Legal
Data Processing & Sub-processors
Version 2026-06-16. NEB RADAR is operated as a public-interest digital commons. This page explains how personal data is processed under the EU GDPR.
Controller
The NEB RADAR project team acts as data controller for all personal data processed through this service. For Data Subject Requests (access, rectification, erasure, portability, objection) email privacy@neb-radar.eu. We respond within 30 days.
Sub-processors
We notify users in-app at least 14 days before adding or replacing a sub-processor.
| Sub-processor | Purpose | Location | Transfers |
|---|---|---|---|
| Lovable Cloud (Supabase, EU region) | Hosting, database, authentication, storage | European Union | None outside EEA |
| Mistral AI | LLM provider for narratives, recommendations, Concierge | France (EU) | None outside EEA |
| Paddle.com Market Ltd. | Merchant of Record for subscriptions (test mode during Beta) | United Kingdom / EU | Adequacy decision (UK) + SCCs where applicable |
| Lovable AI Gateway | Development & preview environments only (Gemini models) | EU-routed | Not used in production |
Data categories
| Category | Examples | Lawful basis | Retention |
|---|---|---|---|
| Account data | Email, display name, avatar, role | Contract (Art. 6(1)(b)) | Until account deletion + 30 days backup |
| Assessment content | Project descriptions, scores, narratives, signals | Contract / Legitimate interest | Until user deletes the assessment or 5 years |
| Youth-mode content (minors) | Free-text reflections, scores by minors aged 13–17 | Consent (Art. 6(1)(a)) + Art. 8 GDPR safeguards | Until withdrawal of consent or 2 years inactivity |
| Telemetry & analytics | Page views, AI usage counts, errors | Legitimate interest (with opt-out) | 13 months max |
| Billing data | Plan, Paddle customer ID, invoices | Contract + Legal obligation (tax) | 10 years (EU tax law) |
AI processing
Free-text inputs (project descriptions, assessment notes, Concierge messages) are sent to Mistral AI (EU-hosted) for narrative generation. No personal data is used for model training. Youth-mode content uses a stricter system prompt with safeguarding controls — see the DPIA summary.
International transfers
Primary infrastructure is hosted in the European Union. Where a sub-processor operates outside the EEA, transfers rely on adequacy decisions or Standard Contractual Clauses with supplementary measures.
Your rights
You have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data. You may lodge a complaint with your national supervisory authority at any time.