Who handles your data, and what they keep

Every company that handles your data, where it is, and what each one keeps and for how long. Plus what we do not claim.

Seven parts, six of them in Europe

The seventh, Google web search, runs only if you switch it on. We name every company whose agreement we hold.

The app and its databaseLOGICANCE S.L. (us), on Hetzner serversGermanyYour account, chats, documents and their search index.
AI gatewayCORTECS (Cortecs GmbH)Vienna, AustriaYour message, while passing it on, only to providers established in the EU.
The AI modelA company established in the EU, such as Google Cloud EMEA Ltd (Gemini) or Microsoft Ireland Operations Ltd (GPT)The EEAYour message, only while it answers. Bound by contract to keep no copy.
Web searchStaan (European Search Perspective SAS, Paris)EUOnly the search words, sent by our server.
Code sandboxLOGICANCE S.L. (us), in a separate sealed containerGermanyOnly the code and data for one job, with no internet access.
Service emailsA European email providerEUYour email address and our service emails, such as sign-in links.

Google web search only if you switch it onGoogleUnited StatesThe search words for that answer, after you confirm. The answer is marked in red.

The models are made by Mistral AI (France), Anthropic, Google and OpenAI (United States), and DeepSeek and Zhipu AI (China). The catalogue shows who made each model and who serves it.

This website loads nothing from other companies and sets no cookie. We count visits on our own server and keep only daily totals (cookies page).

What is kept, and for how long

The same rules, drawn as a timeline on the home page.

Your messages, at the AI provider: Nothing. Zero data retention is requested on every message, and no setting allows retention.
Your saved chats, with us: Deleted automatically 7, 30 or 90 days (the default) or 1 year after the last message, as you choose, or sooner by you. An Ephemeral chat is never stored: no messages, no title, no files. A deleted chat leaves our backups within about a month.
Documents in your Library: Until you remove them or delete your account. Stored and indexed on our servers in Germany.
Account details: Email address and a password hash, for as long as the account exists.
Web-server logs: Kept 7 days, on our servers in Germany.
Your consent to Google web search: Recorded for each chat, so it can be checked later.
Record that a chat was deleted: A short record that a chat was deleted, and when, with none of its content, for up to three years.

Each principle, and what the product does to respect it. This describes how the system works; it is not a certification.

Show the principles

Principle	What EurekaGPT does
Data residencyChapter V: transfers outside the EU	Everything we store is on our servers in Germany. Models are served by companies established in the EU and process your messages in the EEA. Your chats, documents and searches stay in the EEA. The only exception is Google web search, which you switch on and confirm for each chat.
Purpose limitationArt. 5(1)(b)	We use your messages, documents and answers only to run the service for you. We do not use them to train AI, we never sell them, and we never share them for anyone’s marketing or use them to profile you.
Data minimisationArt. 5(1)(c)	We store only what you need for your history, and you can avoid even that with Ephemeral chats. Your content is never read for analytics or advertising.
Right to erasureArt. 17	Delete any chat at any time. Saved chats are also deleted automatically after a period without new messages. You choose 7, 30 or 90 days (the default) or 1 year. An Ephemeral chat is never stored. Deleting your account removes your workspace and its contents.
PortabilityArt. 20	Copy any answer, or export a chat as a PDF, Word, PowerPoint or Excel file. For a machine-readable copy of your account data, ask us by email.
TransparencyArt. 5(1)(a) and EU AI Act Art. 50	Every answer shows where it was processed and says that it was generated by AI.
Security of processingArt. 32	Encrypted connections, passwords stored only as secure hashes, sign-in sessions that can be revoked, and workspaces kept strictly apart.
AccountabilityArt. 5(2)	The EU-only rule is enforced in one place in our code. Every consent to Google web search is recorded. Both can be checked.

Ask us for our data-processing agreement (DPA). It lists every company that processes data for us and where they are. Read it before you sign.

What we do not claim

Five things we do not say, and why.

We do not claim a certification: We have no ISO 27001 or SOC 2 certificate of our own. CORTECS, our gateway, is ISO 27001 certified, but that certificate is theirs.
We do not say “EU-native” means your data never leaves the EU: Established in the EU and processed in the EEA are two facts, and we state them separately. See the difference.
We do not claim we cannot read your data: We store your chats, so technically we can. We do not read them for product, marketing or training purposes, and an Ephemeral chat is never stored.
We do not claim “100 % GDPR compliant”: Compliance also depends on how a system is used. We say GDPR-compliant by design, and show the measure behind each principle.
We do not claim every model is European: Mistral is French; Claude, Gemini and GPT are American; DeepSeek and GLM are made in China. All are served by companies established in the EU.

EU AI Act, Article 50

EurekaGPT is a general-purpose AI assistant. Its answers are generated by AI and labelled as such in the app and in every file you export. AI can be confidently wrong. Check anything you rely on, and do not treat it as legal, medical or financial advice.

Reporting a problem

If you believe you have found a security or privacy problem, write to info@logicance.com with enough detail for us to reproduce it. We will acknowledge you, and we will not pursue anyone who reports in good faith and does not access or modify other people’s data.