Privacy Policy

1. Data Controller

WheresMyMEP ApS (“we”, “us”, “our”) is the data controller for personal data processed through the Lex intelligence platform (“Service”). You can contact us at privacy@wheresmymep.eu.

2. Data We Process

We process the following categories of personal data:

• Account data: email address, password (hashed), account creation date
• Company profile: company name, industry sector, EU member state presence, revenue band, and regulatory profile fields you provide during onboarding
• Usage data: aggregate page views and product events (for example “scan started” or “signup started”), measured with Vercel Web Analytics — see section 7
• Anonymous visitor data: if you use the public parts of the Service without an account, we create an anonymous account (a random ID, no email) so we can apply the free-usage limit and carry your work over if you later sign up. Where no such session is available, we use your IP address to apply that limit.
• Communication data: any messages you send to us via email

We do not process special categories of personal data (e.g. health data, political opinions of individuals).

3. Legal Basis

We process your data on the following legal bases under GDPR:

• Contract performance (Art. 6(1)(b)): to provide and operate the Service you signed up for
• Legitimate interests (Art. 6(1)(f)): aggregate, cookieless product analytics, free-usage limits and fraud prevention
• Legal obligation (Art. 6(1)(c)): where required by Danish or EU law

4. Data Sharing

We share data with the following categories of processors:

• Supabase Inc. (database hosting and authentication, EU region)
• Anthropic PBC (AI model API — only company profile and policy file metadata, no personal end-user data)
• Vercel Inc. (hosting, CDN and Vercel Web Analytics)

We do not use PostHog, DataFast or any other third-party analytics, advertising or tracking service.

We do not sell personal data to third parties.

5. Retention

We retain account data for the duration of your subscription plus 90 days after termination, unless a longer period is required by law. You may request deletion at any time.

6. Your Rights

Under GDPR you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erasure (“right to be forgotten”)
• Data portability
• Object to processing based on legitimate interests
• Lodge a complaint with Datatilsynet (the Danish Data Protection Authority)

To exercise your rights, email us at privacy@wheresmymep.eu. We respond within 30 days.

7. Cookies and Analytics

We set only strictly necessary cookies. We do not use advertising or tracking cookies.

• Supabase session cookie (sb-<project>-auth-token, sometimes split into .0, .1 parts): holds your sign-in session. It is also set for visitors without an account when they open most pages of the site (including the homepage), because we give each visitor an anonymous session (see section 2) to apply the free-usage limit and keep your work if you sign up. First-party; it can last up to 400 days.

Vercel Web Analytics measures page views and product events in aggregate. It does not use cookies.

We also keep a few non-tracking values in your browser’s local storage (for example interface preferences, a daily free-question counter, and the campaign tags of a link to our signup page, which are attached to your account if you sign up). These are not shared with third parties.

8. Governing Law

This policy is governed by Danish law and the EU General Data Protection Regulation (GDPR). Any disputes shall be subject to the jurisdiction of the courts of Copenhagen, Denmark.

9. Changes

We may update this policy. Material changes will be communicated by email to registered users at least 14 days before taking effect.