Legal

Privacy Policy

Last updated: 26 July 2026

1. Who we are (Data Controller)

The data controller for personal data processed on euroswitch.xyz is:
EuroSwitch — Rua S. Bartolomeu, Valongo, Porto, Portugal
Contact: contact@euroswitch.xyz

2. What data we collect

Account data (if you sign up): email address, hashed password or OAuth identifier, display name, timestamps.
Submissions: information you voluntarily submit about alternatives (name, URL, category, description). This is public content once approved.
Newsletter (opt-in): email address and subscription timestamp.
Technical logs: IP address (truncated), user-agent, request path, HTTP status — for security, abuse prevention and debugging.
Consent state & analytics (only with your consent): anonymous page views, referrer and category clicks. No cross-site tracking, no advertising cookies.

3. Legal bases (Art. 6 GDPR)

Contract (Art. 6(1)(b)) — account creation, submissions, admin tools.
Consent (Art. 6(1)(a)) — newsletter and non-essential analytics. Withdrawable at any time in the cookie preferences.
Legitimate interest (Art. 6(1)(f)) — technical logs for security, fraud prevention and directory integrity. Balanced against your rights.
Legal obligation (Art. 6(1)(c)) — tax, accounting, responding to authorities where required.

4. Retention

Account data: while the account exists, then 30 days.
Submissions: kept publicly as long as the alternative is listed.
Newsletter subscribers: until you unsubscribe.
Technical logs: 90 days.
Consent records: 12 months (proof of consent).

5. Recipients & processors

We rely on a deliberately short list of processors, and every one of them is established in the European Union:

Contabo GmbH (Germany) — server hosting. All application data and database files reside on this EU infrastructure.
OVHcloud (France) — domain registration and authoritative DNS.
PocketBase (self-hosted) — database and authentication. It runs inside our own container on the above infrastructure; it is not a third-party service.
Mistral AI (France) — used only by the internal admin curator and the content translator, on public directory entries. Your personal data is never sent to it.

We use no US-based processor, no CDN in front of the site, no advertising network and no data broker. We do not sell, rent or share your personal data.

6. International transfers

There are none. All personal data is stored and processed within the European Union, by processors incorporated in the European Union, and is therefore not subject to the US CLOUD Act or FISA 702. If this ever changes we will update this policy before the change takes effect.

7. Your rights (Art. 15–22 GDPR)

Access, rectification, erasure ("right to be forgotten").
Restriction and objection to processing.
Data portability.
Withdraw consent at any time (does not affect prior processing).
Lodge a complaint with your supervisory authority — in Portugal the CNPD (cnpd.pt).

To exercise any right, email contact@euroswitch.xyz. We respond within 30 days.

8. Cookies

We use a minimal set of cookies and localStorage keys. Non-essential categories (analytics, marketing) are disabled until you opt in via the consent banner. See .

9. Security

We use TLS 1.3, encrypted database backups, role-based access control, rate limiting and human-verification challenges on sensitive endpoints.

10. Children

EuroSwitch is not directed to children under 16 and we do not knowingly collect their data.

11. Changes

We may update this policy. Material changes will be announced on the site at least 14 days before taking effect.