Privacy policy

“SovEU” is the platform behind Trustfile, Vigil, Caseflow, Forms and Atlas. This policy covers the personal data we process as a controller — visitors to our website and people who hold a SovEU account. When you put your own organisation's records into a SovEU product, we act as your processor under a data-processing agreement (DPA); that processing is governed by your instructions, not this policy. Ask us for the DPA and our full corporate details at privacy@soveu.io.

• Account data — your name, work email and organisation, so you can sign in and we can reach you.
• Content you add — the records, documents and answers you put into a product. You control these; you can export or delete them.
• Operational logs — security and audit logs (who did what, and when) needed to run the service safely.

We do not buy personal data, build advertising profiles, or run third-party analytics or ad trackers. See our cookie policy.

To provide the service you asked for (contract), to keep it secure and meet our legal obligations (legal obligation / legitimate interests), and — only where it applies — with your consent. We use the minimum data each purpose needs.

Everything that runs SovEU sits in the EU, UK or Switzerland — all covered by EU adequacy decisions — with no transfers to the US by default. The specific third parties, their region and whether they are required or optional are on our public sub-processor register.

AI assist is optional, EU-hosted and human-reviewed, and it never makes a compliance decision. The detail — provider, what data is sent, retention and opt-out — is in how we use AI.

Account data lasts while your account is active. Content you add follows the retention rules you set, and you can export everything or ask us to delete it. When you leave, we delete or anonymise your data within a reasonable period, except where law requires us to keep specific records.

You can ask for a copy of your personal data, correct it, have it deleted, restrict or object to processing, and receive it in a portable format. You can also complain to your data-protection supervisory authority. To exercise any of these, contact privacy@soveu.io.

Encryption in transit and at rest, least-privilege access, audit logging and EU/UK data residency. More in our security overview.

We may update this policy as the service evolves. We will change the date above and, for material changes, tell account holders directly.