Who we are
eubuilt.eu is published by the legal entity listed on our imprint page. The directory is curated in-house; reader submissions are welcome, but every editorial decision is made in-house.
What data we collect
We deliberately collect the minimum data needed to operate the directory:
When you visit a public page
- HTTP request logs. Web-server logs (IP address, user agent, requested URL, timestamp, response code) retained for 14 days for abuse handling and capacity planning. We never share these logs.
- No cookies, no fingerprinting, no third-party tracking. We don't use Google Analytics, Meta pixels, or any other third-party analytics on public pages.
- Aggregate analytics. If we run analytics, it's a self-hosted, cookieless instance of Plausible on EU infrastructure — no individual visitor profile is recorded.
When you submit a product
- Submission form data. Product details, your name, your email, and your stated relationship to the product. Stored in our database for as long as the submission is in our review queue and for up to 24 months after a decision for editorial reference.
- Submitter IP. Recorded for abuse prevention. Stored for 90 days.
- hCaptcha verification. If hCaptcha is enabled, your interaction with the captcha widget is processed by hCaptcha (Intuition Machines, Inc.). hCaptcha is currently the only non-EU vendor we rely on; we are evaluating EU alternatives. See hCaptcha's privacy policy.
When you sign in to the admin
- Login session. Email + argon2id-hashed password + signed session cookie (HttpOnly, Secure, SameSite=Lax). Sessions expire after 14 days of inactivity.
- Login attempt log. Timestamp and outcome of each login attempt for rate-limiting (5 failed attempts per minute → temporary lock).
Legal basis
Under GDPR Article 6, we rely on:
- Legitimate interest for HTTP request logs and abuse handling.
- Consent for submission form data and the contact form (you provide your details voluntarily to us).
- Contract for admin accounts (operating the platform).
Where data is stored
All eubuilt.eu data is stored on EU infrastructure (Hetzner Cloud, Falkenstein, Germany) and processed under EU jurisdiction. We do not export data to non-EU services.
Your rights
Under GDPR you have the right to access, rectify, delete, and obtain a copy of any personal data we hold about you. Email contact@eubuilt.eu with the subject "GDPR request" and we'll respond within 30 days.
Sub-processors
The full list of third-party services we use (e.g. transactional email provider, error tracking) is published at eubuilt.eu/sub-processors and is updated whenever we add or remove a vendor.
Changes to this policy
We'll post any material change to this page and update the "Last updated" date. Submitters and admin users are emailed if the change affects their data.