1. Introduction
This Privacy Policy explains how personal data is handled when you visit the EuroData Score website, create an account, purchase access, upload datasets or contact support. EuroData Score is a web-based data analytics application.
The controller responsible for your personal data (“we”, “us”) is:
- Legal name: M & A Group LTDA (trade name: M & A Group)
- Registration: CNPJ 62.977.259/0001-44 · Inscrição Estadual SP 156.148.811.111
- Registered address: Rua Sta Cruz, 2187, Vila Mariana, São Paulo – SP, 04121-002, Brazil
- E-mail: support@eurodatascore.com
- Telephone: +55 12 98114-7758
For privacy matters, contact support@eurodatascore.com. Under the Brazilian General Data Protection Law (LGPD), this address is also the channel for communication with our data protection contact (encarregado).
2. Information We Collect
- Account information: your name, e-mail address and a password hash (we never store your password in readable form), plus whether your e-mail address has been verified and whether you completed onboarding.
- Contact details and support communications: the name, e-mail address, category, subject and message you send through our contact or support forms or by e-mail, and our replies.
- Purchase information: when Mundpay confirms a payment, we receive and store the purchase e-mail address, Mundpay's transaction identifier, product, amount, currency, status (for example paid or refunded) and relevant dates. We do not receive or store full payment card numbers or security codes.
- Authentication data: session identifiers (stored only as cryptographic hashes), session expiry dates, the browser user-agent string of each session, and one-time tokens for account activation and password reset (also stored only as hashes).
- Technical and security logs: our hosting provider processes standard request data such as IP address, date and time, requested URL and browser user agent. We keep an audit log of security-relevant account events (for example account creation, sign-in-related events, access granted or revoked). For rate limiting we store hashed identifiers derived from IP addresses or e-mail addresses, not the raw values.
- Uploaded datasets: the content of the CSV or JSON files you upload, after parsing (see section 5), together with the dataset name, original file name, size, record and column counts, and the analyses and reports you save.
- Usage analytics: we do not use analytics, advertising or tracking tools on the website or in the application.
3. How We Use Information
- Account management: creating and maintaining your account, verifying your e-mail address and keeping you signed in.
- Providing software access: linking confirmed purchases to your account and checking, on every request, that you are entitled to use the analytics workspace.
- Dataset processing: storing your datasets and saved results so you can analyze them, and returning them only to you.
- Customer support: answering questions, handling refund requests and resolving technical problems.
- Transaction administration: recording purchases and refunds and keeping billing records required by law.
- Transactional e-mails: activation links, password resets, purchase and refund confirmations, and support confirmations. We do not send marketing e-mails.
- Security: preventing abuse, fraud and unauthorized access, including rate limiting and audit logging.
- Product improvement: we improve the product based on support conversations and our own testing. We do not analyze the contents of your datasets for this purpose.
4. Legal Bases
Where the EU/EEA General Data Protection Regulation (GDPR) applies, we rely on the following legal bases under Article 6(1):
- Performance of a contract (b): account management, providing access, processing your datasets, transactional e-mails and support.
- Legal obligation (c): keeping billing and tax records and responding to lawful requests from authorities.
- Legitimate interests (f): security, fraud prevention, rate limiting and audit logs, and defending legal claims. You may object to processing based on legitimate interests (see section 10).
- Consent (a): where we ask for it — for example, if you choose to use an optional feature that sends information to a third party. You can withdraw consent at any time.
Where the Brazilian LGPD applies, the corresponding legal bases under Article 7 are: performance of a contract (V), compliance with a legal or regulatory obligation (II), legitimate interest (IX), the regular exercise of rights (VI) and consent (I).
5. Uploaded Dataset Privacy
Your datasets belong to you. This section explains exactly what happens to them.
What is stored and where
When you upload a CSV or JSON file, it is transmitted over an encrypted HTTPS connection to our server, where it is validated against our upload limits (5 MB per file, 50,000 rows, 100 columns) and parsed into a table. We store the parsed table — not the original file — in our PostgreSQL database, hosted by Neon, linked to your account. Saved analyses and reports are stored in the same way.
Where calculations run
Statistical calculations, charts and filters are computed in your own browser, using the data loaded from your account. They are not sent to external analytics services.
Who can access them
Only you. Every request for a dataset is checked on the server against your signed-in account, and one account cannot read another account's data. Our staff do not access the contents of your datasets, except when you ask us to look at a specific dataset to resolve a support request, or when we are required to do so by law.
How long they are kept and how they are deleted
Datasets are kept until you delete them. You can delete an individual dataset at any time on the Datasets page, delete all workspace data, or delete your account in Settings. Deletion removes the data from our live database immediately. Copies may remain in our hosting providers' backups until those backups expire under the providers' standard backup rotation.
External AI providers
By default, your datasets are not sent to any AI provider. If the optional “AI-Assisted Interpretation” feature is available in your workspace and you choose to use it, only computed summary statistics and column names — not the rows of your dataset — are sent to Anthropic's API to generate a plain-language explanation, at the moment you request it.
Model training and other uses
We do not sell your datasets, do not use them for advertising, and do not use them to train artificial intelligence models. Avoid uploading special categories of personal data (for example health data) or other people's personal data unless you are permitted to process it.
6. Third-Party Service Providers
We share personal data only with service providers that help us operate EuroData Score, and only to the extent needed for that purpose:
| Provider | Purpose | Data involved |
|---|---|---|
| Vercel Inc. | Hosting the website and application | Request data, all data processed by the application |
| Neon | Database hosting | Account data, purchase records, datasets, analyses, reports, support messages, logs |
| Mundpay | Checkout and payment processing | Data you enter on Mundpay's checkout; Mundpay sends us purchase confirmation details |
| Resend | Sending transactional e-mails | Your e-mail address and the content of the e-mail |
| Anthropic | Optional AI-Assisted Interpretation, only if available and used | Summary statistics and column names you choose to submit |
| Mundpay and Google Fonts | Displaying Mundpay's “secure purchase” badge on our pages | Standard request data (IP address, browser user agent) when the badge and its font load |
When you pay, you enter your payment details directly on Mundpay's checkout, which is governed by Mundpay's own privacy policy. We may also disclose data where required by law, to protect our rights, or in connection with a corporate reorganization, subject to this policy.
8. International Data Transfers
We are based in Brazil, and our service providers may process data in other countries, including countries outside the European Economic Area. Where personal data is transferred internationally, we rely on appropriate safeguards required by applicable law, such as standard contractual clauses where applicable, and on the legal mechanisms for international transfer provided by the GDPR and the LGPD.
9. Retention Periods
| Data | Retention |
|---|---|
| Account information | While your account exists; deleted when you delete your account |
| Datasets, analyses and reports | Until you delete them or your account |
| Sessions and one-time tokens | Until they expire or you sign out (sessions last up to 30 days) |
| Support messages | Up to 24 months after the request is closed |
| Security and audit logs | Up to 12 months |
| Purchase and billing records | As required by tax and accounting law (in Brazil, generally 5 years), even after account deletion |
10. Data Subject Rights
Depending on where you live, you have rights over your personal data, including the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate or incomplete data;
- delete your data (subject to legal retention obligations);
- receive your data in a portable, machine-readable format;
- object to or request restriction of processing based on legitimate interests;
- withdraw consent at any time, where processing is based on consent;
- under the LGPD, obtain confirmation of processing, information about sharing, and anonymization or blocking of unnecessary data.
Many of these rights can be exercised directly in Settings, where you can update your name, export your data as JSON, delete datasets and delete your account. For any other request, contact support@eurodatascore.com or use the contact form. We may need to verify your identity before acting on a request.
You also have the right to lodge a complaint with a supervisory authority — in the EU/EEA, the data protection authority of your country of residence; in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD).
11. Security Measures
We use technical and organizational measures appropriate to the data we process, including:
- encrypted HTTPS connections, with HTTP Strict Transport Security in production;
- password hashing with scrypt; session tokens and one-time tokens stored only as SHA-256 hashes;
- httpOnly, SameSite session cookies and server-side authorization on every request, with data isolated per account;
- rate limiting on sign-in, sign-up, password reset and contact forms, and server-side input validation;
- an audit log of security-relevant account events.
No system is completely secure. More detail is available on our Security page.
12. Children's Privacy
EuroData Score is not directed to anyone under 18 years of age, and purchases may only be made by adults with full legal capacity. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
13. Changes to This Policy
We may update this policy when our practices or legal requirements change. The “Last updated” date at the top shows the current version. If we make material changes, we will notify account holders by e-mail before the changes take effect.
14. Contact Information
For any question or request about this policy or your personal data, contact:
- Legal name: M & A Group LTDA (trade name: M & A Group)
- Registration: CNPJ 62.977.259/0001-44 · Inscrição Estadual SP 156.148.811.111
- Registered address: Rua Sta Cruz, 2187, Vila Mariana, São Paulo – SP, 04121-002, Brazil
- E-mail: support@eurodatascore.com
- Telephone: +55 12 98114-7758
Privacy contact: support@eurodatascore.com
Questions about this document? Contact us at support@eurodatascore.com or visit the Support Center.