What EudrFlow collects, why, who controls it, and the choices you have. Last updated 27 September 2026.
EudrFlow is operated by Li Dong, who acts as the data controller for personal data processed directly through EudrFlow. EudrFlow directly collects: assessment purchase data, product support communications and anonymous usage analytics. Contact: hello@eudrflow.com.
We collect only what is needed to respond to you and operate the service.
Files used in the free Readiness Checker and GeoJSON Validator are processed locally in the browser and are not uploaded to EudrFlow servers. Files submitted for a paid assessment are uploaded securely to EudrFlow for automated processing. For bounded second-line review, EudrFlow sends structured evidence-presence signals, validation codes and opaque record identifiers through Vercel AI Gateway to OpenAI and Anthropic. Raw uploaded files, supplier names, email addresses, coordinates and document text are not included in those model requests. Paid assessment files are not processed only in your browser.
We use Umami, a privacy-focused, cookie-less analytics tool hosted on our own instance. It records anonymous page and feature-usage events only. We never send supplier names, email addresses, coordinates, file contents or evidence content to analytics.
Waffo Pancake acts as Merchant of Record and authorized reseller. For payment, billing, transaction, tax, fraud, refund, chargeback and related Merchant of Record transaction data, Waffo Pancake is an independent controller responsible for that data under its own Privacy Policy — it is not a data processor acting for EudrFlow. Payment card data is handled through Waffo Pancake and is not stored on EudrFlow servers.
Assessment purchase data is used to create and reconcile the one-time assessment payment, and paid assessment profile information and source files are used to provide the purchased assessment service (GDPR Art. 6(1)(b)). Anonymous analytics support product improvement (legitimate interest, Art. 6(1)(f)).
Retention periods are defined per data type — see our Data retention page for the per-category table, including assessment purchase data, paid assessment source files and support communications.
Some service providers (hosting, email) may process data outside the EEA. Where this occurs, transfers rely on the safeguards those providers offer under applicable data-protection law.
You may request access, correction, deletion, restriction or portability of your personal data, and object to processing. Email hello@eudrflow.com and we will respond within 30 days. You may also lodge a complaint with your local supervisory authority.
To delete an assessment payment request, paid assessment source files or any personal data we hold about you, email hello@eudrflow.com with the subject “Deletion request”.