Privacy Policy — Effitrio

Version: 1.1
Last updated: June 21, 2026

---

Table of Contents

1. Introduction
2. Information We Collect
3. How We Process Your Information
4. Legal Bases for Processing
5. Data Controller vs. Data Processor
6. Data Storage and Security
7. GDPR Compliance — EU/EEA/UK/Swiss Users
8. United States Residents — Privacy Rights
9. Canada Residents — Privacy Rights
10. Data Sharing and Third-Party Processors
11. AI-Powered Features
12. Social Logins
13. Cookies and Tracking Technologies
14. Do-Not-Track (DNT) Signals
15. Data Retention
16. Children's Privacy
17. International Data Transfers
18. Data Breach Notification
19. Changes to This Privacy Policy
20. How to Review, Update, or Delete Your Data
21. Contact Us

---

1. Introduction

Welcome to Effitrio ("we," "our," "us," or "Effitrio"). Effitrio is an AI-powered ERP mini tool suite that helps businesses manage invoices, expenses, projects, and customer relationships efficiently. We are committed to protecting your privacy and ensuring the security of your personal information.

Data Controller:
Email: support@effitrio.com
Website: www.effitrio.com

Some features of Effitrio — including the ZUGFeRD e-invoice generator and other tools we may offer without sign-in — are available without registration. Creating a free account unlocks additional features, including saved clients, invoice history, and email sending.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at www.effitrio.com and use our services (the "Service"). By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

---

2. Information We Collect

2.1 Account Information (Required at Registration)

To create an Effitrio account, we require:

• Email address — used for login and communication
• Full name — displayed in your profile
• Password — encrypted with bcrypt; never stored in plain text

2.2 Business Data (Optional — You Control What's Entered)

You optionally enter business data when using Effitrio features. We store only what you provide. You are the Data Controller for this data; Effitrio acts as a Data Processor on your behalf (see Section 5):

• Company Profile: Name, address, email, phone, tax ID, VAT number, logo, bank details (all optional)
• Clients/Customers: Name, email, phone, address, tax ID, contact person, notes
• Invoices: Invoice number, dates, line items, amounts, tax calculations, payment terms, notes
• Expenses: Description, category, amount, date, vendor, notes, receipt images — if you use AI receipt scanning, the image is sent to our AI provider (see Section 11.2; the same notice is shown in the product before upload)
• Projects: Name, description, timeline, assigned team members, tasks

💡 You're in control: All business data is entered and managed by you. Effitrio does not access, use, sell, or share this data beyond what is required to deliver the Service.

2.3 Payment and Subscription Information

Effitrio offers free and paid subscription plans. If you subscribe to a paid plan, billing address and payment method are collected and processed via Stripe. We never see or store full card numbers.

We also record AI credit usage metadata (for example action type, credits deducted, and related workspace identifiers) to enforce plan limits, display usage in your account, and support billing.

2.4 Automatically Collected Information

We automatically collect technical data necessary to operate and secure the Service:

• Device & Technical Data: IP address, browser type, operating system (for security and support)
• Log and Usage Data: Pages visited, features used, session timestamps, crash reports, and interaction patterns (to improve the product and identify issues)
• Session Information: Login/logout times, session duration (for account security)
• Authentication tokens: Session tokens (for example JWT access and refresh tokens) stored in your browser for as long as you remain logged in — used only to authenticate requests to our servers.
• Local browser storage (authenticated users): In addition to server-side storage, the application may store limited data in your browser (localStorage / sessionStorage) for performance and UX, including: a cache copy of workspace company details (to speed up invoice forms and keep fields in sync with what you have saved in your account), optional draft or convenience copies of invoice-related data such as client lists where the product uses the browser for smoother editing, your signed-in user profile snapshot, cookie / analytics consent choices, short-lived values for OAuth sign-in flows (for example LinkedIn state or callback handoff), UI preferences (for example dismissing onboarding or banners within a session), and navigation return paths in sessionStorage where the app needs to restore your place after preview flows. Authoritative business data remains in our database; browser copies are ancillary and may be cleared by logging out, clearing site data, or through your browser settings. If you are unsure what is stored locally, use your browser's site-data tools or contact us.

2.5 Communication Data

If you contact us or receive email from us, we may collect and process:

• Support messages — collected to help resolve issues
• Feedback — feature requests and bug reports you voluntarily share
• Transactional email — billing receipts, security alerts, invoice delivery, legal or policy notices, and other messages required to operate the Service (these cannot be opted out of while your account remains active)
• Product and marketing email — feature announcements, product tips, promotions, and feedback or survey requests sent via Resend (including Resend Contacts for marketing lists). You may unsubscribe from these at any time using the unsubscribe link in each such email or by contacting support@effitrio.com

We add you to marketing lists only where permitted by law — typically where you have given consent (for example by opting in at signup or on a waitlist).

2.6 Sensitive Personal Information

In certain jurisdictions, financial data (bank account details, tax IDs) may be classified as sensitive personal information. We process this data only because you voluntarily enter it as part of using the Service and with your consent, or as required to fulfil the contract you have with us.

✅ What we DON'T do: We do not use third-party advertising trackers, do not sell your personal information, and do not share your data with advertisers for their own marketing. Product analytics: Where enabled, we may use PostHog (a third-party analytics service) to understand how the Service is used in aggregated or event form — only in line with your cookie / consent choices where applicable; see Section 10 and Section 13.

---

3. How We Process Your Information

We use your information for the following purposes:

• Service Delivery: To provide, maintain, update, and support all Effitrio features.
• Account Management: To create accounts, authenticate users, manage workspaces, reset passwords, and handle subscription changes.
• Data Persistence: To store business data securely in our database for access across devices and sessions.
• Communication: To send transactional messages, and — where permitted — product updates and feedback requests via Resend (see Section 2.5).
• AI Features: To power AI-assisted features (summarisation, insights, receipt scanning, chat) by processing data within your workspace via third-party AI providers (see Section 11).
• Credit and Usage Tracking: To track AI credit consumption, enforce plan limits, and display usage in your account.
• Analytics & Improvement: To understand usage patterns and improve product features, including through product analytics (for example PostHog) where you have consented or as otherwise permitted by law — we do not use this for third-party ad targeting.
• Security & Fraud Prevention: To detect, prevent, and address technical issues, unauthorised access, fraud, and data breaches.
• Legal Compliance: To comply with applicable legal requirements, audit obligations, and respond to lawful legal requests.

---

4. Legal Bases for Processing

For EU/EEA/UK Users (GDPR)

We process your personal data only when we have a valid legal basis:

For Canada Users (PIPEDA)

We process your information when you have given us specific or implied consent. You can withdraw consent at any time. In some exceptional cases (fraud detection, legal obligations, vital interests), we may process information without consent as permitted by applicable Canadian law.

---

5. Data Controller vs. Data Processor

This section clarifies a key distinction that governs how your data is handled:

When you use Effitrio's core features, we act in two distinct roles:

5.1 Effitrio as Data Controller

For data we collect directly — such as your name, email address, IP address, usage logs, and session data — Effitrio is the Data Controller. We determine the purposes and means of processing this data. This Privacy Policy governs such processing.

5.2 Effitrio as Data Processor

For data you upload into the Service on behalf of your business — including your clients' names, email addresses, phone numbers, bank account details, tax IDs, invoices, and financial records — you remain the Data Controller. Effitrio processes this data solely as a Data Processor on your instructions, as defined under GDPR Article 28.

When you send invoices or other messages to your clients through the Service, you are also the Data Controller for your clients' contact details; Effitrio and Resend process that data on your instructions to deliver the message.

We do not access, use, sell, or process this data for any purpose beyond providing the Service.

5.3 Data Processing Agreement (DPA)

EU/EEA business users may require a signed Data Processing Agreement (DPA) under GDPR Article 28. To request a DPA, contact: privacy@effitrio.com

---

6. Data Storage and Security

6.1 Data Storage for Registered Users

Your business data is stored in a PostgreSQL database provided by Supabase, together with object/file storage on Supabase for files you upload (for example receipt images and other documents tied to invoices or expenses). The public web application is hosted on Vercel; the API backend runs on Railway. Your data includes invoices, clients, expenses, projects, and workspace settings. You can access, modify, or delete many individual records at any time via your dashboard, subject to retention rules in Section 15.

Storage Duration: We retain your workspace data for as long as your account is active and as needed to provide the Service. Effitrio provides storage tools, not legal or tax archival services — you are responsible for exporting and maintaining your own copies of records you must keep under applicable law (see Section 15).

Upon account deletion, we securely delete your data within 30 days, except limited billing, security, or legally required records as described in Section 15.

6.2 Local browser storage and public tools (summary)

Public tools (no account): We offer free tools that you can use without creating an account (for example the ZUGFeRD e-invoice generator and other tools we may add over time). Data you enter in these flows is processed only to provide the requested output (such as a PDF, XML, or similar result) and is not stored in our database. Nothing is persisted on our servers from the no-login flow after that output is delivered to you. Results are returned directly to your browser unless the tool clearly states otherwise. You are solely responsible for saving any output you download.

Browser storage (all visitors): We may still use browser storage (localStorage / sessionStorage) as described in Section 2.4 — for example authentication tokens and profile cache when you are signed in, optional convenience copies of form fields on public tools, cookie / analytics consent, OAuth handoffs, and UI preferences. Clearing site data or logging out may remove these local copies without deleting account data held in our database.

6.3 Security Measures

We implement industry-standard security practices:

• Encryption in Transit: All connections use HTTPS/TLS 1.2+ encryption
• Encryption at Rest: Database encryption with secure key management
• Password Security: Passwords hashed using bcrypt with salt
• Authentication: JWT-based session management with secure token storage
• Access Controls: Role-based access control (RBAC) and workspace isolation
• Infrastructure: Frontend on Vercel; backend API on Railway; database and file storage on Supabase; background job orchestration via Inngest (thin event payloads only — see Section 10.4)
• Monitoring: Regular security audits and vulnerability assessments

6.4 Limitations

While we implement robust security measures, no system is 100% secure. We cannot guarantee absolute protection against all threats. During the beta phase, security measures are continuously enhanced based on feedback and best practices.

---

7. GDPR Compliance — EU/EEA/UK/Swiss Users

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the GDPR:

7.1 Your Rights

• Right to Access: Request a copy of all personal data we hold about you
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request that we limit how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format (JSON or CSV)
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time without affecting prior processing
• Right Not to Be Subject to Automated Decision-Making: If a decision with significant legal effects is made solely by automated means, you may request human review

7.2 Exercising Your Rights

To exercise any GDPR rights, contact: privacy@effitrio.com

Include your request details and account email. We will verify your identity and respond within 30 days (or notify you of any delay). You may also submit a data subject access request at any time.

7.3 Supervisory Authority

If you are dissatisfied with our response, you have the right to lodge a complaint with your local data protection authority (typically in your country of habitual residence, place of work, or the place of the alleged infringement). For example, users in Germany may contact the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg at www.baden-wuerttemberg.datenschutz.de. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk. Swiss residents may contact the Federal Data Protection and Information Commissioner (FDPIC).

---

8. United States Residents — Privacy Rights

8.1 Applicable States

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have specific privacy rights under applicable state law.

8.2 Categories of Personal Information Collected (Last 12 Months)

8.3 Your Rights (US Residents)

• Right to know whether we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies
• Right to request deletion of your personal data
• Right to obtain a copy of data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of sale of personal data — We do not sell your personal information
• Right to opt out of targeted advertising — We do not use targeted advertising
• Right to limit use of sensitive personal data (California)
• Right to appeal our decisions (see Section 8.5)

8.4 How to Exercise Your Rights

Submit a data subject access request or contact us at: privacy@effitrio.com

We will verify your identity before processing your request. You may designate an authorised agent to make a request on your behalf, provided they submit written, signed permission from you.

8.5 Appeals

If we decline your request, you may appeal by emailing privacy@effitrio.com with the subject "Privacy Rights Appeal." We will respond in writing with our decision and reasoning. If your appeal is denied, you may submit a complaint to your state attorney general.

8.6 California "Shine the Light" Law

California Civil Code Section 1798.83 permits California residents to request, once per year and free of charge, information about personal data disclosed to third parties for direct marketing purposes. We do not share personal data with third parties for their own direct marketing.

8.7 We Do Not Sell or Share Personal Information

We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information belonging to website visitors, users, or consumers.

---

9. Canada Residents — Privacy Rights

We process your information only when you have given specific or implied consent. You may withdraw consent at any time by contacting privacy@effitrio.com. In limited exceptional cases, applicable Canadian law may permit processing without consent (e.g., fraud investigations, legal obligations). We may disclose de-identified information for approved research or statistics projects subject to ethics oversight.

---

10. Data Sharing and Third-Party Processors

We do not sell, trade, or rent your personal information to third parties for marketing. We share your data only with service providers necessary to operate Effitrio. All third-party processors are bound by written data processing agreements.

10.1 Service Providers

We rely on the providers below to run the Service. Roles are split: your browser talks mainly to Vercel (frontend); the app calls our Railway backend; persistent data and uploaded files live in Supabase; other processors handle payments, email, AI, analytics, and background work. We use subprocessors only as needed to provide the features you use.

We may change or add AI subprocessors (for example switching between Mistral and OpenAI, or using region-specific endpoints) as part of normal Service operations without updating this Privacy Policy for each routine provider change, provided the nature of data shared remains as described in Section 11.

10.2 Legal Requirements

We may disclose your information when required by law, court order, or government regulation. We may also share information to:

• Protect Effitrio's intellectual property, privacy, and safety
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the rights, property, or safety of Effitrio, users, or the public
• Enforce legal obligations or this Privacy Policy

10.3 Business Transfers

If Effitrio is involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify users of any such change and any choices they may have.

10.4 Background jobs (Inngest)

We use Inngest to schedule and run asynchronous background work — for example executing an AI goal after you have approved it, or retrying a failed job. Inngest is a job orchestration layer, not our primary data store.

What Inngest receives

When we send an event to Inngest, the payload is intentionally minimal. Typical fields include:

• The event name (for example goal/execute)
• Resource identifiers such as goalId, workspaceId, and approvedByUserId
• Job metadata needed to schedule, deduplicate, or retry the task

What Inngest does not receive

Event payloads are not designed to carry your full business content. Inngest does not receive, by design:

• Full invoice bodies, line items, or client contact details
• Receipt images or OCR output
• Bulk exports of workspace financial data
• Raw third-party AI prompts containing unmasked PII (see Section 11)

Where the actual work runs

When Inngest triggers a job, our Railway backend loads the data it needs from Supabase (EU region) and performs the work inside our application. Third-party AI providers are called from our backend only when the feature requires it and in line with Section 11 — not because Inngest forwards your records to them.

If we add new background job types in the future, we will keep the same principle: identifiers and metadata through Inngest; business content stays in our database and API layer unless a specific feature (such as receipt OCR) explicitly requires otherwise.

---

11. AI-Powered Features

Effitrio uses third-party large language model (LLM) providers for AI-assisted features (for example invoice insights, Q&A-style assistance over your workspace data, receipt scanning / OCR, and AI goal planning). It also runs background workspace watchers that scan your data in our database and may propose follow-up goals — see Section 11.4 for how those differ from user-initiated AI.

Current primary provider: Mistral AI. We may also use comparable providers (for example OpenAI, including EU-region endpoints where available) as alternatives or backups for the same categories of features, without publishing a new Privacy Policy version for each routine provider or region change, provided processing remains as described in this Section.

Not every AI feature uses the same data path. The important distinctions are below.

11.1 Text and tool-based features (PII masking)

For features that send structured text or tool results from your workspace (for example summaries, insights, or chat built from invoice or expense records):

• PII masking: Before sending that content to an LLM provider, we mask personally identifiable information (PII). Names, email addresses, phone numbers, and similar fields are replaced with anonymous tokens (e.g., __PII_1__). The provider does not receive those real values in that pipeline.
• Tool-based access: The provider does not receive your full database. It receives only what is needed for the specific operation, via controlled tool calls.

11.2 Receipt scanning / image extraction (no PII masking on the image)

Shown at upload: Before you scan or bulk-upload receipts, the Service displays a short notice that receipt images are sent to our AI provider for OCR. Please read it before uploading.

When you use receipt scanning (extracting text and fields from a receipt photo or file), we send the receipt image itself to the configured provider's vision or OCR API so the model can read and return structured fields (merchant, amounts, dates, line items, etc.).

• No masking step is applied to the image: Whatever appears on the receipt — including merchant names, partial card numbers, addresses, or other legible text — is visible to the provider as part of the image. Treat receipt uploads accordingly; do not upload images you are not willing to have processed under the provider's applicable privacy policy (Mistral, OpenAI if used).

11.3 Common disclosures (all LLM-powered features)

• Provider retention: Each AI provider may retain API data for a limited period for abuse monitoring and service operation — see that provider's policy for current retention periods.
• No model training (business API): Where the provider's business API terms apply, your data is not used to train their public models in the manner described in those terms.
• Legal basis (GDPR): Processing is generally based on contract performance (Art. 6(1)(b)) where the feature is part of the Service you request, and/or consent where you choose optional AI features; applicable basis may depend on the feature and your jurisdiction. Background watchers and user-initiated AI are described separately in Section 11.4.

💡 In plain terms: For normal AI text features, we mask many PII fields before they leave our systems. For receipt photos, the whole image goes to the AI provider for OCR — so anything printed on the receipt may be processed there. Background watchers mostly scan your workspace in our database; they do not send your data to an AI provider unless you start a separate AI feature (see Section 11.4).

11.4 AI watchers, goal planner, and human approval (HITL)

Effitrio includes background AI watchers and an AI goal planner that help you follow up on invoices, expenses, and workspace hygiene. This section explains what runs automatically, what requires your action, and how human approval works.

What background watchers do

On a scheduled basis (for example daily), our backend scans your workspace data stored in our database — such as invoice status and due dates, draft invoices not yet sent, expenses missing receipts, unbilled time, and incomplete company or workspace setup. Watchers use rules and queries inside our application; they do not send your workspace data to a third-party LLM provider as part of the scan itself.

When a watcher finds something relevant, it may:

• Create an in-app alert in your Action Center (for example “overdue invoices” or “missing receipt”), or
• Create a goal — a proposed plan of one or more steps (for example drafting a payment reminder email) for you to review.

Typical watcher categories include finance (overdue payments, aging drafts, missing receipts, unbilled time), operations (low recent activity), and setup completeness (missing company or workspace details). We may add or adjust watchers over time; the principle remains: scan in our database → surface a suggestion → you decide what happens next.

AI goal planner (when you ask, or when a watcher proposes a goal)

There are two paths:

In both cases, the output is a goal with a summary and planned steps shown in the product. Nothing that affects your clients or sends external communications runs immediately unless the workflow is classified as low-risk and configured to auto-execute without approval (we use this sparingly; most mutating workflows require your approval).

Human-in-the-loop (HITL) — you approve before action

Goals that can change data, send emails, or otherwise affect third parties are designed to require your explicit approval before execution:

1. A goal is created and shown as awaiting approval in the Action Center (or equivalent UI).
2. You review the summary, impact, and planned steps.
3. Only after you approve does our backend queue execution (via Inngest — see Section 10.4) and perform the steps.
4. You may reject or ignore a proposed goal; no action is taken on your behalf.

You remain responsible for reviewing AI-generated or watcher-proposed content (for example reminder email text) before approval, consistent with Section 11.3.

Automated decision-making (GDPR Art. 22)

Watcher alerts and pending goals are suggestions and drafts, not binding decisions about you. Effitrio does not use fully automated processing that produces legal or similarly significant effects solely without human involvement. Where a proposed action could affect others (for example sending an invoice reminder to a client), your approval is required before it is carried out.

If you believe a feature should be reviewed by a person, contact privacy@effitrio.com.

What data watchers and goals may read

Within your workspace, watchers and goal planning may access categories you have entered, such as:

• Invoices: status, dates, amounts, numbers, linked client identifiers
• Clients: names and contact details needed for reminders or drafts
• Expenses: amounts, categories, vendors, receipt attachment status (not receipt OCR unless you separately use receipt scanning)
• Projects and time: billable flags and unbilled entries where applicable
• Workspace / company profile: completeness of setup fields

This processing is scoped to your workspace and is used only to operate the Service. For client personal data you enter, you remain the Data Controller (Section 5.2).

You must not use AI features in any way that violates the applicable provider's terms or policies.

---

12. Social Logins

Our Services may offer you the ability to register or log in using a third-party account (for example Google or LinkedIn). If you choose to do so, we will receive certain profile information from the provider, typically your name and email address. We use this information only to create and manage your Effitrio account. We are not responsible for the privacy practices of third-party providers — please review their privacy policies separately.

---

13. Cookies and Tracking Technologies

We use cookies, local storage, and similar technologies to:

• Maintain your session and authentication state (primarily via browser storage when you are signed in)
• Remember your preferences, including your cookie / analytics consent choice

Consent banner: We display a cookie consent banner on our website when you have not yet saved a choice. It lets you enable or disable optional analytics (PostHog) before saving. Analytics is off by default until you accept it in the banner (including via Accept with the Analytics category enabled). Necessary storage for operating the Service continues regardless of your analytics choice. For category details, see our Cookie and storage details page (linked from the banner).

Where you have accepted analytics, we may use PostHog (see Section 10) to collect product analytics events. PostHog may use first-party cookies and/or local storage as part of its SDK.

We do not permit third-party advertising trackers on our Service. You can also control cookies and site data through your browser settings; however, disabling necessary storage may affect Service functionality.

---

14. Do-Not-Track (DNT) Signals

Most web browsers include a Do-Not-Track ("DNT") feature to signal your preference not to have data about your online browsing activities monitored and collected. At this time, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals. If a standard is adopted that we are required to follow, we will update this Privacy Policy accordingly.

California law requires us to disclose this: we do not respond to DNT signals at this time.

---

15. Data Retention

Registered Users: We retain your workspace data for as long as your account is active and as needed to provide the Service. You are responsible for exporting and keeping independent copies of any records you must retain under applicable tax, accounting, or business law — Effitrio is not your statutory archive.

Upon account deletion, we securely delete your workspace data within 30 days, except where longer retention is required or permitted as set out below:

Local browser copies: Data held only in your browser (Section 2.4) is under your control; it may persist until you clear site data, revoke consent where relevant, or log out, depending on the type of storage. Removing local copies does not by itself delete your account or workspace data on our servers.

When we have no ongoing legitimate business need to process your personal information, we will delete or anonymise it. If deletion is not immediately possible (e.g., backup archives), we will securely isolate it from further processing until deletion occurs.

---

16. Children's Privacy

Our Service is not intended for individuals under the age of 16 (the minimum age for digital consent under GDPR) or under 18 in other jurisdictions. We do not knowingly collect personal information from minors. If you believe we have collected information from a child, please contact us immediately at privacy@effitrio.com and we will take prompt action to delete such data.

---

17. International Data Transfers

Our default for European users: We configure EU/EEA hosting and processing wherever the Service and our providers support it. Your workspace database, uploaded files, and core application data are stored in Supabase (EU region). Our primary AI provider, Mistral AI, processes data in the European Union (France). Product analytics, when enabled, uses PostHog with EU hosting where configured.

Because Effitrio uses specialist providers to run email, payments, hosting, and background jobs, some processing may still involve countries outside your country of residence — even when we choose EU regions. For example, a provider's support, billing, or backup systems may be operated from another jurisdiction. This is normal for cloud SaaS and does not mean we routinely send your business data to the United States.

When a transfer outside the EEA, UK, or Switzerland is necessary, we rely on appropriate safeguards under applicable data protection law — typically the EU Standard Contractual Clauses (SCCs) and, where required, supplementary measures. Safeguards apply mainly to:

You may request further information about international transfers or a copy of relevant SCCs at privacy@effitrio.com.

---

18. Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

• Notify the relevant supervisory authority within 72 hours as required by GDPR Art. 33
• Notify affected users without undue delay if the breach is likely to result in high risk to their rights and freedoms (GDPR Art. 34)
• Include in notifications: details of the breach, categories of data affected, likely consequences, and recommended security actions

---

19. Changes to This Privacy Policy

We may update this Privacy Policy at any time at our discretion.

How we notify you:

• Minor changes (for example clarifications, formatting, or updates that do not materially change how we collect or use your data) take effect when posted on this page. We update the "Last updated" date; we do not typically send email for minor changes.
• Material changes (for example new categories of data collected, new third-party processors that materially affect your privacy, or changes to your rights) will be posted on this page and, where practicable, communicated by email to your registered address.

Your acceptance:

• When you log in after an update, we may ask you to review and accept the current Terms and Privacy Policy before continuing to use account features.
• Continued use of the Service after changes take effect — including accepting on login or using the Service without objecting — constitutes acceptance of the updated policy.

We encourage you to review this policy periodically. Nothing in this Section limits any non-waivable rights you have under applicable data protection law.

---

20. How to Review, Update, or Delete Your Data

You can review or update your account information at any time by logging into your account settings.

Where available in the product, you may also use Settings → Account & Privacy (or equivalent) to request a data export of your workspace data and to initiate account deletion, subject to in-product confirmations and retention rules in Section 15.

To request deletion of your account and all associated data, or to submit a formal data subject access request (including where you prefer not to use self-service tools), contact: privacy@effitrio.com

We will verify your identity and respond within 30 days in accordance with applicable law.

---

21. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or our data practices:

---

This Privacy Policy was last reviewed and updated on June 21, 2026.