Legal
Privacy Policy
Last updated: June 2026
This Privacy Policy explains how RECOSA collects, uses, and protects personal data when you use our website and AI-powered regulatory compliance platform.
1. Who we are
RECOSA (“we”, “us”, “our”) is an AI-powered regulatory compliance platform operated by a sole trader, based in Belgium.
Contact: contact@recosa.eu.
Website: https://recosa.eu.
What data we collect and why
1. Account data
When you create an account, we collect your email address and password (hashed). We use this to authenticate you and provide access to the platform.
Legal basis: Performance of a contract (Article 6(1)(b) GDPR)
2. Company profile data
When you set up your compliance profile, we collect your company name, sector, country, and company size. We use this to personalise your compliance experience and determine which regulations apply to you.
Legal basis: Performance of a contract (Article 6(1)(b) GDPR)
3. Usage data
We collect data about how you use RECOSA — questions asked, documents generated, audits run, and feature usage. We use this to improve the platform and monitor for abuse.
Legal basis: Legitimate interests (Article 6(1)(f) GDPR) — specifically, improving our service and protecting it from misuse
4. Chat and document content
Questions you ask and documents you generate are stored to provide the service (conversation history, document access). We do not use your content to train AI models.
Legal basis: Performance of a contract (Article 6(1)(b) GDPR)
5. Website analytics
We use privacy-friendly analytics on recosa.eu to understand how visitors use the site (page views, traffic sources). No personally identifiable information is collected for analytics purposes.
Legal basis: Legitimate interests (Article 6(1)(f) GDPR)
6. Contact form submissions
If you contact us via the contact form, we collect your name, email, and message. We use this solely to respond to your enquiry.
Legal basis: Legitimate interests (Article 6(1)(f) GDPR)
Who we share data with
We use the following sub-processors to deliver our service:
Processor
Purpose
Location
Supabase
Database and authentication
EU (Frankfurt)
Qdrant Cloud
AI knowledge base (vector database)
EU (Frankfurt)
Mistral AI
AI language model for compliance answers
France (EU)
Brevo
Transactional email
France (EU)
Streamlit (Snowflake)
Application hosting
EU region
We do not sell your data. We do not share your data with third parties for marketing purposes.
How long we keep your data
Data Type
Retention Period
Account data
Until account deletion
Company profile
Until account deletion
Chat history
Until you delete it or close your account
Generated documents
Until you delete them or close your account
Usage logs
12 months rolling
Contact form submissions
12 months
Your rights under GDPR
As an EU resident, you have the following rights:
Right of access — request a copy of your personal data
Right to rectification — correct inaccurate data
Right to erasure — request deletion of your data (“right to be forgotten”)
Right to restriction — ask us to limit how we process your data
Right to data portability — receive your data in a machine-readable format
Right to object — object to processing based on legitimate interests
To exercise any of these rights, email us at contact@recosa.eu. We will respond within 30 days.
If you believe we have not handled your data correctly, you have the right to lodge a complaint with your national data protection authority:
Belgium: Autorité de Protection des Données (APD) — apd-gba.be
France: Commission Nationale de l’Informatique et des Libertés (CNIL) — cnil.fr
Cookies
We use cookies to keep you logged in and to understand how you use our site. For full details, see our Cookie Policy.
Security
We implement appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), hashed passwords, and role-based access controls. We use EU-based infrastructure wherever possible.
Changes to this policy
We may update this policy from time to time. We will notify registered users of material changes by email. The date at the top of this page indicates when the policy was last updated.
Contact
For any privacy-related questions or requests:
Email: contact@recosa.eu
Address: Brussels, Belgium
RECOSA
AI-powered EU regulatory compliance for SMEs in Belgium, France, The Netherlands and across Europe.
Social media
© RECOSA 2026 - Software Made in Europe for European SMEs