Privacy policy
Last updated 24 Sept 2026
Placeholder text — the final wording is being prepared by A&A Digital Factory.
TODO — final wording to be supplied by A&A Digital Factory S.à r.l. The facts below come from spec/01 §7 and spec/07 §5.
Controller
A&A Digital Factory S.à r.l., Luxembourg (TODO: address, contact email).
Processors and hosting
| Processor | Purpose | Region |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (Frankfurt) |
| Stripe | Payments, invoices, VAT | EU/US (Stripe's DPA) |
| Resend | Transactional emails and regulatory-update alerts | EU/US (Resend's DPA) |
| Plausible | Cookieless web analytics | EU |
| Vercel | Hosting | EU (Frankfurt) |
Cookies
The site sets no third-party cookies. Plausible analytics is cookieless. The only cookies are the authentication cookies required to keep you signed in to your account. No consent banner is therefore displayed.
Retention
| Data | Retention |
|---|---|
| Leads (email, name, company, role) | 24 months after last activity, then the email is anonymised |
| Orders and invoices | 10 years (accounting obligation) |
| Review uploads | 30 days after delivery of the review |
| Review deliverables | 24 months |
| Download log | 24 months |
Your rights
Access, rectification, erasure, restriction, portability and objection, by email to the contact address above. You may lodge a complaint with the CNPD (Luxembourg).