting your account removes the workspace and its contents.
If you believe your rights have not been respected you may complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (www.aepd.es), or to the supervisory authority where you live or work.
Security
Traffic is encrypted in transit. Passwords are stored as modern hashes, never in a recoverable form. Sessions are opaque and can be revoked. Workspaces are isolated from one another. Access to production data is limited to what operating and supporting the service requires.
Changes
If this notice changes materially we will say so here and, for account holders, by email before the change takes effect.
Last updated: 28 August 2026