EYBA.AI Privacy Policy

Last updated: August 26, 2026

1. Who we are

This Privacy Policy explains how EYBA OÜ ("EYBA", "we", "us" or "our") collects, uses, shares and protects personal data when you access or use EYBA.AI (the "Service").

EYBA OÜ
Registry code: 16827612
VAT number: EE102660924
Address: Rätsepa tee 5, Järveküla, Rae vald, Harju County 75304, Estonia
Email: team@eybaglobal.com

Data Protection Officer: Ivan Yanush Gonchev
Privacy enquiries may be sent to: team@eybaglobal.com

For the personal data that EYBA determines how and why to process, EYBA acts as the data controller within the meaning of the EU General Data Protection Regulation ("GDPR").

In some circumstances, particularly where a business customer submits personal data concerning its employees, customers, partners or other individuals for the customer's own business purposes, the customer may act as the controller and EYBA may act as a data processor on the customer's behalf.

Where required, such processing may be governed by a separate Data Processing Agreement.

2. What data we collect

Account and subscription information

When you create or use an account, we may process:

• your name;
• email address;
• company or organisation;
• professional role;
• country;
• account settings;
• subscription and plan information; and
• authentication and account identifiers.

Business and market data

EYBA.AI allows users to submit business information for market evaluation, internationalisation analysis, market scoring and related decision support.

This may include:

• company information;
• products or services;
• target markets;
• existing markets;
• export experience;
• market-entry objectives;
• business capabilities and resources;
• certifications or market requirements;
• evaluation criteria;
• readiness assessments; and
• other information you choose to provide.

Company information is not necessarily personal data. It becomes personal data where it relates to an identified or identifiable natural person.

AI interactions and Customer Content

When you use AI-assisted functions, we may process:

• prompts and questions;
• assessment responses;
• information entered into the platform;
• files or documents you upload;
• AI-generated analyses and responses;
• market scoring explanations; and
• interaction history required to provide the Service.

Please do not submit special-category or highly sensitive personal data unless it is genuinely necessary, lawful and appropriate for the intended use.

EYBA.AI is not designed for processing sensitive medical, biometric, political, religious or similar special-category personal data.

Technical and usage data

When you use the Service, certain technical information may be collected automatically, including:

• IP address;
• browser and device information;
• operating system;
• date and time of access;
• pages or features used;
• session information;
• error and diagnostic information;
• security logs; and
• cookie or similar technology identifiers.

Communications

When you contact us, we may process your contact details together with the content of your enquiry, feedback or support request.

Payment information

Paid subscriptions are processed through Stripe Managed Payments.

Depending on the transaction, Stripe and/or Link may process:

• billing information;
• payment method information;
• transaction information;
• billing address;
• tax-related information; and
• payment status.

EYBA does not directly store your full payment card number.

3. Why we process personal data

We process personal data only where there is an appropriate legal basis.

To provide EYBA.AI

We process information necessary to:

• create and manage user accounts;
• provide market assessment and validation tools;
• generate AI-assisted analyses;
• provide market scoring and reports;
• store projects and previous analyses;
• manage subscriptions; and
• provide customer support.

Legal basis: performance of a contract or taking steps at your request before entering into a contract, GDPR Article 6(1)(b).

To operate and secure the Service

We may process technical information, logs and limited usage data to maintain the Service, detect abuse, troubleshoot problems and protect EYBA.AI and its users.

Legal basis: EYBA's legitimate interests in operating and securing the Service, GDPR Article 6(1)(f).

To improve EYBA.AI

We may analyse how features are used and perform technical and statistical analysis to improve functionality, usability, reliability and our decision-support methodology.

Where reasonably possible, we use aggregated or de-identified information for these purposes.

Legal basis: legitimate interests, GDPR Article 6(1)(f).

Payments, taxation and accounting

We process information required to manage subscriptions and comply with applicable financial, accounting and tax requirements.

Legal basis: performance of a contract and compliance with legal obligations, GDPR Articles 6(1)(b) and 6(1)(c).

Marketing and product communications

We may send information about EYBA.AI, related products or similar EYBA services where permitted by applicable law.

Where consent is required, we rely on your consent.

Where applicable law allows communications to an existing customer or a legal person without prior consent, we may rely on legitimate interests, provided that an easy and free opt-out is available.

You may unsubscribe from marketing communications at any time.

Cookies and optional analytics

Where non-essential cookies or similar technologies require consent, they will be used only after the required consent has been obtained.

Legal basis: consent, GDPR Article 6(1)(a).

4. Artificial intelligence and Anthropic

EYBA.AI uses artificial intelligence to provide certain market analysis, scoring explanations, recommendations and conversational functionality.

EYBA currently uses the Anthropic Claude API as an AI service provider.

Information required to generate a requested AI response may therefore be transmitted to Anthropic for processing.

This may include:

• business and market information submitted by you;
• prompts;
• relevant assessment results; and
• contextual information required to generate the requested output.

Anthropic acts as a service provider for the commercial API functionality.

Under Anthropic's current commercial API data practices, inputs and outputs from commercial services are not used to train Anthropic's general-purpose models by default, unless the customer expressly opts into a relevant training or feedback arrangement.

Unless EYBA and Anthropic have agreed a different retention arrangement, Anthropic states that API inputs and outputs are automatically deleted from its backend within approximately 30 days, subject to exceptions including legal obligations and enforcement of Anthropic's usage policies.

EYBA may use aggregated or de-identified information derived from use of the Service to improve EYBA.AI, its methodologies and its functionality.

5. AI transparency and automated decisions

EYBA.AI uses AI to support business decision-making.

Users will be informed when they are directly interacting with an AI-powered feature where required by applicable law.

AI-generated analyses may contain errors, incomplete information or inaccuracies. EYBA.AI is therefore designed as a decision-support tool, not as an autonomous decision-maker.

EYBA.AI does not make solely automated decisions about individuals that produce legal effects or similarly significant effects within the meaning of GDPR Article 22.

6. Who we share personal data with

We disclose personal data only where necessary for operating the Service, fulfilling our contractual obligations or complying with law.

Recipients may include:

We do not sell personal data.

Service providers that process personal data on our behalf are required to handle data in accordance with applicable data protection requirements and relevant contractual obligations.

7. International data transfers

Some of EYBA's technology providers may process personal data outside Estonia or the European Economic Area ("EEA").

In particular, Anthropic currently states that commercial customer data may be processed using infrastructure in several geographic regions, while data storage for its commercial services is generally located in the United States unless otherwise agreed.

Where personal data is transferred outside the EEA and the recipient country is not covered by an adequacy decision, EYBA uses or relies on an appropriate transfer mechanism where required, such as:

• European Commission Standard Contractual Clauses;
• an applicable adequacy decision;
• the EU-US Data Privacy Framework, where applicable; or
• another lawful transfer mechanism under the GDPR.

8. How long we retain data

We retain personal data only for as long as necessary for the relevant purpose or as required by law.

Account information

Account information is generally retained while the account remains active.

After account closure, information that is no longer required is deleted or anonymised, subject to applicable backup cycles, legal requirements and the need to establish or defend legal claims.

Business and market data

Business and market information stored in your EYBA.AI account is retained so that you can access your projects and historical analyses.

You may request deletion of this information, subject to technical, contractual and legal retention requirements.

Anthropic API data

Unless a different arrangement applies, Anthropic currently states that standard commercial API inputs and outputs are automatically deleted from its backend within approximately 30 days, subject to specified legal and usage-policy exceptions.

Billing and accounting data

Accounting and transaction records are retained for the period required by applicable Estonian accounting and tax law, generally seven years where applicable.

Marketing information

Marketing contact information is processed until you unsubscribe, withdraw consent or otherwise object.

We may retain limited information necessary to record and respect an opt-out request.

Security and support information

Security logs and support records are retained only for as long as reasonably necessary to secure the Service, resolve the relevant issue, comply with legal requirements or establish or defend legal claims.

9. Cookies and similar technologies

EYBA.AI may use cookies, local storage and similar technologies.

Essential technologies

These may be necessary for:

• authentication;
• account security;
• session management;
• core platform functionality; and
• remembering privacy or service preferences.

Essential technologies may be used without optional consent where permitted by law because the requested Service cannot function properly without them.

Optional analytics and similar technologies

Non-essential analytics or tracking technologies will be used only where permitted by applicable law and, where required, after consent has been obtained.

Users must be able to reject optional technologies and later change their preferences.

Cookie settings may also be controlled through the relevant consent interface and browser settings.

10. Your rights

Subject to the conditions and limitations in applicable data protection law, you may have the right to:

• access personal data concerning you;
• correct inaccurate or incomplete information;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• receive certain personal data in a portable format;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a competent supervisory authority.

Withdrawal of consent does not affect processing carried out lawfully before the withdrawal.

To exercise your rights, contact:

team@eybaglobal.com

We may request information reasonably necessary to verify your identity before fulfilling a request.

11. Customer responsibility for third-party data

If you submit personal data concerning another person to EYBA.AI, you are responsible for ensuring that you have the right and an appropriate legal basis to do so.

Where EYBA processes such information solely on behalf of a business customer, the customer remains responsible for its obligations as controller, including providing any privacy information required by applicable law.

12. Data security

EYBA uses appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.

Measures may include:

• encrypted transmission;
• access controls;
• authentication controls;
• technical logging;
• restricted administrative access; and
• appropriate infrastructure security measures.

No online service can guarantee absolute security.

13. Children's privacy

EYBA.AI is designed primarily for business and professional use.

Independent user accounts are intended for persons aged 18 or older.

We do not knowingly collect personal data from children through independent EYBA.AI accounts.

14. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to:

• EYBA.AI functionality;
• technology providers;
• data-processing practices;
• applicable law; or
• regulatory requirements.

The current version will always show the date on which it was last updated.

If a change materially affects existing users' personal data, we will provide additional notice where required.

15. Contact and complaints

For questions concerning this Privacy Policy or EYBA's processing of personal data:

EYBA OÜ
Registry code: 16827612
Rätsepa tee 5
Järveküla, Rae vald
Harju County 75304
Estonia

Email: team@eybaglobal.com

Data Protection Officer: Ivan Yanush Gonchev

You also have the right to lodge a complaint with:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)

or with another competent data protection supervisory authority in the EU/EEA.